avoid calls to iptables_rule_exist()