EdgeRouter and Unifi routers are built on top of Linux with Netfilter/iptables. This gives them quite a bit of flexibility compared to other routing platforms systems based on proprietary operating systems.
Understanding how rules are applied in the netfilter stack are important in building an effective firewall.
IN and OUT Target Direction
IN and OUT rules are specifically for routing and only apply to packets that are going through the router, not originating from the router.
IN is processed first, and is the direction you should be using when trying to control what packets coming in on an interface should be doing.
For example, if you want to prevent your GUEST (eth2) network on 172.16.1.0/24 from communicating with your LAN (eth1) on 192.168.1.0/24…
set firewall name GUEST-IN rule 10 action drop set firewall name GUEST-IN rule 10 description 'Drop traffic from GUEST to LAN' set firewall name GUEST-IN rule 10 log disable set firewall name GUEST-IN rule 10 protocol all set firewall name GUEST-IN rule 10 source address 172.16.1.0/24 set firewall name GUEST-IN rule 10 destination address 192.168.1.0/24 set interfaces ethernet eth2 firewall in name GUEST-IN
Basically, you want to act on packets as early on in the stack as possible.
OUT rules are handled in the same way as IN rules and handled after IN rules. Because they are both handled in the netfilter FORWARD chain, they are technically handled in the same way and mostly are separated just for the benefit of the user.
LOCAL Target Direction
LOCAL rules are specifically for controlling traffic directed at the router and have no impact on routed traffic.
For example, if you wanted to restrict access to SSH from the WAN (eth0)…
set firewall name WAN-IN rule 10 action drop set firewall name WAN-IN rule 10 description 'Drop SSH connections from WAN' set firewall name WAN-IN rule 10 log disable set firewall name WAN-IN rule 10 protocol tcp set firewall name WAN-IN rule 10 destination port 22 set interfaces ethernet eth0 firewall in name WAN-IN
LOCAL rules are applied to the netfilter INPUT chain. There is no way to add rules to the netfilter OUTPUT chain unless you directly insert them in via iptables.