Move the allow_pings to the provisioning stage instead of during the OS install; this is so the firewall setting actually persists.