Comment 16 for bug 595501

This series moves all libvirt rules into separate chains:

  https://www.redhat.com/archives/libvir-list/2018-November/msg00018.html

This makes it practical to install rules ahead of libvirt's rules in iptables default chains, without risk of libvirt constantly inserting more rules in front.