systemd can do most of this by itself now

[ad90df8e708e8fa8153e56a059]

The current default systemd can handle setting up your local network, serve local DHCP client IPs, and do DNS by just configuring /etc/systemd/network/eth0.network file:
[Match]
Name=eth0
[Network]
Address=172.16.0.1/16
DHCPServer=yes
[DHCPServer]
DNS=172.16.0.1
EmitDNS=yes

Then you can install iptables and tor with the same configs and it works. You can write an eth1.network file to handle the public connection similarly.

All you need to install is tor and iptables with the same configs. It makes things a lot simpler and I'm happy to submit a pull request, but I don't know if trusting systemd with that much of the networking stuff is the best idea as people have strong feelings about it.