Last piece for directly adressable lxc:

in shorewall, be not permissive on net network if publicly addressable

cc @jpcw @regilero @samaradona