install openvpn from wheezy-backports, this will bring in openvpn 2.3,
which will provide us with proper ipv6 support

Change-Id: I0188732aae6cbc64ab57e95bf805d6158fa17e07
set the ipv6 configuration options on the server

some important things to note:

We are hard-coding the pushing of the ipv6 route '2000::/3' and
configuring the server-ipv6 to be 2001:db8:123::/64. This netblock is a
reserved ipv6 prefix that is used for documentation purposes
only (http://www.apnic.net/info/faq/ipv6-documentation-prefix-faq.html),
and the route being pushed redirects all internet-bound traffic.

When LEAP fully supports ipv6, these network values should be turned
into variables, but for now, to make sure we are blocking any clients
that have functional ipv6, this will work.

Change-Id: Icb65f3169264e0178a2e98825b266a779feac6b5
Change the initial firewall to subscribe to the rule file to be able to
trigger changes, make the default ipv6 firewall subscribe to shorewall6,
if it exists, and finally reject all outgoing IPv6 packets.

All of this will complete the platform-side of route IPv6 through
OpenVPN gateway, and block it. (Feature #4163)

Change-Id: Icf6d582063ed01d304658b740a565057ee4e6810
add the tun-ipv6 configuration to the eip-service (#4163)

Change-Id: I4781f0c3e1c74f5a45217a4d631603fa1a622fd6
update cipher configuration for openvpn to use the IANA name, due to
deprecation warning:

2014-05-06 18:10:23,594 - INFO     - L#826  : leap.openvpn:outReceived() - Tue May  6 18:10:23 2014 Deprecated TLS cipher name 'DHE-RSA-AES128-SHA', please use IANA name 'TLS-DHE-RSA-WITH-AES-128-CBC-SHA'

Change-Id: I159b26604993d38806fcb7c2ed8f6de8138999f7