fixes race condition where an unnecessary DNS query fails after kernel
rules have already been flushed

eliminates source chains without proper destination chains (e.g. IPv6 addresses
with pass action and ulog)