netfilter: ip6table_filter in netns for real