iptables: don't apply patches if building an external kernel