(netflow) add egress_only option to ui and netflow setup script. for most downstream interfaces it's a good idea to inspect both traffic going to the firewall (proxy usage for example)  as going through it, for wan type interfaces however you don't want to count the traffic going to local for nat processing (no ingress).