Comment by remram

The firewall can't tell what is legitimate traffic and what looks like legitimate traffic, but the application often can. This is what DOTS us trying to cover: let the application server tell the firewall who to allow or block in real time.

https://www.rfc-editor.org/rfc/rfc8782.html