entrypoint: create prerouting chain if not already created by container runtime

CHANGELOG.md

@@ -5,6 +5,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Fixed
+- create prerouting chain if not already created by container runtime
+  (fixes dns proxy with direct routing & transparent proxy on some hosts)
 
 ## [4.3.0] - 2021-05-07
 ### Added

entrypoint.sh

@@ -3,6 +3,7 @@
 set -e
 
 if [ "$(id -u)" -eq 0 ]; then
+    nft add chain ip nat PREROUTING { type nat hook prerouting priority dstnat \; } || true
     nft add rule ip nat PREROUTING ip protocol tcp fib daddr type != local counter redirect to :9040 \
         || echo 'warning: failed to configure nftables for transparent proxy (missing CAP_NET_ADMIN?)'
     nft add rule ip nat PREROUTING fib daddr type local udp dport 53 counter redirect to :9053 \