netfilter: move tee_active to core