At one point I overloaded the server and Wireguard was not working on it. I began to understand and found out that the `wg-iptables` service did not start. The logs were:
```
May 19 17:50:27 server.domain iptables[714]: Another app is currently holding the xtables lock. Perhaps you want to use the -w option?
May 19 17:50:27 server.domain systemd[1]: wg-iptables.service: Main process exited, code=exited, status=4/NOPERMISSION
May 19 17:50:27 server.domain systemd[1]: wg-iptables.service: Failed with result 'exit-code'.
May 19 17:50:27 server.domain systemd[1]: Failed to start wg-iptables.service.
```
Then I started googling this problem [and found out](https://lists.zx2c4.com/pipermail/wireguard/2019-October/004592.html) that the problem is that your startup commands do not specify to wait in case of blocking. This patch fixes the problem.
Containers are supported via the BoringTun user space tool.
Additional small changes:
- NAT fixed
- Do not force bc dependency for Debian any longer (#2)
New logic makes way more sense:
- If either firewalld or iptables are present, use whatever we have
- If not, install firewalld in CentOS/Fedora and iptables in Debian/Ubuntu
