diff --git a/shadowsocks-go.sh b/shadowsocks-go.sh
index 4b74926..0fbfd44 100644
--- a/shadowsocks-go.sh
+++ b/shadowsocks-go.sh
@@ -189,7 +189,7 @@ function iptables_set(){
     if [ $? -eq 0 ]; then
         /etc/init.d/iptables status | grep '8989' | grep 'ACCEPT' >/dev/null 2>&1
         if [ $? -ne 0 ]; then
-            /sbin/iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 8989 -j ACCEPT
+            /sbin/iptables -I INPUT -m state --state NEW -m tcp -p tcp --dport 8989 -j ACCEPT
             /etc/init.d/iptables save
             /etc/init.d/iptables restart
         else
diff --git a/shadowsocks-libev.sh b/shadowsocks-libev.sh
index d5b17ea..717207d 100644
--- a/shadowsocks-libev.sh
+++ b/shadowsocks-libev.sh
@@ -148,7 +148,7 @@ function iptables_set(){
     if [ $? -eq 0 ]; then
         /etc/init.d/iptables status | grep '8989' | grep 'ACCEPT' >/dev/null 2>&1
         if [ $? -ne 0 ]; then
-            /sbin/iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 8989 -j ACCEPT
+            /sbin/iptables -I INPUT -m state --state NEW -m tcp -p tcp --dport 8989 -j ACCEPT
             /etc/init.d/iptables save
             /etc/init.d/iptables restart
         else
diff --git a/shadowsocks.sh b/shadowsocks.sh
index 3b8a733..7c1928e 100644
--- a/shadowsocks.sh
+++ b/shadowsocks.sh
@@ -161,7 +161,7 @@ function iptables_set(){
     if [ $? -eq 0 ]; then
         /etc/init.d/iptables status | grep '8989' | grep 'ACCEPT' >/dev/null 2>&1
         if [ $? -ne 0 ]; then
-            /sbin/iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 8989 -j ACCEPT
+            /sbin/iptables -I INPUT -m state --state NEW -m tcp -p tcp --dport 8989 -j ACCEPT
             /etc/init.d/iptables save
             /etc/init.d/iptables restart
         else