rock solid default firewall-rules for webhosts