firewall: type fixes