[iptables] support negated rules