fix iptable rules