Give standalone snowflakes guidance on how best to set up their nat

According to our current broker stats (https://snowflake-broker.torproject.net/debug), we have

current snowflakes available: 3021
	standalone proxies: 2589
	browser proxies: 5
	webext proxies: 250
	unknown proxies: 177
NAT Types available:
	restricted: 2512
	unrestricted: 386
	unknown: 123

i.e. most of the snowflakes that we're giving out seem to be standalone ones as opposed to browser extension ones, and also most of the ones we have available to us are behind restricted nat.

It seems to me that the standalone ones are probably in a better position to be behind the good kind of nat (or no nat at all). But does our docker image impose the bad kind of nat on them by default? How come so many standalone proxies are behind restricted nat?

More generally: is there useful guidance we can give people, on setting themselves up with the right kind of nat, presuming they're on a VPS or otherwise on a 'real' internet connection?