def floating_ebtables_rules(fixed_ip, network):
    """Makes sure only in-network traffic is bridged."""
    return [
        'PREROUTING --logical-in %s -p ipv4 --ip-src %s ! --ip-dst %s -j redirect --redirect-target ACCEPT'
         % (network['bridge'], fixed_ip, network['cidr'])], 'nat'
