# Firewall

Zone-based policy on the UDR7. Document the **intent** first, then the rules
that implement it — future-you (mid-outage) needs the reasoning, not just a
rule dump.

## Policy matrix

| From \ To | Management | Trusted | IoT | Guest | WAN |
|---|---|---|---|---|---|
| Management | — | allow | allow | allow | allow |
| Trusted | deny | — | allow | deny | allow |
| IoT | deny | deny | — | deny | allow* |
| Guest | deny | deny | deny | — | allow |

\* IoT to WAN often restricted to specific destinations. Document exceptions.

## Rationale

Explain each non-obvious allow/deny: why IoT can't reach Trusted, which
management exceptions exist, and any per-device carve-outs.