fix fragment handling in ip_filter