Where can firewall rules be applied on the NSX Edge Services Gateway?

A.
Rules can be applied on the uplink interface only.

B.
Rules can be applied on either the uplink interface or internal interface.

C.
Rules can be on either the uplink, internal, or management interfaces.

D.
Rules can be applied on the management and uplink interfaces only.

Explanation:
https://pubs.vmware.com/NSX-6/index.jsp?topic=%2Fcom.vmware.nsx.install.doc%2FGUID-
6FB89057-CD13-48AF-82F2-550B89F89FC5.html