ZyXEL Communications USG 2000 User Manual
Chapter 24 Firewall
ZyWALL USG 2000 User’s Guide
427
the firewall rule to always be in effect. The following figure shows the results of
this rule.
this rule.
Figure 314 Blocking All LAN to WAN IRC Traffic Example
Your firewall would have the following rules.
• The first row blocks LAN access to the IRC service on the WAN.
• The second row is the firewall’s default policy that allows all LAN to WAN traffic.
• The second row is the firewall’s default policy that allows all LAN to WAN traffic.
The ZyWALL applies the firewall rules in order. So for this example, when the
ZyWALL receives traffic from the LAN, it checks it against the first rule. If the
traffic matches (if it is IRC traffic) the firewall takes the action in the rule (drop)
and stops checking the firewall rules. Any traffic that does not match the first
firewall rule will match the second rule and the ZyWALL forwards it.
ZyWALL receives traffic from the LAN, it checks it against the first rule. If the
traffic matches (if it is IRC traffic) the firewall takes the action in the rule (drop)
and stops checking the firewall rules. Any traffic that does not match the first
firewall rule will match the second rule and the ZyWALL forwards it.
Now suppose that your company wants to let the CEO use IRC. You can configure
a LAN to WAN firewall rule that allows IRC traffic from the IP address of the CEO’s
computer. You can also configure a LAN to WAN rule that allows IRC traffic from
any computer through which the CEO logs into the ZyWALL with his/her user
name. In order to make sure that the CEO’s computer always uses the same IP
address, make sure it either:
a LAN to WAN firewall rule that allows IRC traffic from the IP address of the CEO’s
computer. You can also configure a LAN to WAN rule that allows IRC traffic from
any computer through which the CEO logs into the ZyWALL with his/her user
name. In order to make sure that the CEO’s computer always uses the same IP
address, make sure it either:
• Has a static IP address,
or
• You configure a static DHCP entry for it so the ZyWALL always assigns it the
same IP address (see
for information on DHCP).
Table 109 Blocking All LAN to WAN IRC Traffic Example
#
USER
SOURCE
DESTINATION
SCHEDULE SERVICE
ACTION
1
Any
Any
Any
Any
IRC
Deny
2
Any
Any
Any
Any
Any
Allow