fix a typo in my netfilter commit - worked for iptables, didn't work for the kernel...