dnsmasq: use a persistent lease file
firewall: use SNAT instead of masquerading

Otherwise, conntrack is flushed when the interface goes down.
firewall: don't use `-i` in POSTROUTING
firewall: fix negation of condition
firewall: don't repeat the default NAT rule
firewall: don't drop broadcast either
firewall: use netfilter for rpf for both IPv4 and IPv6
firewall: log multicast/broadcast in separate files
firewall: drop spotify broadcasts
firewall: IPv6 doesn't support broadcast match
firewall: keep chain names short enough
firewall: log rpfilter
firewall: rpfilter wrongfully match DHCP request
firewall: correctly exempt DHCP from rpfiltering
firewall: fix rpfilter logging
firewall: enable rpfilter
firewall: don't log multicast packets coming back to us
dnsmasq: use unbound for recursive DNSSEC-enabled resolution
dnsmasq: disable caching, handled by unbound
dnsmasq: fix path to unbound template