As pointed out by Ermal, VIPs should go first in the list since NAT is first match. Ticket #983