make the whole iptables/netfiter modular (closes: #3871, #3527)