firewall: allow routed lan<->lan traffic by default