implement rules API for <vmid>.fw