CC-580: Refactor iptables control into a separate library, and create a serviced chain