allow outgoing via tun0 for internal programs

e.g. dnsmasq doing dns requests