Fixup iptables a bit, move vars to group