restored iptables; DNAT-only works well