Another variation is the final rule which drops all new relationship makes an attempt from your WAN port to our LAN community (Until DstNat is employed). Without this rule, if an attacker is aware or guesses your local subnet, he/she will be able to build connections on to local hosts https://wbofficial.com