Visualizes the documented gap: pfSense always applies, firewalld only covers native services, Docker-published ports skip straight past it.