Initial tunnel work
Sort iptables specs to avoid spurious reconfig