One more difference is the final rule which drops all new connection tries from your WAN port to our LAN community (Unless of course DstNat is made use of). With no this rule, if an attacker knows or guesses your local subnet, he/she will set up connections on to area https://wbofficial.com