firewall: fix zone defaults