Get rid of broken masquerade firewall rule.

I seem to have botched the syntax for this one. I'll have to add a
working one later.

I also removed the catchall reject rule from the headnode_host manifest;
This should be done outside of this module.