commit before messing with iptables