nixos/firewall: Cleanup in case reload fails
Merge branch 'master.firewall'
nixos/nat: Don't flush tables, create subchains for autogenerated rules