Move IP filter to own patch and (messily) fix merge conflicts as a result.