Fix various differences for rhel5

iptables 1.3.5 ships on rhel 5 and is really old. It doesn't support
`--comment` on ip6tables, doesn't support `-m socket` or `--random`, and
the format of netmasks uses subnet mask format instead of CIDR.