The rule you wrote is the rule that runs
Every provider names its firewall constructs differently, and the translation work lands on you. ProjectX networking gives you one rule model — direction, protocol, port range, CIDR — that means the same thing everywhere and denies what it does not name.
What you get
- Private networks with subnets and routes, isolated per tenant.
- Firewalls written once in one rule model, translated to whatever each provider calls them, deny-by-default.
- Layer-4 and layer-7 load balancers on one resource, every listener health-checking the backends it sends traffic to.
- DNS with health-checked failover and location-based routing as record policy.
Refused at validation, not in production
Configuration that cannot work is an error when you write it: a certificate on a plain TCP listener is refused now, not discovered as a mystery at 3 a.m. The API would rather say no than run something ambiguous.