FirewallRules: pick DNS/DHCP hosts for fw rules. Refs #2775