Use separate iptables log levels for forward/input chains