allow mesh to mesh traffic; rework firewalling