Split firewall config into its own section

Fixes #365, splits the firewall for the webserver into a separate role so it doesn't affect the local vagrant setup.