diff --git a/iptables.cc b/iptables.cc
index 915a1ac..e8ca006 100644
--- a/iptables.cc
+++ b/iptables.cc
@@ -387,6 +387,7 @@
   argv.push_back(interface);
   argv.push_back("-j");
   argv.push_back("MASQUERADE");
+  argv.push_back("-w");  // Wait for xtables lock
 
   // Use CAP_NET_ADMIN|CAP_NET_RAW.
   if (ExecvNonRoot(argv, kIpTablesCapMask) != 0) {
@@ -442,6 +443,7 @@
   argv.push_back("MARK");
   argv.push_back("--set-mark");
   argv.push_back(kMarkForUserTraffic);
+  argv.push_back("-w");  // Wait for xtables lock
 
   // Use CAP_NET_ADMIN|CAP_NET_RAW.
   bool success = ExecvNonRoot(argv, kIpTablesCapMask) == 0;