bluebook/forwarding:

- if we forward to vpn, masquerade as bluemote doesn't know any of our
  subnets
- do not forward traffic from our real interfaces
bluebook/mathijs: upgrade qemu to 2.1
switch bedup to duperemove