fix firewall resources for libvirt negations and --ctstate rules