Ensure shorewall either starts up correctly or fails safe

see isec report, issue 19

if shorewall doesn't start up correctly it should lock down everything except ssh

(from redmine: created on 2013-07-31, closed on 2013-09-04, relates #2399 (closed), relates #3076)