netfilter: bridge: start splitting mask into public/private chunks