[backfire] netfilter: backport r20690, r20693 & r20694