(legacy) fix tunnel identification when using ipsec nat, https://github.com/opnsense/core/issues/369

(ipfw) reverse behaviour for non captiveportal pass rules in ipfw, issue https://github.com/opnsense/core/issues/369

same issue could appear on otheri non physical interfaces as well in the previous version

(ipfw) skip enc0 device when processing captiveportal rules, found issue when analyzing https://github.com/opnsense/core/issues/369

Backend can't call tainted code that may run configd again.  This needs
to be cleaned up.  Ideally, the backend should only call python code.

Spotted by: @fabianfrz