> and if the vm is shutdown, the tap chain is already removed on vm_stop. I would not rely on that. We need a way to correctly update rules without relying on previous state.