firewall: move include sourcing into a subshell, this makes the firewall init immune...