CJ: add firewall rules