Turns out the iptables scripts don't handle this well. Change-Id: I89880ecd2de9f0d6f55a1a84187e23044cc1cd2c