I took a look into poly_pkt_fwd and implemented a prototype. That was easier than I thought.
Filtering works and keeps net id 00/01 inside of the local network.
I will test this implementation over the next weeks refine it and post a patch for poly_pkt_fwd.c here.