remove openvpn polkit file
make bitmask chain constant
change the rule to actually allow dns traffic to tunnel nameserver, not gateway