This isn't properly handled by Qubes VMs yet, so block it in all the VMs. Also restrict access to firewall config.
Marek Marczykowski