Description & examples about In Out Fwrd chain filtering

I'm having a hard time understanding the concepts for the firewall & rules packet flow.

Is there some document that describes this with examples ( packet coming from a lan client to a wan device etc...) to get a better understanding ?

Ive been looking at videos but it confuses me more than help me.

Not sure if there is a good explainer, but here is the firewall documentation, and you can also look up information about zone based firewalls (ZPF).

Simplified answer:
Input regulates the traffic that is destined for the firewall host itself (in the case of a router+firewall, that affects the ability to connect to the router for administration, DHCP, DNS, and other locally hosted services).

forward controls the intra-zone forwarding between networks. You can put multiple networks into the same zone (such as the lan zone) -- forward controls the ability for those networks to connect to each other.

output is what allows traffic to egress from the firewall where it is then destined for another zone. (this one is often "accept" unless the zone is expected to have no connectivity to any other zones -- this might be set to drop/reject if you do not want it to be able be routed to any other zones -- a management network with no (or very limited) allowed routing to the internet or other local zones would be such an example).

2 Likes