base/firewall: always declare a subnet chain