Still not working. PREROUTING and OUTPUT seem to be the only chains that accept the most plausible options. Substituting INPUT or POSTROUTING generally causes the rule to be rejected. In any case, I still get "No servers suitable for syncronization".