A server requires one inbound application port from an approved subnet. Which firewall design fits?

1. Disable every firewall profile
2. Block the application's port and assume DNS will carry its traffic
3. Allow all inbound traffic from any source
4. A narrowly scoped inbound allow rule for the required protocol, port, and source