Correctly express "any address" to iptables.

Iptables interprets "-d 0.0.0.0" as "-d 0.0.0.0/32", not /0. This
results in the DNAT rule never matching any traffic if not bound
to a specific host IP.

Fixes #2598
Merge pull request #2633 from danderson/2598-fix-iptables-anydest

Correctly express "any address" to iptables.