firewall shouldn't search all nodes

also, split to a new class, removing all isItemRelayed checks from the
base class