Fix NAT module
Use iptables' ‘-w’ flag

This prevents errors like "Another app is currently holding the
xtables lock" if the firewall and NAT services are starting in
parallel.  (Longer term, we should probably move to a single service
for managing the iptables rules.)
Fix tests broken due to the firewall being enabled by default
Include Archive::Cpio in the installation CD

http://hydra.nixos.org/build/10268978