Traffic not expressly permitted by the firewall policy should generally be:

1. A policy can either permit by default or deny by default. 2. The recommendation is the stricter of the two. 3. All traffic not expressly permitted by the firewall policy should be blocked. 4. Such traffic is not needed by the organization. _Source: NIST SP 800-41 Rev. 1, 'Guidelines on Firewalls and Firewall Policy'_