Hey,
1. not quite, for vnets the the firewall attaches to the bridge FORWARD hook, so there is no separate IN/OUT. So it will filter everything that goes through the bridge, this can be east-west traffic between guests on the same vnet, but also includes traffic between vlan's on that vnet. The...