diff --git a/netflow/iptables.sh b/netflow/iptables.sh
index f75b62e..d108686 100644
--- a/netflow/iptables.sh
+++ b/netflow/iptables.sh
@@ -17,7 +17,7 @@ __get_mount_paths_cgroup_id() {
 		fi
 	done
 }
-__get_mount_paths_cgroup_id
+# __get_mount_paths_cgroup_id
 
 __main() {
 	update-alternatives --set iptables /usr/sbin/iptables-legacy 2>/dev/null
@@ -29,6 +29,17 @@ __main() {
 	_owner_id=52000
 	_chain="output_netflow_owner_${_owner_id}"
 
+	for cmd in iptables ip6tables; do
+		$cmd -t mangle -N "$_chain" 2>/dev/null || true
+		if ! $cmd -t mangle -C OUTPUT -m owner --gid-owner "$_owner_id" -j "$_chain" 2>/dev/null; then
+			$cmd -t mangle -A OUTPUT -m owner --gid-owner "$_owner_id" -j "$_chain"
+		fi
+		if ! $cmd -t mangle -C "$_chain" -j RETURN 2>/dev/null; then
+			$cmd -t mangle -A "$_chain" -j RETURN
+		fi
+		$cmd -t mangle -L OUTPUT -v -n -x
+	done
+
 	for cgid in "${_cgroup_ids[@]}"; do
 		for cmd in iptables ip6tables; do
 			$cmd -t mangle -N "$_chain" 2>/dev/null || true