consider security group chains in iptables_get_chains
consider host-IN/OUT chains in iptables_get_chains
simplify firewall and use MD5 hash to detect changes