iptables: install bakes the -A command