iptables: refactor how an existing rule is found