@matigo based on what you've told me so far, I assume they have an "any any accept" rule somewhere in the firewall. ?
Searching