Firewall Editor Warnings for Deny Rules and Public Ports

What's changed

• When a deny rule takes away what an allow rule lets in, the firewall editor now shows a note under the deny rule as you edit it, and the read-only rules list on the firewall page and on each Security tab shows it too. On databases, caches, queues and containers a deny rule wins over every allow rule, and a deny rule with no sources blocks every connection to that port, including from your own resources
• The note says who loses access, for example the address or resource that an allow rule lets in and the deny now blocks, and when an allow rule is open to anyone it says that the allow rule now lets nothing in, and how to close the port or block particular sources
• The note stays quiet when the firewall protects only servers, where allow rules are checked before deny rules, and for the default Deny all other inbound traffic rule
• On a database, cache or queue with public access on, a rule written for the public port in your connection string instead of the service's own port, such as 5432 for PostgreSQL, now gets a note that it has no effect, because firewall rules use the service's own port for public connections too
• That note also says when no rule allows the service port from a public address, because the public endpoint then refuses every connection. A rule that lists only resources or private ranges such as 10.0.0.0/8 does not let a public client in, so the note still appears for it
• The note above the inbound rules now gives each service's own port: 5432 for PostgreSQL, 3306 for MySQL, 6379 for caches and 5672 for AMQP