nixos/nat: Don't flush tables, create subchains for autogenerated rules