Add comment about the FORWARD rule order

Should help debugging.

net/bridge.go

@@ -449,7 +449,9 @@ func configureIPTables(config *BridgeConfig) error {
 		// If WEAVE-NPC chain doesn't exist then creating a rule in the chain will fail
 		fwdRules = append(fwdRules,
 			[][]string{
-				{"-o", config.WeaveBridgeName, "-j", "WEAVE-NPC"},
+				{"-o", config.WeaveBridgeName,
+					"-m", "comment", "--comment", "NOTE: this must go before '-j KUBE-FORWARD'",
+					"-j", "WEAVE-NPC"},
 				{"-o", config.WeaveBridgeName, "-m", "state", "--state", "NEW", "-j", "NFLOG", "--nflog-group", "86"},
 				{"-o", config.WeaveBridgeName, "-j", "DROP"},
 			}...)

test/191_create_bridge_2_test.sh

@@ -48,7 +48,7 @@ IPT_BEFORE=$(mktemp)
 IPT_AFTER=$(mktemp)
 run_on $HOST1 "sudo iptables-save | grep -i weave | grep -v '\[.*:.*\]' > $IPT_BEFORE"
 
-run_on $HOST1 sudo iptables -t filter -D FORWARD -o weave -j WEAVE-NPC
+run_on $HOST1 "sudo iptables -t filter -D FORWARD -o weave -m comment --comment \"NOTE: this must go before '-j KUBE-FORWARD'\" -j WEAVE-NPC"
 run_on $HOST1 sudo iptables -t nat -D POSTROUTING -j WEAVE
 kill_weaver # should re-create the bridge and iptables friends