diff --git a/CommandListener.cpp b/CommandListener.cpp
index 21efadd..0d14d13 100644
--- a/CommandListener.cpp
+++ b/CommandListener.cpp
@@ -588,10 +588,8 @@
         }
     } else if (!strcmp(argv[1], "disable")) {
         rc = sNatCtrl->disableNat(argv[2], argv[3]);
-        if(!rc) {
-            /* Ignore ifaces for now. */
-            rc = sBandwidthCtrl->removeGlobalAlertInForwardChain();
-        }
+        /* Ignore ifaces for now. */
+        rc |= sBandwidthCtrl->removeGlobalAlertInForwardChain();
     } else {
         cli->sendMsg(ResponseCode::CommandSyntaxError, "Unknown nat cmd", false);
         return 0;
diff --git a/NatController.cpp b/NatController.cpp
index c05aa7b..49984f8 100644
--- a/NatController.cpp
+++ b/NatController.cpp
@@ -77,6 +77,8 @@
     return true;
 }
 
+// when un-doing NAT, we should report errors, but also try to do as much cleanup
+// as we can - don't short circuit on error.
 int NatController::doNatCommands(const char *intIface, const char *extIface, bool add) {
     char cmd[255];
 
@@ -90,6 +92,7 @@
                 if (ret == 0) {
                     natCount=0;
                 }
+                LOGE("setDefaults returned %d", ret);
                 return ret;
             }
         }
@@ -105,7 +108,8 @@
              "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT",
              (add ? "A" : "D"),
              extIface, intIface);
-    if (runIptablesCmd(cmd)) {
+    if (runIptablesCmd(cmd) && add) {
+        // only bail out if we are adding, not removing nat rules
         return -1;
     }
 
@@ -113,7 +117,8 @@
             "-%s FORWARD -i %s -o %s -m state --state INVALID -j DROP",
             (add ? "A" : "D"),
             intIface, extIface);
-    if (runIptablesCmd(cmd)) {
+    if (runIptablesCmd(cmd) && add) {
+        // bail on error, but only if adding
         snprintf(cmd, sizeof(cmd),
                 "-%s FORWARD -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT",
                 (!add ? "A" : "D"),
@@ -124,7 +129,7 @@
 
     snprintf(cmd, sizeof(cmd), "-%s FORWARD -i %s -o %s -j ACCEPT", (add ? "A" : "D"),
             intIface, extIface);
-    if (runIptablesCmd(cmd)) {
+    if (runIptablesCmd(cmd) && add) {
         // unwind what's been done, but don't care about success - what more could we do?
         snprintf(cmd, sizeof(cmd),
                 "-%s FORWARD -i %s -o %s -m state --state INVALID -j DROP",