caesium: add firewall

Change-Id: Ib8a24fa74b143b891d186247a178a06bee624503