add top-level route and firewall-generating rule calls