make sure the firewall enable happens last