iptables: tweak nat/firewall handling
update configs
move overlay directories out of tree