uplink: use new network functions
uplink: ensure clamp-mss rule is first in forward chain