cleaning up iptables spec