monolith/firewall: allow multicast