firewall: comply with REC-22, REC-24 of RFC 6092