Rules are purged before all of the new ones are created

I'm having an issue where some wget requests (using wget:fetch definition from maestrodev/wget module) are happening between firewall rules.

Some default rules that are in the CentOS box are deleted, then wget tries to download a file and fails to do dns resolution, then the rest of the firewall rules are applied later on. 

Added a system spec to show the problem and expected behavior

This is the sequence of events in this spec. I would expect to have all firewall rules added before old ones are removed to avoid losing connection to the box or some other network issue

       Notice: /Firewall[9002 cf9e8bfd0c6419a489cce21f32abed1e]/ensure: removed
       Notice: /Firewall[000 accept all icmp]/ensure: created
       Notice: /Firewall[9001 cf9e8bfd0c6419a489cce21f32abed1e]/ensure: removed
       Notice: /Firewall[001 accept all to lo interface]/ensure: created
       Notice: /Firewall[002 accept related established rules]/ensure: created
       Notice: /Firewall[500 open up port 22]/ensure: created
       Notice: /Firewall[999 drop all]/ensure: created
       Notice: Finished catalog run in 0.80 seconds

I tried to work around by adding some 'before' requirements to firewall. I didn't know how to make all wget::fetch definitions depend on all the firewall definitions, so I tried to make firewall run before Package['wget'] as all wget:fetch definitions require that.

```
  Firewall {
    before  => [Class['maestro_nodes::firewall::post'], Package['wget']],
    require => Class['maestro_nodes::firewall::pre'],
  }
```

```
class maestro_nodes::firewall::post {
   firewall { "999 drop all other requests to ${ipaddress}":
     proto       => 'all',
     action      => 'drop',
     destination => [$ipaddress],
     before      => Package['wget'], # <---------
   }
}
```

```
    resources { 'firewall':
      purge => true,
      before => Package['wget'],
    }
```

But it didn't work