Allow intra-VPN networking

By excluding the internal network from the SNAT route, intra-VPN traffic will be routed correctly.

It might be worth it to add a step to the installation wizard that asks whether the user wants this feature, but I can't see any scenario in which the clients connecting to the VPN wouldn't be trusted. Let me know if you deem this necessary and I'll add another commit that does it.