Add firewall to holmium/blog

This adds a firewall to the blog box. The current setup apparently has
some holes -that I won't document- and while we've been putting off a
reorganization of the service (e.g.  putting it behind misc-lb and
making it internal) for a while, pending larger changes to the blog
service, this is simple enough.

Change-Id: I044412342b5beb27bddb233119f5360337a85983