base::firewall always needs defs, but main-input should be absent if ensure => absent

Change-Id: I153b175f558944a203e9bc923c7baab742f6a82c