AA: iptables: backport r35898 (#13649)