if you had multiple subnets that you were connected to and you wanted to block internet access to one computer but not access to the other subnets, you would then have to specify that the internet is the destination that you want to block it from and not the other subnets. where, if you put the rule on the wan_out from the station ip it only applies wherever that interface will take you, which is most likely just the internet. if you don't run multiple networks off that router, then of course that's all pointless :-)
↧