silly me ordering is not important here since we are in a firewall defer apply block  where the filter defer apply off will call  in iptables firewall setup chains apply setup chain  etc doing  update ipset members  and  generate ipset rule args later on 