diff --git a/weaver/weave b/weaver/weave
index 33f7d83e..4a954777 100755
--- a/weaver/weave
+++ b/weaver/weave
@@ -60,7 +60,7 @@ create_bridge() {
     ip link set dev $BRIDGE up
 }
 
-add_nat_rule() {
+run_iptables() {
     # -w is recent addition to iptables
     if [ -z "$CHECKED_IPTABLES_W" ] ; then
         if iptables -S -w >/dev/null 2>&1 ; then
@@ -69,15 +69,28 @@ add_nat_rule() {
         CHECKED_IPTABLES_W=1
     fi
 
-    if ! iptables $IPTABLES_W -t nat -C $1 >/dev/null 2>&1
+    iptables $IPTABLES_W "$@"
+}
+
+add_nat_rule() {
+    if ! run_iptables -t nat -C "$@" >/dev/null 2>&1
     then
-        iptables $IPTABLES_W -t nat -A $1 >/dev/null
+        run_iptables -t nat -A "$@" >/dev/null
     fi
 }
 
 setup_masquerading() {
-    add_nat_rule "POSTROUTING -o $BRIDGE ! -s $1 -j MASQUERADE"
-    add_nat_rule "POSTROUTING -s $1 ! -o $BRIDGE -j MASQUERADE"
+    if ! run_iptables -t nat -S WEAVE >/dev/null 2>&1
+    then
+        run_iptables -t nat -N WEAVE
+        add_nat_rule POSTROUTING -j WEAVE
+    fi
+    add_nat_rule WEAVE -o $BRIDGE ! -s $1 -j MASQUERADE
+    add_nat_rule WEAVE -s $1 ! -o $BRIDGE -j MASQUERADE
+}
+
+stop_masquerading() {
+    run_iptables -t nat -F WEAVE >/dev/null 2>&1 || true
 }
 
 # the following borrows from https://github.com/jpetazzo/pipework
@@ -135,6 +148,7 @@ case "$COMMAND" in
                 ;;
         esac
         create_bridge
+        stop_masquerading
         setup_masquerading $IPADDR
         # We set the router name to the bridge mac since that is
         # stable across re-creations of the containers.
@@ -200,6 +214,7 @@ case "$COMMAND" in
         fi
         docker rm -f weave >/dev/null 2>&1 || true
         check_command_and_run conntrack conntrack -D -p udp --dport 6783 >/dev/null 2>&1 || true
+        stop_masquerading
         ;;
     *)
         echo "Unknown weave command '$COMMAND'"