[Quickenroll] tunnetd restart required

[cocoon]

Describe the bug
After a successful and approved quick enrollment of a windows VM the network is unavailable until I do a tunnet service restart.

To Reproduce
Steps to reproduce the behavior:

1. Clean or reset a machine

2. do a quick enroll

3. try to ping other machine

4. See error

5. do a tunnet service restart

6. see success

Expected behavior
Expected to have network availability after approval without restart of the service.

Additional context

[cocoon]

I guess this has the same root cause, adding here:

With default open policy, when adding a "deny all" network rule, it is also not applied until a service restart.
But funny then, if deleting the deny rule, it is directly working and traffic is allowed without svc restart.

And in addition the simulator for ICMP tells it would be allowed, but after a service restart with the deny all rule it is not allowed/working: