Prevent leakage while killswitch setup is performed

[twiebe]

DNS resolution for all vpn endpoints can take time. I've seen this take more than a minute.

Meanwhile, connections would be opened through the original gw effectively leaking details about the regular connection.

This change makes sure to only let through what is necessary to setup the killswitch, namely dns resolvers.