iptables: revert r40916