Only allow ICMP and SSH traffic

Includes firewall module <https://forge.puppetlabs.com/puppetlabs/firewall>
with an as yet not included fix
<https://github.com/puppetlabs/puppetlabs-firewall/pull/365>.