note that hardware firewalls must open up some ports