firewall: fix validation constraints