diff --git a/rpm_spec/core-vm.spec b/rpm_spec/core-vm.spec
index eb0e561..c8ea1f2 100644
--- a/rpm_spec/core-vm.spec
+++ b/rpm_spec/core-vm.spec
@@ -224,6 +224,15 @@ for ip in '127\.0\.0\.1' '::1'; do
     fi
 done
 
+# Copy ip(|6)tables into place if they do not already exist in filesystem.
+# This prevents conflict with iptables-service
+if [ ! -f '/etc/sysconfig/iptables' ]; then
+  cp -p /usr/lib/qubes/init/iptables /etc/sysconfig/iptables
+fi
+if [ ! -f '/etc/sysconfig/ip6tables' ]; then
+  cp -p /usr/lib/qubes/init/ip6tables /etc/sysconfig/ip6tables
+fi
+
 if [ "$1" !=  1 ] ; then
 # do the rest of %post thing only when updating for the first time...
 exit 0
@@ -260,15 +269,6 @@ mkdir -p /rw
 #mv /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/ifcfg-eth0.orig
 #grep -v HWADDR /etc/sysconfig/network-scripts/ifcfg-eth0.orig > /etc/sysconfig/network-scripts/ifcfg-eth0
 
-# Copy ip(|6)tables into place if they do not already exist in filesystem.
-# This prevents conflict with iptables-service
-if [ ! -f '/etc/sysconfig/iptables' ]; then
-  cp -p /usr/lib/qubes/init/iptables /etc/sysconfig/iptables
-fi
-if [ ! -f '/etc/sysconfig/ip6tables' ]; then
-  cp -p /usr/lib/qubes/init/ip6tables /etc/sysconfig/ip6tables
-fi
-
 %triggerin -- notification-daemon
 # Enable autostart of notification-daemon when installed
 if [ ! -e /etc/xdg/autostart/notification-daemon.desktop ]; then