Even though we are checking for a working iptables installation, it is still possible that the user does not have the PHYSDEV matcher installed, so just issue a diagnostic instead. Signed-off-by: Ewan Mellor <ewan@xensource.com>