ZyXEL Communications 2 Plus User Manual

 Chapter 11 Firewall

ZyWALL 2 Plus User’s Guide

Now you configure a LAN to WAN firewall rule that allows IRC traffic from the IP address of 
the CEO’s computer (192.168.1.7 for example) to go to any destination address. You do not 
need to specify a schedule since you want the firewall rule to always be in effect. The 
following figure shows the results of your two custom rules.

Figure 133   Limited LAN to WAN IRC Traffic Example

Your firewall would have the following configuration.  

• The first row allows the LAN computer at IP address 192.168.1.7 to access the IRC 

service on the WAN. 

• The second row blocks LAN access to the IRC service on the WAN.  
• The third row is (still) the firewall’s default policy of allowing all traffic from the LAN to 

go to the WAN.

The rule for the CEO must come before the rule that blocks all LAN to WAN IRC traffic. If 
the rule that blocks all LAN to WAN IRC traffic came first, the CEO’s IRC traffic would 
match that rule and the ZyWALL would drop it and not check any other firewall rules.

If an alternate gateway on the LAN has an IP address in the same subnet as the ZyWALL’s 
LAN IP address, return traffic may not go through the ZyWALL. This is called an 
asymmetrical or “triangle” route. This causes the ZyWALL to reset the connection, as the 
connection has not been acknowledged.
You can have the ZyWALL permit the use of asymmetrical route topology on the network 
(not reset the connection).

Table 47   Limited LAN to WAN IRC Traffic Example

1

192.168.1.7

Any

Any

IRC

Allow

2

Any

Any

Any

IRC

Drop

Default

Any

Any

Any

Any

Allow