Comment by zx2c4

It's like a routing table on the way out and an ACL on the way in. Maybe an easier way to think of it.