iptables: Ensure 'lo' always comes first