Stealth rule should prevent all direct connections to the Security gateway
Add the following rule:
Source: Any
Destination: Security gateway
Service: Any
Action: Drop
This rule will drop all connections to the Security gateway, so it will become "invisible" to the outside world.