[RFC] Firewall role

Implemented (optional) firewall role:

* iptables as persistent firewall layer on all `eth` interfaces
  * optional ipv6 support
  * configured open ports for ssh, http, https
* fail2ban as intrusion protection system
  * configured for ssh (+ddos), apache (+overflow)
  * configurable ip whitelist, ban time & notifications
* added as service in evolution init script
* test for ports expected open & expected blocked

Reimplements genesis/wordpress#71