BSD: "ipfw add %d accept ip from any to any established"

With this rule, we don't interfere with already-established (or incoming)
connections to routes that we're about to take over.  This is what
happens by default in Linux/iptables.

firewall.py

@@ -115,6 +115,9 @@ def do_ipfw(port, subnets):
     if subnets:
         sysctl_set('net.inet.ip.fw.enable', 1)
         sysctl_set('net.inet.ip.forwarding', 1)
+
+        ipfw('add', sport, 'accept', 'ip',
+             'from', 'any', 'to', 'any', 'established')
         
         # create new subnet entries
         for snet,swidth in subnets: