diff --git a/de/heat-templates/scripts/instance_boot.sh b/de/heat-templates/scripts/instance_boot.sh
index b1b54fe..4436054 100644
--- a/de/heat-templates/scripts/instance_boot.sh
+++ b/de/heat-templates/scripts/instance_boot.sh
@@ -104,7 +104,7 @@
 function install_required_packages {
     function install_retry {
         apt update
-        apt install -y apt-transport-https ca-certificates curl software-properties-common jq unzip atop
+        export DEBIAN_FRONTEND=noninteractive; apt install -y apt-transport-https ca-certificates curl software-properties-common jq unzip atop iptables-persistent
     }
     retry 10 "Failed to install required packages" install_retry
 }
@@ -263,10 +263,23 @@
 }
 
 function workaround_default_forward_policy {
+    cat << EOF > /etc/iptables/rules.v4
+*filter
+:DOCKER-USER - [0:0]
+EOF
     for net in $FLOATING_NETWORK_PREFIXES; do
-        iptables -I DOCKER-USER  -d ${net} -j ACCEPT
-        iptables -I DOCKER-USER  -s ${net} -j ACCEPT
+cat << EOF >> /etc/iptables/rules.v4
+-A DOCKER-USER -d ${net} -j ACCEPT
+-A DOCKER-USER -s ${net} -j ACCEPT
+-A DOCKER-USER -j RETURN
+COMMIT
+EOF
     done
+
+cat << EOF >> /etc/iptables/rules.v4
+-A DOCKER-USER -j RETURN
+EOF
+    sudo netfilter-persistent reload
 }
 
 function network_config {
@@ -346,6 +359,7 @@
         prepare_network
         update_docker_network
         install_required_packages
+        workaround_default_forward_policy
         install_docker
         network_config
         swarm_init
@@ -354,7 +368,6 @@
         download_bundles
         rm_ucp_config
         install_kubectl
-        workaround_default_forward_policy
         wait_for_node
         set_node_labels
         ;;
@@ -363,12 +376,12 @@
         prepare_network
         update_docker_network
         install_required_packages
+        workaround_default_forward_policy
         install_docker
         network_config
         download_bundles
         join_node manager
         install_kubectl
-        workaround_default_forward_policy
         wait_for_node
         set_node_labels
         ;;
@@ -377,13 +390,13 @@
         prepare_network
         update_docker_network
         install_required_packages
+        workaround_default_forward_policy
         install_docker
         network_config
         load_modules
         download_bundles
         join_node worker
         install_kubectl
-        workaround_default_forward_policy
         wait_for_node
         set_node_labels
         ;;