zones: add interface/subnet bound LOG rules