abf: exclude networks with deny rules