For an ingress acl rule, we should not set src address and for egress rule, we should not set dst address because if the SG is attached to a service VM interface, it will not pass transit traffic