ZyXEL g-2000 plusv2 Betriebsanweisung

ZyXEL G-2000 Plus v2 User’s Guide

140

Chapter 10 Firewalls

With stateful inspection, fields of the packets are compared to packets that are already known 
to be trusted. For example, if you access some outside service, the proxy server remembers 
things about your original request, like the port number and source and destination addresses. 
This remembering is called saving the state. When the outside system responds to your 
request, the firewall compares the received packets with the saved state to determine if they 
are allowed in. The ZyXEL device uses stateful packet inspection to protect the private LAN 
from hackers and vandals on the Internet. By default, the ZyXEL device’s stateful inspection 
allows all communications to the Internet that originate from the LAN, and blocks all traffic to 
the LAN that originates from the Internet. In summary, stateful inspection: 

• Allows all sessions originating from the LAN (local network) to the WAN (Internet).
• Denies all sessions originating from the WAN to the LAN.

Figure 54   Stateful Inspection

The previous figure shows the ZyXEL device’s default firewall rules in action as well as 
demonstrates how stateful inspection works. User A can initiate a Telnet session from within 
the LAN and responses to this request are allowed. However other Telnet traffic initiated from 
the WAN is blocked.

In this example, the following sequence of events occurs when a TCP packet leaves the LAN 
network through the Firewall’s WAN interface. The TCP packet is the first in a session, and 
the packet's application layer protocol is configured for a firewall rule inspection:

1 The packet travels from the Firewall’s LAN to the WAN.

2 The packet is evaluated against the interface's existing outbound access list, and the 

packet is permitted (a denied packet would simply be dropped at this point).