allow GROUP rule without iface