I hate to say this, but do we actually need to compare the file against the running iptables NAT list and verify that all expected entries are there?