iptables: fix inversion flags