RE: Ingress filtering from an external cloud service to the internal network