fix a bug

nat should use PREROUTING rule, it has no OUTPUT