base/firewall: fix dep cycle