Chapter 19 Firewall

•The third row is (still) the firewall’s default policy of allowing all traffic from LAN1 to go to the WAN.

Alternatively, you configure a LAN to WAN rule with the CEO’s user name (say CEO) to allow IRC traffic from any source IP address to go to any destination address.

Your firewall would have the following configuration.

Table 112 Limited LAN to WAN IRC Traffic Example 2

#

USER

SOURCE

DESTINATION

SCHEDULE

SERVICE

ACTION

1

CEO

Any

Any

Any

IRC

Allow

 

 

 

 

 

 

 

2

Any

Any

Any

Any

IRC

Deny

 

 

 

 

 

 

 

Default

Any

Any

Any

Any

Any

Allow

 

 

 

 

 

 

 

•The first row allows any LAN1 computer to access the IRC service on the WAN by logging into the ZyWALL with the CEO’s user name.

•The second row blocks LAN access to the IRC service on the WAN.

•The third row is (still) the firewall’s default policy of allowing all traffic from LAN1 to go to the WAN.

The rule for the CEO must come before the rule that blocks all LAN1 to WAN IRC traffic. If the rule that blocks all LAN1 to WAN IRC traffic came first, the CEO’s IRC traffic would match that rule and the ZyWALL would drop it and not check any other firewall rules.

19.1.4 Firewall Rule Configuration Example

The following Internet firewall rule example allows a hypothetical MyService from the WAN to IP addresses 192.168.1.10 through 192.168.1.15 (Dest_1) on LAN1.

1Click Firewall. Click the Add icon () in the heading row to configure a new first entry (as in this example) or the Add icon ( ) in an entry to add a rule below the selected entry. Remember the sequence (priority) of the rules is important since they are applied in order.

340

 

ZyWALL USG 100/200 Series User’s Guide