Without this fix, the rdr rule is executed sending the packages that
should be excluded to the ssh tunnel.
What I did was make sure that the packages that are going to the
excluded subnets are processed first and only after that, the remaining
packages will be sent to the ssh tunnel.
Thanks Warr1024 on #openssh channel in freenode for telling me about
the quick keyword and the rest of guys in the channel who tried to help.
There were still a few conditions under some OSes that would cause
firewall.py to terminate without cleaning up the firewall settings. 'pkill
sshuttle' was one of them. Ignore a couple more signals to further ensure a
correct cleanup.
(This only affects sshuttle --firewall, which is a subprocess of the main
sshuttle process. The firewall is supposed to exit automatically whenever
the client exits, and so far that part seems to work reliably.)
