kalua: hotplug: prevent DNS-aplification attac on WAN if needed via netfilter rules