firewall: move the config_get out of the loop, no need to call it multiple times