That's another thing I liked about DO more than AWS. AWS seems too overwhelming as they have too much going on. DO is simple.

The thing I am proposing about the ACL on firewall already exists in DO - but it only exists for the droplets. I don't think it would be too hard for them to port it over for the firewall too without making things too complicated.