IP Containers in Firewall Rule

Acording to the KB, "The Internet firewall inspects traffic between the WAN and the Internet and lets you create rules to control this traffic."

Dumb question but then is the firewall one directional? WAN to Internet?

I ask because other firewalls have rules/policies that are bi-directional. When I tried to create an Internet firewall rule in CATO and tried to select an IP Container (bad source IP's) it did not have an option, which indicates to me that the Internet Firewall rules are WAN to Internet only.

In that case how do I apply an IP Container to block for inbound traffic from the Internet?