[NETFILTER]: Convert ip_tables matches/targets to centralized error checking