my management station is equally behind a statefull firewall that blocks everything that is not needed, this includes all public Chinese (and Russian for that matter) address space.
And how are you against for example dns-tunneling Mr. Securuty Engineer?
If I was chinese software engineer and I just needed few hundred bytes of traffic to request/receive/execute commands.
security, lol