iptables: add exception handling