I'm inhereting this client from someone else and they had it configured that way. For now I'm just replacing their aging cisco 2800, hopefully soon I can start improving other things.
Thanks for taking a look. I wasn't sure if the firewall rule should list the internal or external IP for the destination, cisco uses external but i've seen other Ubiquiti configs that looked like they used the internal.