firewall script is optional