firewall: fist version of firewall
firewall: there is no ip6tables package
firewall: fix sourcing of rule files
firewall: replace address to allow idempotency
firewall: dns port is "domain"
firewall: ensure dhcp is applied to an input interface
firewall: just drop those noisy ports
firewall: puppet refuse to refresh a oneshot service

Use an exec type instead.
firewall: fix typo in FIREWALL-OUTPUT-INET chain name
firewall: currently, IPv6 can come from "internet"

When 6rd will be setup, it will come only from "internet6". Let's handle
both cases.
firewall: try to not conflict with current addressing
firewall: add temporary rules for mdns
firewall: fix mdns rules
firewall: drop mdns on non-trusted LAN
firewall: mdns OK from trusted VLAN
firewall: allow DHCP from internet (for IPv6)
firewall: temporarily accept RA from internet
firewall: just drop filtered broadcast
firewall: don't forget to drop!
firewall: fix RA acceptation from internet