The rules edit page can do it, but it was not picked up
by the actual firewall rules...