Make the rule creation to use the same mechanism (via ensureRules) as other rules from filter/FORWARD. Otherwise, the rule is preceded by "-j WEAVE-EXPOSE" rule which can break the subnet isolation.
Make the rule creation to use the same mechanism (via ensureRules) as other rules from filter/FORWARD. Otherwise, the rule is preceded by "-j WEAVE-EXPOSE" rule which can break the subnet isolation.