[PATCH v2] spec: don't touch existing nwfilters on update