Reconsider src_mac
In case of "normal" traffic (outgoing connection from local network to the internet), src_mac is mostly fine. But in case of incoming connection, when IP address is from WAN network, src_mac will be from the outer network as well, which is probably something we don't want. Also when router connects/sends something to the local network, we don't get any MAC address at all (this is due to NFQUEUE MAC address handling). This should be addressed somehow.