mount /lib/modules from host to guest so that commands that manipulate kernel modules (such as iptables!) work correctly