ZyXEL Communications 200 Series User Manual

Chapter 19 Firewall

ZyWALL USG 100/200 Series User’s Guide

After you create a VPN tunnel and add it to a zone, you can set the firewall rules applied to 
VPN traffic. If you add a VPN tunnel to an existing zone (the LAN1 zone for example), you 
can configure a new LAN to LAN firewall rule or use intra-zone traffic blocking to allow or 
block VPN traffic transmitting between the VPN tunnel and other interfaces in the LAN zone. 
If you add the VPN tunnel to a new zone (the VPN zone for example), you can configure rules 
for VPN traffic between the VPN zone and other zones or From VPN To-ZyWALL rules for 
VPN traffic destined for the ZyWALL.

• See 

 for related information on the Firewall screens.

• See 

 for an example of creating firewall rules as part of 

configuring user-aware access control (

• See 

 for an example of creating a firewall rule to allow H.323 

traffic from the WAN to LAN1. 

Suppose that your company decides to block all of the LAN users from using IRC (Internet 
Relay Chat) through the Internet. To do this, you would configure a LAN1 to WAN firewall 
rule that blocks IRC traffic from any source IP address from going to any destination address. 
You do not need to specify a schedule since you need the firewall rule to always be in effect. 
The following figure shows the results of this rule.

Figure 238   Blocking All LAN to WAN IRC Traffic Example 

Your firewall would have the following configuration. 

• The first row blocks LAN1 access to the IRC service on the WAN. 

Table 110   Blocking All LAN1 to WAN IRC Traffic Example 

1

Any

Any

Any

Any

IRC

Deny

Default

Any

Any

Any

Any

Any

Allow