pve-firewal rules

PVE stack: 6.4-13 (running kernel: 5.4.128-1-pve) How do I define a firewall rule, via the PVE firewall web frontend, that restricts incoming packets to tagged connections(conntrack) for a specific security group? A iptables rule equivalent would be: iptables -A INPUT -m conntrack --ctstate...