ruleset_generate_vm_rule: avoid multiple calls to generate_nfqueue()