convert filter operations from init.d to hotplug scripts

Solves a bug with wan filtering where the rule would not apply if there
was no WAN ipaddr at boot time (e.g. the ethernet cable was not
plugged).  Using hotplug scripts, the filter rules will fire when the
network comes up.  Use the same mechanism for filtering traffic from
public & vpn to the private network (not so sensitive to timing since
these are static allocations and use interface matches).

Signed-off-by: Russell Senior <russell@personaltelco.net>