When a computer is configured to use NAT, an OS module must be created to control the computer providing NAT. When currentimage for the NAT computer is set to noimage, vcld uses the Unix OS module which doesn't have sufficient code to handle iptables for doing NAT.
Here is some info from vcld.log:
2017-05-09 13:02:34|5706|6|6|reserved|Module.pm:create_nathost_os_object|720|attempting to create NAT host OS object
2017-05-09 13:02:34|5706|6|6|reserved|Module.pm:create_nathost_os_object|753|NAT host resource type is computer, creating VCL::Modu
le::OS::Linux::UnixLab OS object to control vmhost1
2017-05-09 13:02:52|5706|6|6|reserved|OS.pm:process_connect_methods|3702|NAT not configured on vmhost1, VCL::Module::OS::Linux::firewall does not implement a 'nat_configure_host' subroutine
2017-05-09 13:02:52|5706|6|6|reserved|OS.pm:process_connect_methods|3717|NAT not configured on vmhost1 for this reservation, VCL::Module::OS::Linux::firewall does not implement a 'nat_configure_reservation' subroutine