ZyXEL Communications 1000 Manuel D’Utilisation
Chapter 24 Firewall
ZyWALL USG 1000 User’s Guide
425
• The ZyWALL drops most packets from the DMZ zone to the ZyWALL itself,
except for DNS and NetBIOS traffic, and generates a log.
When you configure a firewall rule for packets destined for the ZyWALL itself,
make sure it does not conflict with your service control rule. See
make sure it does not conflict with your service control rule. See
for more information about service control (remote management). The
ZyWALL checks the firewall rules before the service control rules for traffic
destined for the ZyWALL.
destined for the ZyWALL.
You can configure a To-ZyWALL firewall rule (with From Any To ZyWALL
direction) for traffic from an interface which is not in a zone.
direction) for traffic from an interface which is not in a zone.
Global Firewall Rules
Firewall rules with from any and/or to any as the packet direction are called
global firewall rules. The global firewall rules are the only firewall rules that apply
to an interface or VPN tunnel that is not included in a zone. The from any rules
apply to traffic coming from the interface and the to any rules apply to traffic
going to the interface.
global firewall rules. The global firewall rules are the only firewall rules that apply
to an interface or VPN tunnel that is not included in a zone. The from any rules
apply to traffic coming from the interface and the to any rules apply to traffic
going to the interface.
Firewall Rule Criteria
The ZyWALL checks the schedule, user name (user’s login name on the ZyWALL),
source IP address, destination IP address and IP protocol type of network traffic
against the firewall rules (in the order you list them). When the traffic matches a
rule, the ZyWALL takes the action specified in the rule.
source IP address, destination IP address and IP protocol type of network traffic
against the firewall rules (in the order you list them). When the traffic matches a
rule, the ZyWALL takes the action specified in the rule.
User Specific Firewall Rules
You can specify users or user groups in firewall rules. For example, to allow a
specific user from any computer to access a zone by logging in to the ZyWALL, you
can set up a rule based on the user name only. If you also apply a schedule to the
firewall rule, the user can only access the network at the scheduled time. A user-
aware firewall rule is activated whenever the user logs in to the ZyWALL and will
be disabled after the user logs out of the ZyWALL.
specific user from any computer to access a zone by logging in to the ZyWALL, you
can set up a rule based on the user name only. If you also apply a schedule to the
firewall rule, the user can only access the network at the scheduled time. A user-
aware firewall rule is activated whenever the user logs in to the ZyWALL and will
be disabled after the user logs out of the ZyWALL.
Firewall and Application Patrol
To use a service, make sure both the firewall and application patrol allow the
service’s packets to go through the ZyWALL. The ZyWALL checks the firewall rules
before the application patrol rules for traffic going through the ZyWALL.
service’s packets to go through the ZyWALL. The ZyWALL checks the firewall rules
before the application patrol rules for traffic going through the ZyWALL.
Firewall and VPN Traffic
After you create a VPN tunnel and add it to a zone, you can set the firewall rules
applied to VPN traffic. If you add a VPN tunnel to an existing zone (the LAN zone
for example), you can configure a new LAN to LAN firewall rule or use intra-zone
applied to VPN traffic. If you add a VPN tunnel to an existing zone (the LAN zone
for example), you can configure a new LAN to LAN firewall rule or use intra-zone