shorewall: don't fail on empty ports