Firewall > Access Rules
422
SonicOS Enhanced 4.0 Administrator Guide
Stateful Packet Inspection Default Access Rules Overview
By default, the SonicWALL security appliance’s stateful packet inspection allows all
communication from the LAN to the Internet, and blocks all traffic to the LAN from the Internet.
The following behaviors are defined by the “Default” stateful inspection packet access rule
enabled in the SonicWALL security appliance:
• Allow all sessions originating from the LAN, WLAN to the WAN, DMZ, or OPT.
• Allow all sessions originating from the DMZ or OPT to the WAN.
• Deny all sessions originating from the WAN to the DMZ or OPT.
• Deny all sessions originating from the WAN and DMZ or OPT to the LAN or WLAN.
Additional network access rules can be defined to extend or override the default access rules.
For example, access rules can be created that block certain types of traffic such as IRC from
the LAN to the WAN, or allow certain types of traffic, such as Lotus Notes database
synchronization, from specific hosts on the Internet to specific hosts on the LAN, or restrict use
of certain protocols such as Telnet to authorized users on the LAN.
Custom access rules evaluate network traffic source IP addresses, destination IP addresses,
IP protocol types, and compare the information to access rules created on the SonicWALL
security appliance. Network access rules take precedence, and can override the SonicWALL
security appliance’s stateful packet inspection. For example, an access rule that blocks IRC
traffic takes precedence over the SonicWALL security appliance default setting of allowing this
type of traffic.
Caution The ability to define network access rules is a very powerful tool. Using custom access rules
can disable firewall protection or block all access to the Internet. Use caution when creating
or deleting network access rules.
Using Bandwidth Management with Access Rules Overview
Bandwidth management allows you to assign guaranteed and maximum bandwidth to services
and prioritize traffic on all WAN zones. Using access rules, bandwidth management can be
enabled on a per-interface basis. Packets belonging to a bandwidth management enabled
policy will be queued in the corresponding priority queue before being sent on the bandwidth
management-enabled WAN interface. All other packets will be queued in the default queue and
will be sent in a First In and First Out (FIFO) manner (a storage method that retrieves the item
stored for the longest time).

Example Scenario

If you create an access rule for outbound mail traffic (such as SMTP) and enable bandwidth
management with the following parameters:
• Guaranteed bandwidth of 20 percent
• Maximum bandwidth of 40 percent
• Priority of 0 (zero)