NAT: Disable FORWARD by default and set postroute before FORWARD.

[Adaptation from https://android-review.googlesource.com/#/c/50223 ]

For NAT table, only the first packet of data flow
hits the rules in this table. If forward is
enabled before postrouting in NAT, packet may be
forwarded without hit rules in NAT table. Phone
will not get responses for such packets because
source IP address is not translated.
How to reproduce:
1) Enable usb tethering;
2) Start ping test on PC;
3) Disable data on Phone;
4) NAT is disabled since data service is lost;
5) Enable data on Phone;
6) Ping can not recover on PC;
7) Capture tcpdump data on phone, source IP
   Address is not translated for ICMP packets.
Test result:
Run steps 1-5 in "How to reproduce", Ping session
on PC can be recovered after data is enabled.
CQ00027191

Change-Id: I1c3bcbb3d69eb7e2f61d720fa17086ee0da22fa0