in and out means catch traffic when it comes in or when it goes out respectively.
So you can configure the 'out' on the Internet facing interface to catch the request before it goes out to the Internet.
But you can also configure the 'in' on the client interface to catch the request when it comes into the router.
The 'in' gives much better performance because you catch the request before doing a route loockup.
The only disadvantage is that if you have many client vlans, you need to configure this 'in' command for each one of them.
Regards,
Gilles.