must be run as root
sets forwarders based on resolv.conf, drops privileges properly and
orchestrates iptables and port listening