It's not usually dynamic. That is, most folk will make the rules and restart rather than tinker without a restart of the network stack. That along with a restart of Eset.