This allows us to distinguish between ingress and egress dst selectors (required when managing entries in default-allow ipsets).