Fix fwknop iptable rule order and explain why.