netfilter: support /proc conntrack flushing of specific ip addresses
netfilter: consider reply direction on selective flushing