firewall: add rule for traceroute support