reference input_rule and forward_rule
silence ipset duplicates and curl