Changes that seems to be needed only in migration script https://github.com/vyos/vyos-1x/blob/current/src/migration-scripts/firewall/10-to-11:
- Use accept action for base-chains (it's done, no change needed here).
- Migrate action=accept to action=return on every rule.
- fix order and ensure all "in" rules are applied first.