firewall: add rules for nova