diff --git a/iptables-1.8.9-fix-checking-existence-of-rule.patch b/iptables-1.8.9-fix-checking-existence-of-rule.patch
new file mode 100644
index 0000000..51866e6
--- /dev/null
+++ b/iptables-1.8.9-fix-checking-existence-of-rule.patch
@@ -0,0 +1,32 @@
+From 78850e7dba64a949c440dbdbe557f59409c6db48 Mon Sep 17 00:00:00 2001
+From: Markus Boehme <markubo@amazon.com>
+Date: Mon, 3 Apr 2023 23:13:47 +0200
+Subject: ip6tables: Fix checking existence of rule
+
+Pass the proper entry size when creating a match mask for checking the
+existence of a rule. Failing to do so causes wrong results.
+
+Reported-by: Jonathan Caicedo <jonathan@jcaicedo.com>
+Fixes: eb2546a846776 ("xshared: Share make_delete_mask() between ip{,6}tables")
+Signed-off-by: Markus Boehme <markubo@amazon.com>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+---
+ iptables/ip6tables.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
+index 345af451..9afc32c1 100644
+--- a/iptables/ip6tables.c
++++ b/iptables/ip6tables.c
+@@ -331,7 +331,7 @@ check_entry(const xt_chainlabel chain, struct ip6t_entry *fw,
+ 	int ret = 1;
+ 	unsigned char *mask;
+ 
+-	mask = make_delete_mask(matches, target, sizeof(fw));
++	mask = make_delete_mask(matches, target, sizeof(*fw));
+ 	for (i = 0; i < nsaddrs; i++) {
+ 		fw->ipv6.src = saddrs[i];
+ 		fw->ipv6.smsk = smasks[i];
+-- 
+cgit v1.2.3
+
diff --git a/iptables.changes b/iptables.changes
index 0d15c4c..876286a 100644
--- a/iptables.changes
+++ b/iptables.changes
@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Mon Jan  6 21:18:58 UTC 2025 - Antonio Teixeira <antonio.teixeira@suse.com>
+
+- Add iptables-1.8.9-fix-checking-existence-of-rule.patch
+  * Fixes checking existence of rules. Fixes issues with rule creation
+    with podman/netavark. (bsc#1235088, bsc#1234996)
+
 -------------------------------------------------------------------
 Thu Jan 12 22:58:50 UTC 2023 - Jan Engelhardt <jengelh@inai.de>
 
diff --git a/iptables.spec b/iptables.spec
index 813d6a8..47cb6e4 100644
--- a/iptables.spec
+++ b/iptables.spec
@@ -37,6 +37,7 @@ Source4:        baselibs.conf
 Patch1:         iptables-batch.patch
 Patch2:         iptables-batch-lock.patch
 Patch3:         iptables-1.8.2-dont_read_garbage.patch
+Patch4:         iptables-1.8.9-fix-checking-existence-of-rule.patch
 
 BuildRequires:  bison
 BuildRequires:  fdupes