@Virgo Thanks for the info however.

In the past I worked with CISCO and SONICWALL Routers/Firewalls/VPN solutions.

I totally understand what NAT is and how it works, However there should be a block on all ports by default on the WAN interface for added security.

Packets should be dropped right at the door and not in house so to speek. 

And if you look at my other post, this is indeed doable. 

Added a Block all on WAN In and have a few allow only ports needed for Open VPN and IPSec.

Sadly the IPSec allow rule does not work no matter what I do. Thus I have to have the WAN interface open and unprotected.

This may be ok for an average home network, but certainly not an option for business users. 

There should be a default block all traffic on WAN In and There should be a detailed document on how to setup Allow rules for IPSec otherwise this is no "bussiness" router.

  @Ortofan Also super confusing.

In the UI it says when selecting direction for Gatway ACL it says "WAN in" is an option. 

The documentation says it is for LAN to WAN traffic only (Doesnt make any sense).

Then I also found a set of instructions on OMADA setup where it also lists "VPN networks" as an option for allow networks, and this is NOT listed in my firmware 1.02 for the 7212

Very very confusing, specially because with a block all rules it does seem to work and if I put an allow rule front of it the Gatway ACLs works as expected, with the Excpetion of IPSEC!