refactored firewall module in preparation for rewrite