firewall: link iptables extensions dynamically