[iptables] bootstrap rules (fixes #431)
[binder] allow nonhashable collections