Cannot set "/ip firewall nat" unless it is at the top of the script

Point #16 here (just in case):