Comment 1 for bug 1263534

or, since that would require to be aware of the interface configuration and subsequent variation, it would have made sense making use of iptables' --in-interface and --out-interface parameters