Input means packets originating from another device within this zone with the router as the destination.
How does this work with the second rule? Wouldn’t any connection from the internet be a connection originating from another device within the wan zone (internet) with the router as the destination? The rule has Input: reject, but I would think that it should then be input: accept.