firewall: clear rpfilter on stop