code: func iptablesInit(clusterVIP seesaw.Host) error {
  	if err := iptablesFlush(); err != nil {
  		return err
  	}
  	for _, af := range seesaw.AFs() {
  		// Allow connections to port 10257 for all VIPs.
  		if err := iptablesRun(af, "-I INPUT -p tcp --dport 10257 -j ACCEPT"); err != nil {
  			return err
  		}
  
  		// conntrack is only required for NAT. Disable it for everything else.
  		if err := iptablesRun(af, "-t raw -A PREROUTING -j NOTRACK"); err != nil {
  			return err
  		}
  		if err := iptablesRun(af, "-t raw -A OUTPUT -j NOTRACK"); err != nil {
  			return err
  		}
  	}
  
  	// Enable conntrack for incoming traffic on the seesaw cluster IPv4 VIP. This
  	// is required for NAT return traffic.
  	return iptablesRun(seesaw.IPv4,
  		fmt.Sprintf("-t raw -I PREROUTING -d %v/32 -j ACCEPT", clusterVIP.IPv4Addr))
  }
docs: // iptablesInit initialises the iptables rules for a Seesaw Node.