firewall: allow local redirection of ports