Is this not enough? The rest seems like a "validity check" of some sort - should that perhaps go in `FirewallRule` itself? Should it even be _possible_ to create a FirewallRule that violates the checks that follow?