Move firewall stuff to common role, spin off shaping script separately