firewalls on the forward chain for ensemble