diff --git a/criu/netfilter.c b/criu/netfilter.c
index 2ba331efa..1896365d2 100644
--- a/criu/netfilter.c
+++ b/criu/netfilter.c
@@ -74,7 +74,7 @@ static int nf_connection_switch_raw(int family, u32 *src_addr, u16 src_port,
 
 	snprintf(buf, sizeof(buf), NF_CONN_CMD, cmd,
 			kdat.has_xtlocks ? "-w" : "",
-			lock ? "-A" : "-D",
+			lock ? "-I" : "-D",
 			input ? "INPUT" : "OUTPUT",
 			dip, (int)dst_port, sip, (int)src_port);