ufw masquerade config not idempotent

[David Brownlee]

Step 2 of the "IP Masquerade" section of https://help.ubuntu.com/lts/serverguide/firewall.html has this:

    # nat Table rules
    *nat
    :POSTROUTING ACCEPT [0:0]

    # Forward traffic from eth1 through eth0.
    -A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE

    # don't delete the 'COMMIT' line or these nat table rules won't be processed
    COMMIT

Because this always appends, every time you run "systemctl reload ufw.service", a duplicate line is added to POSTROUTING. You can use -F on a line by itself to flush POSTROUTING first.