Modified NAT setup to work reliably with libvirtd

Ted,
Thanks for this very useful piece of code. I'm using it to punch holes from a guest VM out to the 'public' network. Libvirtd sets up a private RFC1918 network for these VM's then creates iptables rules to restrict direct access in to the VM's, and NAT so the guests can get out. Currently the rules in natpmd.action don't work in this setup. This is partly because the rules are appended and are never reached, and partly due to problems with the FORWARD chain rule not matching. This change not only *inserts* them but changes the FORWARD chain rule to use the DNAT connection tracking state. It works well and I think would work in more diverse setups than the original.
Regards
Nick
PS. I also wrote a Ruby Gem (natpmp) to control this feature. It's up on github and rubygems too.