YAML-based dsl for iptables rules