work around stupidness around iptables-save

if iptables / netfilter hasn't been touched since boot, iptables-save
output will be an empty string, which iptables-restore will ignore.