fix iptables cleanup