use puppetlabs's firewall repo

same as ghoneycutt's, so tracking the proper upstream