rpearce: Add NAT support for more than just TCP.
  * Proto defaults to 'tcp' but can be 'udp' or 'all', as this is fed
  * directly to the puppet firewall module'
  * bind virtual servers will use 'all'