rules (traffic sections)

The rules block is a list of up to three traffic sections. Each section matches packets travelling in one direction relative to the firewall VM.

Section	Direction	Matches
to-firewall	inbound to the VM	Packets destined to the firewall itself (SSH, health check).
through-firewall	routed across	Packets routed across the firewall (your main rules).
from-firewall	originated by the VM	Packets originated by the firewall engine itself.

Each section has its own default_action (the fallback when no rule in that section matches).

rules:
  - name: to-firewall
    default_action: drop
    rules:
      - comment: SSH from ops bastion
        src: 10.0.5.10/32
        protocol: tcp
        port: 22
        action: accept

  - name: through-firewall
    default_action: drop
    rules: []   # filled in below

  - name: from-firewall
    default_action: accept
    rules: []

Next: Rule fields — the fields each rule inside a section can carry.