guest: fix firewall rules