OpenVPN upgrade code should put an allow all rule for migrations from 1.2.x
Since OpenVPN does not filter on 1.2.x, upgrades from 1.2.x -> 2.0 should place an "Allow All" style rule on the OpenVPN interface rules, to avoid a POLA violation.
This way, the non-filtered behavior is retained for those upgrading from 1.2.3, but new installs of 2.0 can be filtered by default.
Less clear is how we should handle upgrades where a tun was assigned as an opt for filtering. (Or is that already handled?)