confine iptables rules to physical only