create the firewall rule just once