iptables: use ALTERNATIVES for ip(6)tables(-nft)