network ACL helpers;

just double-checking here: the `ingress` function takes no arguments and always sets `Egress` to `false`?