Move all firewall logic to generate-firewall-rules

New support for port ranges:
 * port a to port b = a:b
 * no port in case of non-tcp or udp protocol = -