more fixes

internal/firewall/iptables/tcp.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"net/netip"
+	"os"
 )
 
 type tcpFlags struct {
@@ -71,7 +72,8 @@ func (c *Config) TempDropOutputTCPRST(ctx context.Context,
 	src, dst netip.AddrPort, excludeMark int) (
 	revert func(ctx context.Context) error, err error,
 ) {
-	if !c.nftables && !c.xtMark {
+	_, err = os.Stat("/usr/lib/xtables/libxt_mark.so")
+	if err != nil && errors.Is(err, os.ErrNotExist) {
 		return nil, fmt.Errorf("%w", ErrMarkMatchModuleMissing)
 	}