POLICY:
fw      net    	ACCEPT
loc	fw      ACCEPT
loc   	loc 	ACCEPT
fw      loc   	ACCEPT

net    	fw      DROP
all     all     REJECT  info

RULES:
Web/DNAT  net       loc:192.168.1.1
DNAT	net	loc:192.168.1.1		tcp	22