Fixes issue #3939

(cherry picked from commit b8783e65e4)

network/qubes-iptables

@@ -35,12 +35,13 @@ start() {
 
     CMD_ARGS=
     if "$CMD-restore" --help 2>&1 | grep -q wait=; then
+        # 'wait' must be last on command line if secs not specified
         CMD_ARGS=--wait
     fi
 
     echo -n $"${CMD}: Applying firewall rules: "
 
-    "$CMD-restore" $CMD_ARGS "$IPTABLES_DATA"
+    "$CMD-restore" "$IPTABLES_DATA" $CMD_ARGS
     ret="$?"
     if [ "$ret" -eq 0 ]; then
         echo OK