more logic to firewall.c