Add NAT rule based on NAT rule below it instead of at the bottom of the list. Fixes #1118