diff --git a/debian/ngcp-rtpengine-daemon.default b/debian/ngcp-rtpengine-daemon.default
index ec896ffae..2798298c9 100644
--- a/debian/ngcp-rtpengine-daemon.default
+++ b/debian/ngcp-rtpengine-daemon.default
@@ -3,6 +3,5 @@ CONFIG_FILE=/etc/rtpengine/rtpengine.conf
 # CONFIG_SECTION=rtpengine
 PIDFILE=/run/ngcp-rtpengine-daemon.pid
 MANAGE_IPTABLES=yes
-TABLE=0
 #SET_USER=root
 #SET_GROUP=root # GROUP only needs to be set if USER is not set or if the user isn't in the group
diff --git a/debian/ngcp-rtpengine-daemon.init b/debian/ngcp-rtpengine-daemon.init
index 858544ead..512071ea6 100755
--- a/debian/ngcp-rtpengine-daemon.init
+++ b/debian/ngcp-rtpengine-daemon.init
@@ -12,7 +12,6 @@
 PATH=/sbin:/bin:/usr/sbin:/usr/bin
 NAME=ngcp-rtpengine-daemon
 DESC="RTP/media proxy"
-TABLE=0
 
 DAEMON=$(which rtpengine)
 DEFAULTS=/etc/default/${NAME}
@@ -75,7 +74,6 @@ fi
 [ -z "$NO_REDIS_REQUIRED" ] || { [ "$NO_REDIS_REQUIRED" != "1" ] && [ "$NO_REDIS_REQUIRED" != "yes" ] ; } || OPTIONS="$OPTIONS --no-redis-required"
 [ -z "$B2B_URL" ] || OPTIONS="$OPTIONS --b2b-url=$B2B_URL"
 [ -z "$NO_FALLBACK" ] || { [ "$NO_FALLBACK" != "1" ] && [ "$NO_FALLBACK" != "yes" ] ; } || OPTIONS="$OPTIONS --no-fallback"
-OPTIONS="$OPTIONS --table=$TABLE"
 [ -z "$LOG_LEVEL" ] || OPTIONS="$OPTIONS --log-level=$LOG_LEVEL"
 [ -z "$LOG_FACILITY" ] || OPTIONS="$OPTIONS --log-facility=$LOG_FACILITY"
 [ -z "$LOG_FACILITY_CDR" ] || OPTIONS="$OPTIONS --log-facility-cdr=$LOG_FACILITY_CDR"
diff --git a/debian/ngcp-rtpengine-daemon.service b/debian/ngcp-rtpengine-daemon.service
index 2f4a0e8a2..a9a78eedb 100644
--- a/debian/ngcp-rtpengine-daemon.service
+++ b/debian/ngcp-rtpengine-daemon.service
@@ -9,7 +9,7 @@ Type=notify
 EnvironmentFile=/etc/default/ngcp-rtpengine-daemon
 PIDFile=/run/ngcp-rtpengine-daemon.pid
 ExecStartPre=/usr/sbin/ngcp-rtpengine-iptables-setup start
-ExecStart=/usr/sbin/rtpengine -f -E --no-log-timestamps --pidfile /run/ngcp-rtpengine-daemon.pid --config-file /etc/rtpengine/rtpengine.conf --table $TABLE
+ExecStart=/usr/sbin/rtpengine -f -E --no-log-timestamps --pidfile /run/ngcp-rtpengine-daemon.pid --config-file /etc/rtpengine/rtpengine.conf
 ExecStopPost=/usr/sbin/ngcp-rtpengine-iptables-setup stop
 
 [Install]
diff --git a/debian/ngcp-rtpengine-iptables-setup b/debian/ngcp-rtpengine-iptables-setup
index 5ca3e9a4d..ddf99aa0e 100755
--- a/debian/ngcp-rtpengine-iptables-setup
+++ b/debian/ngcp-rtpengine-iptables-setup
@@ -1,7 +1,6 @@
 #!/bin/sh
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin
-TABLE=0
 MODNAME=xt_RTPENGINE
 MANAGE_IPTABLES=yes
 
@@ -13,6 +12,7 @@ if [ -f "$DEFAULTS" ]; then
 fi
 
 MODPROBE_OPTIONS=""
+TABLE=$(/usr/libexec/rtpengine/rtpengine-get-table --config-file=$CONFIG_FILE)
 
 # Handle requested setuid/setgid.
 if ! test -z "$SET_USER"; then
diff --git a/debian/ngcp-rtpengine-utils.install b/debian/ngcp-rtpengine-utils.install
index 04c88eb1e..c988b902c 100644
--- a/debian/ngcp-rtpengine-utils.install
+++ b/debian/ngcp-rtpengine-utils.install
@@ -1,3 +1,4 @@
 perl/* /usr/share/perl5/
 utils/rtpengine-ctl /usr/sbin/
+utils/rtpengine-get-table /usr/libexec/rtpengine/
 utils/rtpengine-ng-client /usr/sbin/
diff --git a/el/ngcp-rtpengine-iptables-setup b/el/ngcp-rtpengine-iptables-setup
index 9fde5ff6f..f5baa9216 100755
--- a/el/ngcp-rtpengine-iptables-setup
+++ b/el/ngcp-rtpengine-iptables-setup
@@ -1,7 +1,6 @@
 #!/bin/sh
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin
-TABLE=0
 MODNAME=xt_RTPENGINE
 MANAGE_IPTABLES=yes
 
@@ -12,6 +11,7 @@ if [ -f "$DEFAULTS" ]; then
   . "$DEFAULTS" || true
 fi
 
+TABLE=$(/usr/libexec/rtpengine/rtpengine-get-table --config-file=$CONFIG_FILE)
 MODPROBE_OPTIONS=""
 
 # Handle requested setuid/setgid.
diff --git a/el/rtpengine.init b/el/rtpengine.init
index 45eeb68c7..8b970079c 100644
--- a/el/rtpengine.init
+++ b/el/rtpengine.init
@@ -20,7 +20,6 @@
 . /etc/rc.d/init.d/functions
 
 # defaults
-TABLE=0
 
 if [ -f /etc/sysconfig/rtpengine ]
 then
@@ -36,6 +35,7 @@ pidfile=${PIDFILE-/run/rtpengine.pid}
 lockfile=${LOCKFILE-/var/lock/subsys/rtpengine}
 configfile=${CONFIG_FILE-/etc/rtpengine/rtpengine.conf}
 cachefile=/var/lib/ngcp-rtpengine/rtpengine.cfg
+TABLE=$(/usr/libexec/rtpengine/rtpengine-get-table --config-file=$CONFIG_FILE)
 PIDFILE=${pidfile}
 RETVAL=0
 OPTS=""
@@ -43,9 +43,8 @@ OPTS=""
 build_opts() {
         # kernel table
 	MODULE=0
-	# variable from sysconfig is prefer then config
+	# the variable from the config is the source of truth
 	if [[ -n "$TABLE" ]];then
-		OPTS+=" --table=$TABLE"
 		if [[ $TABLE -ge 0 ]];then
 			MODULE=1
 		fi
diff --git a/el/rtpengine.spec b/el/rtpengine.spec
index f8ff4ee3a..7710b04ae 100644
--- a/el/rtpengine.spec
+++ b/el/rtpengine.spec
@@ -115,6 +115,8 @@ cd ..
 install -D -p -m755 daemon/%{binname} %{buildroot}%{_sbindir}/%{binname}
 # Install CLI (command line interface)
 install -D -p -m755 utils/%{binname}-ctl %{buildroot}%{_sbindir}/%{binname}-ctl
+# Install helper
+install -D -p -m755 utils/%{binname}-get-table %{buildroot}%{_libexecdir}/%{binname}/%{binname}-get-table
 # Install recording daemon
 %if 0%{?with_transcoding} > 0
 install -D -p -m755 recording-daemon/%{binname}-recording %{buildroot}%{_sbindir}/%{binname}-recording
diff --git a/el/rtpengine.sysconfig b/el/rtpengine.sysconfig
index 7a378b72b..128f99bd3 100644
--- a/el/rtpengine.sysconfig
+++ b/el/rtpengine.sysconfig
@@ -4,8 +4,6 @@
 CONFIG_FILE=/etc/rtpengine/rtpengine.conf
 # pid
 #PIDFILE=/run/ngcp-rtpengine-daemon.pid
-# iptables table for in-kernel forwarding rules. Ignored if "KERNEL=no"
-#TABLE=0
 # "yes" enables fallback to userspace forwarding only.
 #FALLBACK=yes
 # Local IPv4/6 address for RTP. The format of the value is [NAME/]IP[!IP].
diff --git a/utils/rtpengine-get-table b/utils/rtpengine-get-table
new file mode 100755
index 000000000..188418fc2
--- /dev/null
+++ b/utils/rtpengine-get-table
@@ -0,0 +1,51 @@
+#!/usr/bin/perl
+
+use strict;
+use warnings;
+
+use Getopt::Long;
+use Config::Tiny;
+
+sub showusage {
+    print <<HELP;
+Usage: rtpengine-get-table <option>...
+
+Options:
+  -h, --help                print this help message.
+  --config-file=<pathname>  use <pathname> as the config file.
+  --config-section=<name>   use <section> instead of 'rtpengine'.
+  --fallback-table=<index>  use <index> as fallback table instead of 0.
+HELP
+}
+
+my %options = (
+    'help'                => sub { showusage(); exit 0 },
+    'config-file'         => '/etc/rtpengine/rtpengine.conf',
+    'config-section'      => 'rtpengine',
+    'fallback-table'      => 0,
+);
+
+Getopt::Long::Configure('require_order');
+
+my $optret = GetOptions(\%options,
+    'help|h',
+    'config-file=s',
+    'config-section=s',
+    'fallback-table=i',
+);
+
+if (!$optret) {
+    showusage();
+    exit 1;
+}
+
+my $cfg = Config::Tiny->read($options{'config-file'});
+if (not defined $cfg) {
+    die "error: " . Config::Tiny->errstr . "\n";
+}
+my $cfg_section = $options{'config-section'};
+my $table = $cfg->{$cfg_section}{table} // $options{'fallback-table'};
+
+print "$table\n";
+
+1;