Lan To Wan Rules; Alerts; Triangle Route; The "Triangle Route" Problem - ZyXEL Communications G.SHDSL.bis 4-port Security Gateway P-793H User Manual

Chapter 9 Firewall Configuration

9.4.1 LAN to WAN Rules

The default rule for LAN to WAN traffic is that all users on the LAN are allowed non-
restricted access to the WAN. When you configure a LAN to WAN rule, you in essence want
to limit some or all users from accessing certain services on the WAN. WAN to LAN Rules
The default rule for WAN to LAN traffic blocks all incoming connections (WAN to LAN). If
you wish to allow certain WAN users to have access to your LAN, you will need to create
custom rules to allow it.

9.4.2 Alerts

Alerts are reports on events, such as attacks, that you may want to know about right away. You
can choose to generate an alert when a rule is matched in the Edit Rule screen (see
on page 137). When an event generates an alert, a message can be immediately sent to an e-
mail account that you specify in the Log Settings screen. Refer to the chapter on logs for
details.

9.5 Triangle Route

When the firewall is on, your ZyXEL Device acts as a secure gateway between your LAN and
the Internet. In an ideal network topology, all incoming and outgoing network traffic passes
through the ZyXEL Device to protect your LAN against attacks.

Figure 57 Ideal Firewall Setup

9.5.1 The "Triangle Route" Problem

You may have more than one connection to the Internet (through one or more ISPs). If the
alternate gateway is on the LAN (and its IP address is in the same subnet as the ZyXEL
Device's LAN IP address), the "triangle route" (also called asymmetrical route) problem may
occur. The steps below describe the "triangle route" problem.
1 A computer on the LAN initiates a connection by sending out a SYN packet to a
receiving server on the WAN.
2 The ZyXEL Device reroutes the SYN packet through Gateway A on the LAN to the
WAN.
3 The reply from the WAN goes directly to the computer on the LAN without going
through the ZyXEL Device.
As a result, the ZyXEL Device resets the connection, as the connection has not been
acknowledged.
132
Figure 62
P-793H User's Guide