diff --git a/nodeup/pkg/model/firewall.go b/nodeup/pkg/model/firewall.go
index 6453bdbe4e..b87750b9db 100644
--- a/nodeup/pkg/model/firewall.go
+++ b/nodeup/pkg/model/firewall.go
@@ -73,13 +73,13 @@ func (b *FirewallBuilder) buildFirewallScript() *nodetasks.File {
 
 # The GCI image has host firewall which drop most inbound/forwarded packets.
 # We need to add rules to accept all TCP/UDP/ICMP packets.
-if iptables -L INPUT | grep "Chain INPUT (policy DROP)" > /dev/null; then
+if iptables -w -L INPUT | grep "Chain INPUT (policy DROP)" > /dev/null; then
 echo "Add rules to accept all inbound TCP/UDP/ICMP packets"
 iptables -A INPUT -w -p TCP -j ACCEPT
 iptables -A INPUT -w -p UDP -j ACCEPT
 iptables -A INPUT -w -p ICMP -j ACCEPT
 fi
-if iptables -L FORWARD | grep "Chain FORWARD (policy DROP)" > /dev/null; then
+if iptables -w -L FORWARD | grep "Chain FORWARD (policy DROP)" > /dev/null; then
 echo "Add rules to accept all forwarded TCP/UDP/ICMP packets"
 iptables -A FORWARD -w -p TCP -j ACCEPT
 iptables -A FORWARD -w -p UDP -j ACCEPT