1)  On systems running Upstart, shorewall-init cannot reliably start the
    firewall before interfaces are brought up.