use firewall from maestro_nodes
some additional checks for nginx