Firewall backport

This backports the changes from #3681 with the 2.4-only changes.

After this is merged, we'll need to merge this into master (like normal). At that time, the 2.5-specific changes from the `firewall_restriction` and firewall configuration need to be added back.

| Q             | A
| ------------- | ---
| Doc fix?      | yes
| New docs?     | no
| Applies to    | 2.4
| Fixed tickets | n/a

Thanks!