+ - properly handle routerless dhcp leases
+ - set lifetime on the address acquired from dhcp
+ - patch kernel to support module alias for tunnel device (ipip/sit/gre),
+ then remove remove libkmod dependency and CAP_SYS_MODULE
+ - add veth netdev support (c.f. http://shorewall.net/bridge-Shorewall-perl.html#veth)