iptables: Use conntrack instead of state