Firewall Policies Overview - ZyXEL Communications Vantage CNM 2.0 User Manual

Any protocol that operates in this way must be supported on a case-by-case basis. You can use the web
configurator's Custom Ports feature to do this.

12.6 Firewall Policies Overview

Firewall rules are grouped based on the direction of travel of packets to which they apply: The following
example is for a ZyWALL 100 device.
•
LAN to LAN/ZyWALL
•
LAN to WAN
•
LAN to DMZ
DMZ is not available on all models.
By default, the ZyXEL device's stateful packet inspection allows packets traveling in the following directions:
•
LAN to LAN/ZyWALL
This allows computers on the LAN to manage the ZyWALL and communicate between networks or
subnets connected to the LAN interface.
•
LAN to WAN
•
LAN to DMZ
•
WAN to DMZ
•
DMZ to WAN
By default, the ZyXEL device's stateful packet inspection blocks packets traveling in the following directions:
•
WAN to LAN
•
WAN to WAN/ZyWALL
This prevents computers on the WAN from using the ZyXEL device as a gateway to communicate with
other computers on the WAN and/or managing the ZyXEL device.
•
DMZ to LAN
•
DMZ to DMZ/ZyWALL
This prevents computers on the DMZ from communicating between networks or subnets connected to
the DMZ interface and/or managing the ZyXEL device.
You may define additional rules and sets or modify existing ones but please exercise extreme caution in doing
so.
If you configure firewall rules without a good understanding of how they work, you
might inadvertently introduce security risks to the firewall and to the protected
network. Make sure you test your rules after you configure them.
For example, you may create rules to:
♦ Block certain types of traffic, such as IRC (Internet Relay Chat), from the LAN to the Internet.
♦ Allow certain types of traffic, such as Lotus Notes database synchronization, from specific hosts on the
Internet to specific hosts on the LAN.
♦ Allow everyone except your competitors to access a Web server.
♦ Restrict use of certain protocols, such as Telnet, to authorized users on the LAN.
Configuration > Firewall
•
WAN to LAN
•
WAN to WAN/ZyWALL
•
WAN to DMZ
Vantage CNM 2.0
•
DMZ to LAN
•
DMZ to WAN
•
DMZ to DMZ/ZyWALL
12-7