hitcount cannot be more than 255 in recent module
Docker really insists on adding itself to the top of the FORWARD chain. Making our firewall side-steps this docker design.