Skip ip address check if not hosts are configured
Match only state/NEW packets
Don't add duplicate netfiler rules, skip based on rule comment
Allow DNS with default rule
Update rule handling method, remove has_rule()