[PATCH v3] spec: don't touch existing nwfilters on update