ip table: always remove first entry