more netfilter fixes