The menu Network Protection > Firewall allows you to define and manage firewall rules of the gateway. Generally speaking, the firewall is the central part of the gateway which functions in a networked environment to prevent some communications forbidden by the security policy. The default security policy of Sophos UTM states that all network traffic is to be blocked and logged, except for automatically generated rule sets that are necessary for other software components of the gateway to work. However, those auto-generated rule sets are not shown on the Firewall > Rules tab. This policy requires you to define explicitly which data traffic is allowed to pass the gateway.
Sophos UTM Administration Guide