rework firewall logic