Fix #4066:

Make sure pf is configured before other services are restarted when WAN
IP changes. The way it was before, 'pass out' rules with route-to still
have old IP set as 'from' and some Dynamic DNS ended up not being
updated.