libs/core: rework firewall model