added firewall

configuration vars now CFG_*
waits forever if salt is not there or key is wrong