refine the iptables setup