<filter name='allow-arp' chain='arp'> 
  <rule direction='inout' action='accept'/> 
</filter>
