iptables: set nonshared flag