firewall: no need to query nvram on every single rule we are adding to the firewall