apply iptables at the end