Externalized services v2

Uses IPTables on each host node to demux based on destination IP address.

Eliminates service port conflicts.
I think the longer term design involves a single field, whether singular or plural.  But we want to consolidate external IPs, normal services, "external" services, nominal services, etc.