Maybe default via `krebs.iptables.defaults.versions`