I contacted Adtran support and Wil helped clarify things for me. I wanted to post the results here in case anyone else finds themselves confused by the same thing. In the Cisco world, a 'deny any' statement will block all traffic. However, in the Adtran world, when you use a 'allow list' with an access list that has a 'deny any' statement, you actually aren't doing anything at all, neither blocking nor permitting. Also, the reason that nothing was getting blocked from getting through the WAN interface of the router was due to stateful inspection by the firewall. Any traffic that is initiated from the private interface will be allowed back in regardless of the rules in my policy-class. Here is the super helpful explanation from Wil regarding Access Control Policies:
The Access Control Lists are used as selectors to match traffic (either permit or deny). Then, the Access Control Policy of that interface is where the action is performed (either allow or discard). If traffic matches the criteria of the deny statement then it will not perform the action of the ACP and instead will move on to the next rule. An ACL with a deny statement does not block traffic. Instead, the traffic needs to match an ACL with a permit statement, it will then perform the action of the ACP, either allowing or discarding the traffic. If it matches none of the rules that have been created then it will be blocked by the implicit discard that is automatically applied to all ACPs.
For example, if you look at the sample config you sent me, if a computer on the private side begins to ping google then the traffic would enter the box on the vlan 1 interface.The access-policy "Private" and begins to examine the traffic in a top down fashion. The first rule is an allow for the ACL "self" for all traffic from the source of any to the destination of any with the "self" statement meaning the ip address of the box. This rule is allowing any ip traffic from the private side, destined to the box ip address through the firewall.
The second rule "nat source list wizard-ics interface eth 0/1 overload" is going to perform a NAT on the source address of any traffic that matches the ACL "wizard-ics" which is "permit any" This means all traffic initiated from the private side, will match this ACL and because it is a permit, it will then perform the action of the ACP (in this case a NAT).
If we look at the policy class "Public" we see the rule "allow list DenyAll-acl" this will allow any traffic that matches the ACL, "DenyAll-acl" However, the "Deny-All-acl" is a deny any which means that any traffic that matches this rule (which is everything) will skip this ACP and move on to the next rule. The first rule of the Public policy class isn't performing any action. Instead the traffic is moving on to the next rule after "allow list DenyAll-acl" which in our case is the implicit Discard that is there by default. Any traffic that is initiated from the internet to your public interface is being blocked by that implicit discard automatically applied on the bottom of all ACPs.
