Interesting. I guess I've been lucky as I use externally managed stateful and stateless rules (aws security groups + network acls)