Make NATing add/remove iptable rules as needed

It was flushing on every unNAT, but really you want to remove just those rules.  We'll
Flush when we get to 0 NATs.

bug: 2542176
Change-Id: Ia70580191b1aed754689864044de122234346011