new config item allow_network for iptables and nat