Switch order of network interfaces, so the ipnat forwards work out of the box.