22 lines
696 B
Markdown
22 lines
696 B
Markdown
# Firewall
|
|
|
|
Zone-based policy on the UDR7. Document the **intent** first, then the rules
|
|
that implement it — future-you (mid-outage) needs the reasoning, not just a
|
|
rule dump.
|
|
|
|
## Policy matrix
|
|
|
|
| From \ To | Management | Trusted | IoT | Guest | WAN |
|
|
|---|---|---|---|---|---|
|
|
| Management | — | allow | allow | allow | allow |
|
|
| Trusted | deny | — | allow | deny | allow |
|
|
| IoT | deny | deny | — | deny | allow* |
|
|
| Guest | deny | deny | deny | — | allow |
|
|
|
|
\* IoT to WAN often restricted to specific destinations. Document exceptions.
|
|
|
|
## Rationale
|
|
|
|
Explain each non-obvious allow/deny: why IoT can't reach Trusted, which
|
|
management exceptions exist, and any per-device carve-outs.
|