diff --git a/linux/linux.mk b/linux/linux.mk
index 8867be44f7..14dc78fc9e 100644
--- a/linux/linux.mk
+++ b/linux/linux.mk
@@ -357,11 +357,6 @@ define LINUX_KCONFIG_FIXUP_CMDS
 		$(call KCONFIG_ENABLE_OPT,CONFIG_NET))
 	$(if $(BR2_PACKAGE_LINUX_TOOLS_PERF),
 		$(call KCONFIG_ENABLE_OPT,CONFIG_PERF_EVENTS))
-	$(if $(BR2_PACKAGE_IPTABLES),
-		$(call KCONFIG_ENABLE_OPT,CONFIG_IP_NF_IPTABLES)
-		$(call KCONFIG_ENABLE_OPT,CONFIG_IP_NF_FILTER)
-		$(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER)
-		$(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XTABLES))
 	$(if $(BR2_PACKAGE_XTABLES_ADDONS),
 		$(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_ADVANCED)
 		$(call KCONFIG_ENABLE_OPT,CONFIG_NF_CONNTRACK)
diff --git a/package/iptables/iptables.mk b/package/iptables/iptables.mk
index ae5cf4ddd3..7b964aaf41 100644
--- a/package/iptables/iptables.mk
+++ b/package/iptables/iptables.mk
@@ -47,4 +47,11 @@ else
 IPTABLES_CONF_OPTS += --disable-bpf-compiler --disable-nfsynproxy
 endif
 
+define IPTABLES_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_IP_NF_IPTABLES)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_IP_NF_FILTER)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XTABLES)
+endef
+
 $(eval $(autotools-package))