diff --git a/types/preftype/netfiltermode.go b/types/preftype/netfiltermode.go
index 7e8dec9dd..cf9feb6b1 100644
--- a/types/preftype/netfiltermode.go
+++ b/types/preftype/netfiltermode.go
@@ -10,10 +10,12 @@ package preftype
 // programming the Linux network stack.
 type NetfilterMode int
 
+// These numbers are persisted to disk in JSON files and thus can't be
+// renumbered or repurposed.
 const (
-	NetfilterOff      NetfilterMode = iota // remove all tailscale netfilter state
-	NetfilterNoDivert                      // manage tailscale chains, but don't call them
-	NetfilterOn                            // manage tailscale chains and call them from main chains
+	NetfilterOff      NetfilterMode = 0 // remove all tailscale netfilter state
+	NetfilterNoDivert NetfilterMode = 1 // manage tailscale chains, but don't call them
+	NetfilterOn       NetfilterMode = 2 // manage tailscale chains and call them from main chains
 )
 
 func (m NetfilterMode) String() string {