Chapter 19 Firewall

Your firewall would have the following configuration.

Table 86 Limited LAN to WAN IRC Traffic Example 1

#

USER

SOURCE

DESTINATIO

SCHEDULE

SERVICE

ACTION

N

 

 

 

 

 

 

1

Any

192.168.1.7

Any

Any

IRC

Allow

 

 

 

 

 

 

 

2

Any

Any

Any

Any

IRC

Deny

 

 

 

 

 

 

 

Default

Any

Any

Any

Any

Any

Allow

 

 

 

 

 

 

 

•The first row allows the LAN computer at IP address 192.168.1.7 to access the IRC service on the WAN.

•The second row blocks LAN access to the IRC service on the WAN.

•The third row is (still) the firewall’s default policy of allowing all traffic from the LAN to go to the WAN.

Alternatively, you configure a LAN to WAN rule with the CEO’s user name (say CEO) to allow IRC traffic from any source IP address to go to any destination address.

Your firewall would have the following configuration.

Table 87 Limited LAN to WAN IRC Traffic Example 2

#

USER

SOURCE

DESTINATIO

SCHEDULE

SERVICE

ACTION

N

 

 

 

 

 

 

1

CEO

Any

Any

Any

IRC

Allow

 

 

 

 

 

 

 

2

Any

Any

Any

Any

IRC

Deny

 

 

 

 

 

 

 

Default

Any

Any

Any

Any

Any

Allow

 

 

 

 

 

 

 

•The first row allows any LAN computer to access the IRC service on the WAN by logging into the ZyWALL with the CEO’s user name.

•The second row blocks LAN access to the IRC service on the WAN.

•The third row is (still) the firewall’s default policy of allowing all traffic from the LAN to go to the WAN.

The rule for the CEO must come before the rule that blocks all LAN to WAN IRC traffic. If the rule that blocks all LAN to WAN IRC traffic came first, the CEO’s IRC traffic would match that rule and the ZyWALL would drop it and not check any other firewall rules.

19.4 Alerts

You can choose to generate an alert or log when a rule is matched and have the ZyWALL send an immediate e-mail message to you. Otherwise, see the logs created (for the categories you specified) in the View Log screen. Refer to the chapter on logs for details.

19.5 Asymmetrical Routes

If an alternate gateway on the LAN has an IP address in the same subnet as the ZyWALL’s LAN IP address, return traffic may not go through the ZyWALL. This is called an asymmetrical or “triangle” route. This causes the ZyWALL to reset the connection, as the connection has not been acknowledged.

282

 

ZyWALL USG 1000 User’s Guide