firewall: correctly rewrite DNS packets originally for local network.

the firewall is starting to get a little complicated, but this new one appears to correctly reroute DNS requests to the VPN for all cases.

the one thing that concerns me is the MASQUERADE entries. it would be better to limit them to the tun0 interface, but this firewall is not started until after tun0 exists. it should be ok, since the masquerade is limited to port 53, but it would be good to get an expert opinion.

also, the firewall now passes through all packets originating from localhost that have a local network source address. i can't think of any security problem with this, but again, it would be good to get an audit from an iptables ninja.