netfilter: let reset rules clean out conntrack entries