device-mapper unmap timing issue

* fix:
  * device-mapper unmapping
* feature:
  * vz.conf configuration to use iptables `nat` table rule in container