separate tcp and udp rules