clarify firewall rule changes (possible)