Chapter 11 Firewall
Now you configure a LAN to WAN firewall rule that allows IRC traffic from the IP address of the CEO’s computer (192.168.1.7 for example) to go to any destination address. You do not need to specify a schedule since you want the firewall rule to always be in effect. The following figure shows the results of your two custom rules.
Figure 133 Limited LAN to WAN IRC Traffic Example
Your firewall would have the following configuration.
Table 47 Limited LAN to WAN IRC Traffic Example
# | SOURCE | DESTINATIO | SCHEDULE | SERVICE | ACTION | |
N | ||||||
|
|
|
|
| ||
1 | 192.168.1.7 | Any | Any | IRC | Allow | |
|
|
|
|
|
| |
2 | Any | Any | Any | IRC | Drop | |
|
|
|
|
|
| |
Default | Any | Any | Any | Any | Allow | |
|
|
|
|
|
|
•The first row allows the LAN computer at IP address 192.168.1.7 to access the IRC service on the WAN.
•The second row blocks LAN access to the IRC service on the WAN.
•The third row is (still) the firewall’s default policy of allowing all traffic from the LAN to go to the WAN.
The rule for the CEO must come before the rule that blocks all LAN to WAN IRC traffic. If the rule that blocks all LAN to WAN IRC traffic came first, the CEO’s IRC traffic would match that rule and the ZyWALL would drop it and not check any other firewall rules.
11.6 Asymmetrical Routes
If an alternate gateway on the LAN has an IP address in the same subnet as the ZyWALL’s LAN IP address, return traffic may not go through the ZyWALL. This is called an asymmetrical or “triangle” route. This causes the ZyWALL to reset the connection, as the connection has not been acknowledged.
You can have the ZyWALL permit the use of asymmetrical route topology on the network (not reset the connection).
| 201 |
ZyWALL 2 Plus User’s Guide | |
|
|