diff --git a/config/rootfiles/common/iptables b/config/rootfiles/common/iptables
index d7d87bee7..06e4ab7b4 100644
--- a/config/rootfiles/common/iptables
+++ b/config/rootfiles/common/iptables
@@ -13,15 +13,12 @@ lib/libipq.so.0.0.0
 #lib/libxtables.la
 lib/libxtables.so
 lib/libxtables.so.12
-lib/libxtables.so.12.6.0
+lib/libxtables.so.12.7.0
 #lib/xtables
 lib/xtables/libip6t_DNPT.so
 lib/xtables/libip6t_HL.so
-lib/xtables/libip6t_LOG.so
-lib/xtables/libip6t_MASQUERADE.so
 lib/xtables/libip6t_NETMAP.so
 lib/xtables/libip6t_REJECT.so
-lib/xtables/libip6t_SNAT.so
 lib/xtables/libip6t_SNPT.so
 lib/xtables/libip6t_ah.so
 lib/xtables/libip6t_dst.so
@@ -36,11 +33,8 @@ lib/xtables/libip6t_rt.so
 lib/xtables/libip6t_srh.so
 lib/xtables/libipt_CLUSTERIP.so
 lib/xtables/libipt_ECN.so
-lib/xtables/libipt_LOG.so
-lib/xtables/libipt_MASQUERADE.so
 lib/xtables/libipt_NETMAP.so
 lib/xtables/libipt_REJECT.so
-lib/xtables/libipt_SNAT.so
 lib/xtables/libipt_TTL.so
 lib/xtables/libipt_ULOG.so
 lib/xtables/libipt_ah.so
@@ -58,7 +52,10 @@ lib/xtables/libxt_DSCP.so
 lib/xtables/libxt_HMARK.so
 lib/xtables/libxt_IDLETIMER.so
 lib/xtables/libxt_LED.so
+lib/xtables/libxt_LOG.so
 lib/xtables/libxt_MARK.so
+lib/xtables/libxt_MASQUERADE.so
+lib/xtables/libxt_NAT.so
 lib/xtables/libxt_NFLOG.so
 lib/xtables/libxt_NFQUEUE.so
 lib/xtables/libxt_NOTRACK.so
@@ -66,6 +63,7 @@ lib/xtables/libxt_RATEEST.so
 lib/xtables/libxt_REDIRECT.so
 lib/xtables/libxt_SECMARK.so
 lib/xtables/libxt_SET.so
+lib/xtables/libxt_SNAT.so
 lib/xtables/libxt_SYNPROXY.so
 lib/xtables/libxt_TCPMSS.so
 lib/xtables/libxt_TCPOPTSTRIP.so
@@ -177,4 +175,5 @@ sbin/xtables-legacy-multi
 #usr/share/man/man8/iptables.8
 #usr/share/man/man8/nfnl_osf.8
 #usr/share/xtables
+usr/share/xtables/iptables.xslt
 usr/share/xtables/pf.os
diff --git a/lfs/iptables b/lfs/iptables
index 275559bfe..30c6e1d94 100644
--- a/lfs/iptables
+++ b/lfs/iptables
@@ -24,10 +24,10 @@
 
 include Config
 
-VER        = 1.8.8
+VER        = 1.8.9
 
 THISAPP    = iptables-$(VER)
-DL_FILE    = $(THISAPP).tar.bz2
+DL_FILE    = $(THISAPP).tar.xz
 DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
@@ -41,7 +41,7 @@ objects = $(DL_FILE) \
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 netfilter-layer7-v2.23.tar.gz = $(URL_IPFIRE)/netfilter-layer7-v2.23.tar.gz
 
-$(DL_FILE)_BLAKE2 = 0da021cc7313b86af331768904956dab3eee3de245a7b03965129f3d7f13097fc03fbb1390167dcd971eff216eabad9e59b261a9c0f54bfc48a77453aa40d164
+$(DL_FILE)_BLAKE2 = 37ba80be0ee7049c4d3ee5689b273b4d2cc6e6fb9ebb297e86976b5750f987f2ae4536013fe1749ae79b6989c241eaece3202019fafd47d842c7a4fe3e5093b1
 netfilter-layer7-v2.23.tar.gz_BLAKE2 = 5c8ab722f6fbc126f2f65ecf401de5fc40560c20e3be52f783db34410446185dcb6781b3148e4a174e8b2d2c290bec0342dea95e8cefc35c39345617fa7a8fdc
 
 install : $(TARGET)
@@ -72,7 +72,7 @@ $(subst %,%_BLAKE2,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) $(DIR_SRC)/netfilter-layer7*
-	@cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
+	@cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
 
 	# Layer7
 	cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-v2.23.tar.gz