support all ports or all sources, but reject both