TripleO firewall should be per Network

[Federico Iezzi]

The current (Ocata and Pike) TripleO Firewall adds a bunch of IPTables rules to allow defined ports on every network interfaces.
It means that any sensible services i.e. SSH and PCSD, binding every network, even on the External Network, are not filtered at all.

[Emilien Macchi (emilienm)]

This bug report is a well-known limitation of Firewall support in TripleO and has been an ongoing topic for some months. It requires some work in THT and puppet-tripleo but nobody has spent time on this thing, that I would call a feature.

[Ben Nemec (bnemec)]

I'm re-targeting to Queens. I don't think we can absorb a major refactoring of the firewall support in pike. However, I think we need to talk to the folks in the security squad and see if they can prioritize this for early in Queens since it clearly is something we need to address.

[Emilien Macchi (emilienm)]

This is an automated cleanup. This bug report has been closed because it
is older than 18 months and there is no open code change to fix this.
After this time it is unlikely that the circumstances which lead to
the observed issue can be reproduced.

If you can reproduce the bug, please:
* reopen the bug report (set to status "New")
* AND add the detailed steps to reproduce the issue (if applicable)
* AND leave a comment "CONFIRMED FOR: <RELEASE_NAME>"
  Only still supported release names are valid (FUTURE, PIKE, QUEENS, ROCKY, STEIN).
  Valid example: CONFIRMED FOR: FUTURE