vrlan NEW-----------> [XX] lan
lan NEW-----------> [OK] vrlan
vrlan ESTABLISHED---> [OK] lan
config rule
option src 'vrlan'
option dest 'lan'
option target 'REJECT'
config rule
option src 'lan'
option dest 'vrlan'
option target 'ACCEPT'
config rule
option src 'vrlan'
option dest 'lan'
option ctstate 'ESTABLISHED'
option target 'ACCEPT'