allow ingress and egress to be specified by NetKAT predicate