[DarylZero]

I see. Well it sounds like you "should" be using prefix translation instead of DNAT/SNAT (i.e., use the iptables DNPT/SNPT targets instead). Probably doesn't matter enough to change though.