the default that has to be deny
Per-port rules look like security and behave like a promise to remember every port. Workloads get new ports when they are rescheduled, and the rule list does not grow with them, so the estate accumulates silent holes that nobody wrote down.