Delete activation rules by spec not number

Fixes #41

The assumption that the rules added to allow established connections
during activation will always be first is wrong for configs with
iptables -I statements.