As a best practice, don’t think in terms of what to block. Think more in terms of what to _*explicitly permit*_; block and/or alert on the rest. You get better security for less work. a la zero-trust