Fix match-set parsing

As for man iptables-extensions
```
       [!] --match-set setname flag[,flag]...
```
match-set must have two arguments.