One list for the whole box (dev and uat share it). An allowed IPv4 can reach: SSH 22, MySQL 3306, Mongo 27017, Redis 6379/6380, Kafka 9092‑9094 / 9392‑9394. Everything else — and every other IP — stays blocked.