firewall: add sanity checks to zone default rules (patch from #5459)