Unsafe routes guide: ufw NAT block flushes other tools' POSTROUTING rules #415

The ufw steps in the unsafe routes guide add a *nat block to /etc/ufw/before.rules that starts with -F POSTROUTING. That empties the whole NAT POSTROUTING chain every time ufw loads its rules, including rules other software added.

On a host that also runs Docker, ufw reload removes Docker's MASQUERADE rule and containers lose outbound connectivity until Docker is restarted.

Reproduce (Ubuntu 26.04, Docker 29.9, ufw 0.36.2):

1. docker run --rm curlimages/curl -s -m 6 https://example.com/ works.
2. Add the guide's block to /etc/ufw/before.rules and run ufw reload.
3. The same docker run times out. iptables -t nat -S POSTROUTING shows only the Nebula rule.

Tested fix: keep the Nebula rule in its own chain, and add the jump from ufw's before.init hook.

/etc/ufw/before.rules:

*nat
:POSTROUTING ACCEPT [0:0]
:NEBULA-NAT - [0:0]
-F NEBULA-NAT
-A NEBULA-NAT -s 10.0.0.0/24 -d 192.168.1.0/24 -j MASQUERADE
COMMIT

/etc/ufw/before.init (chmod 750):

#!/bin/sh
set -e
case "$1" in
start)
    iptables -t nat -N NEBULA-NAT 2>/dev/null || true
    iptables -t nat -C POSTROUTING -j NEBULA-NAT 2>/dev/null || iptables -t nat -A POSTROUTING -j NEBULA-NAT
    ;;
stop)
    iptables -t nat -D POSTROUTING -j NEBULA-NAT 2>/dev/null || true
    ;;
esac

With this, Docker's rule survives repeated ufw reloads and a reboot, the jump isn't duplicated, and ufw disable removes it. Putting the jump in before.rules instead doesn't work: a -D for a rule that isn't there yet aborts the block and ufw fails to start.

Split out from #407.

— Caleb + Cache