def action_traffic_permitted(env, state, action):
    """
    Return True if action is permitted in terms of firewall traffic
    """
    if action.is_scan():
        return True
    network = env.network
    service = action.service
    dest = action.target[0]
    # add 0 since 0 = internet
    compromised_subnets = set([0])
    for m in env.address_space:
        if state.machine_compromised(m):
            compromised_subnets.add(m[0])
    for src in compromised_subnets:
        if network.traffic_permitted(src, dest, service):
            return True
    return False