NOTE: this is actually caused by broken ipt_state module loading due missing /etc/sysctl.conf (see https://bugzilla.suse.com/show_bug.cgi?id=1217990).