Make the module actually work reliably

First attempt probably only worked due to continuous fussing over the same
server.

- Parameterize the public address so that the module can work on nodes assigned
  an elastic address.
- Parameterize the local address because a mysterious disappearance of the ec2
  facts.
- restart setkey, not start.  And flush everything while we're at it.
- Tell racoon to generate policies.
- Add an ESP requirement to 1701 against local address in addition to public.
- Shorewall doesn't know what ppp0 is until someone connects, so masq by
  address range instead.