install a preliminary firewall that blocks everything, except ssh for the cases when shorewall doesn't properly come up, ensuring that it fails safe (#3339)

Change-Id: Id4f0bf6cf25f420aa2ad67635b37ae95f54e3d38
Merge branch 'bug/3339' into develop