BSD: "ipfw add %d accept ip from any to any established"

With this rule, we don't interfere with already-established (or incoming)
connections to routes that we're about to take over.  This is what
happens by default in Linux/iptables.

firewall.py

@@ -116,6 +116,9 @@ def do_ipfw(port, subnets):
         sysctl_set('net.inet.ip.fw.enable', 1)
         sysctl_set('net.inet.ip.forwarding', 1)
 
+        ipfw('add', sport, 'accept', 'ip',
+             'from', 'any', 'to', 'any', 'established')
+        
         # create new subnet entries
         for snet,swidth in subnets:
             ipfw('add', sport, 'fwd', '127.0.0.1,%d' % port,