ZyXEL Communications ZyWall ATP series User Manual page 494

Figure 336 Blocking All LAN to WAN IRC Traffic Example
Your Security Policy would have the following settings.
Table 198 Blocking All LAN to WAN IRC Traffic Example
# USER SOURCE
1 Any Any
2 Any Any
• The first row blocks LAN access to the IRC service on the WAN.
• The second row is the Security Policy's default policy that allows all LAN1 to WAN traffic.
The Zyxel Device applies the security policies in order. So for this example, when the Zyxel Device
receives traffic from the LAN, it checks it against the first policy. If the traffic matches (if it is IRC traffic)
the security policy takes the action in the policy (drop) and stops checking the subsequent security
policies. Any traffic that does not match the first security policy will match the second security policy
and the Zyxel Device forwards it.
Now suppose you need to let the CEO use IRC. You configure a LAN1 to WAN security policy that allows
IRC traffic from the IP address of the CEO's computer. You can also configure a LAN to WAN policy that
allows IRC traffic from any computer through which the CEO logs into the Zyxel Device with his/her user
name. In order to make sure that the CEO's computer always uses the same IP address, make sure it
either:
• Has a static IP address,
or
• You configure a static DHCP entry for it so the Zyxel Device always assigns it the same IP address.
Now you configure a LAN1 to WAN security policy that allows IRC traffic from the IP address of the CEO's
computer (172.16.1.7 for example) to go to any destination address. You do not need to specify a
schedule since you want the security policy to always be in effect. The following figure shows the results
of your two custom policies.
Chapter 25 Security Policy
DESTINATION SCHEDULE
Any Any
Any Any
ZyWALL ATP Series User's Guide
494
SERVICE ACTION
IRC Deny
Any Allow