only install firewall rules on a master