firewall: add keystone rules