externalize firewall rules