https-dns-proxy: only restart firewall when needed