some further work on emitting iptables rulesets