Describe the match
The builder represents the proposed rule as an action plus match conditions. Protocol, direction, addresses, and ports determine which traffic the result describes. A CIDR covers a network rather than one host, and an unrestricted endpoint broadens the match. Port selectors apply to port-bearing protocols such as TCP and UDP. Read the output as a packet filter expression, not as a prose security goal.