See requirement 1.2 of https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-... Only s

See requirement 1.2 of https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-... Only services necessary for the business should be allowed in/out. If the service can’t be firewalled by simple IP:port then you are left with having to use a proxy to enforce the access control.