Comment 14 for bug 1511869

I'm on 16.04 and I tried installing shorewall-init and configuring /etc/default/shorewall-init per http://shorewall.net/Shorewall-init.html as well as setting safestop=1 in /etc/default/shorewall but was still able to ping my firewall's external IP for a couple seconds upon every reboot.

I had to change my /etc/systemd/system/shorewall.service

from

Wants=network-online.target
After=network-online.target

to

Wants=network-pre.target
Before=network-pre.target

Once that was set, I was no long able to ping my firewall while it was booting up. Thanks to everyone in this thread for contributing.