firewall rule hiera lookup