* route config must be with firewall script