dnsmasq: add a CNAME for ntp
firewall: allow NTP access
dnsmasq: advertise for NTP server
interfaces: use an untagged VLAN for isolated LAN

It seems quite painful to configure Netgear switches to use a tagged
VLAN for administration. Let's keep an untagged one.
firewall: identify physical interfaces for QoS
dhcp: use vendor-class-identifier

dhcp-class-identifier was the previous name. We keep "pfSense" just
because we have to reinitialize internet otherwise...
ddns: don't execute ddns-updater if we didn't get an IP address
ddns: execute ddns-updater directly (not through systemd)
Revert "ddns: execute ddns-updater directly (not through systemd)"

This reverts commit 8ceabfc69a4efa6e022c6a20475f2096b09da11d.
ddns: don't block when starting ddns-updater
dnsmasq: don't use bash stuff to update /etc/resolv.conf.dhclient
dnsmasq: use a shorter lease

If dnsmasq is restarted, we lose the names. Try to use a shorter lease
to workaround that.
nginx: proxy printer configuration
Revert "nginx: proxy printer configuration"

This reverts commit 70dc75edb82bff4ef2984fc7b0ec10996ea587e1. Hostname
seems to be resolved at start. Not what we want.
Revert "Revert "nginx: proxy printer configuration""

This reverts commit c28ae27e0e7cfe315ccac839cc112743ef216719. Use
"resolve" keyword introduced in nginx 1.5.12.
Revert "Revert "Revert "nginx: proxy printer configuration"""

This reverts commit 09a251b72f2a3553f8b583e58c0dbf044deb968b. Despite
the "resolve" keyword, the name needs to be solvable on start. On boot,
this won't be the case.
firewall: remove transition rules
firewall: DNS answers seem to also have problems with conntrack
dhcp: also request option-6rd
firewall: don't drop multicast, we need it to debug IPv6