I'm somewhat confused by some of the firewall's terminology .
If the 'Source Zone' is ' Device Output' what exactly does that mean ? This is the router and all output to any destination passes through it .
If the 'Destination Zone' is 'Device Input' what exactly does that mean ? This is the router and all traffic is input to it .
What I'm really asking is how the above 2 selections are handled by the firewall's routing process .
Egress traffic originating from the router.
Ingress traffic destined to the router.
See https://en.m.wikibooks.org/wiki/Communication_Networks/IP_Tables and especially https://upload.wikimedia.org/wikipedia/commons/thumb/3/37/Netfilter-packet-flow.svg/1280px-Netfilter-packet-flow.svg.png as a useful on hand document.
Regarding input vs forward, see https://thermalcircle.de/lib/exe/fetch.php?media=linux:routing_simple_01.png from here: https://thermalcircle.de/doku.php?id=blog:linux:routing_decisions_in_the_linux_kernel_2_caching
I'm going to rephrase your question:
If I put an interface in the wan part of the firewall and another interface in the lan part of the firewall, what does that do?
It tells OpenWrt what to let flow out (lan), easily, and what to discriminate/block (wan) when both solicited and unsolicited, probes come in or out on ports.
More modern flow diagram:
https://wiki.nftables.org/wiki-nftables/index.php/Flowtables
