I want hosts on the WIFI to be able to access the internet without being able to access the LAN. That is what I thought the first rule was supposed to do.