Document netfilter DEFAULT:fw support