Feature/15613 negate address masks

We could also wait on https://github.com/puppetlabs/puppetlabs-firewall/pull/88