Move the definition of negate_networks/vpn_networks to its place and re-include ipsec vpns in this tables since scrub for mss clamping need this.