does reachbale spoofing need rule 2?