iptables -t nat -A POSTROUTING -s 10.0.1.0/255.255.255.0 -j MASQUERADE 
iptables -A INPUT -i br0 -p tcp -m tcp --dport 67 -j ACCEPT 
iptables -A INPUT -i br0 -p udp -m udp --dport 67 -j ACCEPT 
iptables -A INPUT -i br0 -p tcp -m tcp --dport 53 -j ACCEPT 
iptables -A INPUT -i br0 -p udp -m udp --dport 53 -j ACCEPT 
iptables -A FORWARD -i br0 -o br0 -j ACCEPT 
iptables -A FORWARD -s 10.0.1.0/255.255.255.0 -i br0 -j ACCEPT 
iptables -A FORWARD -d 10.0.1.0/255.255.255.0 -o br0 -m state --state RELATED,ESTABLISHED -j ACCEPT 
iptables -A FORWARD -o br0 -j REJECT --reject-with icmp-port-unreachable 
iptables -A FORWARD -i br0 -j REJECT --reject-with icmp-port-unreachable