firewall: only use one list

Unless you use complicated rights veto rules, WFP's policy is that
between sublayers, block always outweighs allow. It's easier, therefore,
to simply weight a single sublayer correctly, with allow rules having
heavier weight than block rules.

This basically means that we have to be careful that DNS isn't a subset
of some allow rule. One place where this would be a problem are the
permitLan* rules, which we don't use anyway, and so this commit nukes
them.

Another place would be if somebody is using a localhost/loopback resolver
for whatever reason. This is probably a "low risk" sort of thing, but we
may want to fix this by ordering the dns block just in front of the
loopback permit.

The other place is in the wireguard.exe tunnel service itself, which
does DNS lookups. Since right now we mostly enforce one-tunnel-at-a-
time, this isn't really a problem. But later if we allow nested
tunneling, it means that the DNS lookup in a second tunnel can
potentially escape the DNS server of the first tunnel. We can address
this problem later, perhaps with fancier security descriptors that we
shuffle around depending on which state the tunnel is in. And on the
bright side, this change allows people to run WireGuard over port 53
itself, which is generally a desirable thing.

0 files changed, 0 insertions, 0 deletions