AA: iptables: backport r35898 (#13649)

git-svn-id: svn://svn.openwrt.org/openwrt/branches/attitude_adjustment@36853 3c298f89-4303-0410-b956-a3cf2f4a3e73