refactor firewall state to be more useful

allows udp/tcp
allows port
allows source via CIDR