base/firewall: fix up chain define