correctly remove stale chains
use accept mark for security groups