Drop invalid packets destined to bridge networks

[aboch]

Add a per network rule in the INPUT chain to drop packets marked invalid by conntrack.

Fixes #1090

As an example, in a two bridge networks scenario, following would be programmed:

$ sudo iptables -nvL INPUT
Chain INPUT (policy ACCEPT 211 packets, 40848 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  *      *       0.0.0.0/0            172.17.0.0/16        ctstate INVALID
    0     0 DROP       all  --  *      *       0.0.0.0/0            172.18.0.0/16        ctstate INVALID
$ 

Signed-off-by: Alessandro Boch [email protected]

[aboch]

Closing as this does not fix the issue.