npc: Add WEAVE-NPC-EGRESS-ACCEPT chain

For improving readability of NPC rules. The chain marks to-be-allowed egress
traffic.

prog/weave-npc/main.go

@@ -57,6 +57,10 @@ func resetIPTables(ipt *iptables.IPTables) error {
 		return err
 	}
 
+	if err := ipt.ClearChain(npc.TableFilter, npc.EgressMarkChain); err != nil {
+		return err
+	}
+
 	if err := ipt.ClearChain(npc.TableFilter, npc.EgressCustomChain); err != nil {
 		return err
 	}
@@ -136,6 +140,11 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
 		return err
 	}
 
+	if err := ipt.Append(npc.TableFilter, npc.EgressMarkChain,
+		"-j", "MARK", "--set-xmark", npc.EgressMark); err != nil {
+		return err
+	}
+
 	if err := ipt.Append(npc.TableFilter, npc.EgressChain,
 		"-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "RETURN"); err != nil {
 		return err