nat rules require firewall rules to allow traffic