ensure the right rules happen first

The basic ones in ::pre will allow network out. ::post did not guarantee that
those had been applied.