Weblogic Domain>Security>Filter>Connection Filter Rules port issue after adop cutover

Last fall we loaded AD and TXK Delta.11 and in those patching instructions, it said you have to configure connection filter rules to allow servers/users/ports access to Weblogic and the console.  My understanding was that you were supposed to list each port controlled by Weblogic (i.e. shown in the Environment/Servers screen), the servers in your environment, and an IP address mask of the staff who use the Weblogic Console.

I've noticed since this patching that when subsequent patches are applied via adop, after you run cutover to the new Run FS, the ports on the Connection Filter Rules get changed to all list the AdminServer port.  When I saw that, I was fixing it in the Weblogic Console, but I just noticed that in our production environment, the port entries are all there with the AdminServer port.  Is this a bug?  Do I only need to list the AdminServer port in the filter rules and not all the other ports?