Firewall Rules Keep Their Ports and Protocols

What's changed

• Regenerating a firewall no longer turns a port-specific rule into an all-traffic rule, and stale rules are replaced correctly
• Large port ranges are accepted again instead of being rejected by the policy engine
• A firewall named with spaces or capitals now deploys; the name is only used as a label
• Attaching and detaching firewalls is safe to retry, detaching cleans up the generated policy, and removing an instance removes its policies too