first commit and build

docs/network/firewall.md

@@ -0,0 +1,21 @@
+# Firewall
+
+Zone-based policy on the UDR7. Document the **intent** first, then the rules
+that implement it — future-you (mid-outage) needs the reasoning, not just a
+rule dump.
+
+## Policy matrix
+
+| From \ To | Management | Trusted | IoT | Guest | WAN |
+|---|---|---|---|---|---|
+| Management | — | allow | allow | allow | allow |
+| Trusted | deny | — | allow | deny | allow |
+| IoT | deny | deny | — | deny | allow* |
+| Guest | deny | deny | deny | — | allow |
+
+\* IoT to WAN often restricted to specific destinations. Document exceptions.
+
+## Rationale
+
+Explain each non-obvious allow/deny: why IoT can't reach Trusted, which
+management exceptions exist, and any per-device carve-outs.