nixos/firewall: Don't allow traffic during reload