fix a couple of bugs, reduce the code complexity; don't create duplicate
iptables rules (oops!)