Fix "--match set" support for newer iptables