1*a71a9546SAutomerger Merge Workeriptables-translate -t filter -A INPUT -m cgroup --cgroup 0 -j ACCEPT 2*a71a9546SAutomerger Merge Workernft 'add rule ip filter INPUT meta cgroup 0 counter accept' 3*a71a9546SAutomerger Merge Worker 4*a71a9546SAutomerger Merge Workeriptables-translate -t filter -A INPUT -m cgroup ! --cgroup 0 -j ACCEPT 5*a71a9546SAutomerger Merge Workernft 'add rule ip filter INPUT meta cgroup != 0 counter accept' 6