> > Yes, it's an optimization, to not test other tap chains in VMBR-OUT. > > If we use RETURN, we can reuse vmbr0-OUT for the hostfw? Oh, ignore me. It should work out of the box.