Firewall¶
Zone-based policy on the UDR7. Document the intent first, then the rules that implement it — future-you (mid-outage) needs the reasoning, not just a rule dump.
Policy matrix¶
| From \ To | Management | Trusted | IoT | Guest | WAN |
|---|---|---|---|---|---|
| Management | — | allow | allow | allow | allow |
| Trusted | deny | — | allow | deny | allow |
| IoT | deny | deny | — | deny | allow* |
| Guest | deny | deny | deny | — | allow |
* IoT to WAN often restricted to specific destinations. Document exceptions.
Rationale¶
Explain each non-obvious allow/deny: why IoT can't reach Trusted, which management exceptions exist, and any per-device carve-outs.