diff --git a/daemon/libnetwork/service_linux.go b/daemon/libnetwork/service_linux.go
index 87e4006b36..d0d0eeabe6 100644
--- a/daemon/libnetwork/service_linux.go
+++ b/daemon/libnetwork/service_linux.go
@@ -390,13 +390,6 @@ func programIngress(gwIP net.IP, ingressPorts []*PortConfig, isDelete bool) erro
 	// TODO IPv6 support
 	iptable := iptables.GetIptable(iptables.IPv4)
 
-	addDelOpt := "-I"
-	rollbackAddDelOpt := "-D"
-	if isDelete {
-		addDelOpt = "-D"
-		rollbackAddDelOpt = "-I"
-	}
-
 	ingressMu.Lock()
 	defer ingressMu.Unlock()
 
@@ -408,6 +401,19 @@ func programIngress(gwIP net.IP, ingressPorts []*PortConfig, isDelete bool) erro
 
 	// Filter the ingress ports until port rules start to be added/deleted
 	filteredPorts := filterPortConfigs(ingressPorts, isDelete)
+
+	return programIngressPorts(gwIP, filteredPorts, iptable, isDelete)
+}
+
+func programIngressPorts(gwIP net.IP, filteredPorts []*PortConfig, iptable *iptables.IPTable, isDelete bool) error {
+
+	addDelOpt := "-I"
+	rollbackAddDelOpt := "-D"
+	if isDelete {
+		addDelOpt = "-D"
+		rollbackAddDelOpt = "-I"
+	}
+
 	rollbackRules := make([][]string, 0, len(filteredPorts)*3)
 	var portErr error
 	defer func() {