iptables.sh: add state filter condition