fix comment in iptables rules, fix reject