ZyXEL Communications 200 Series - Manual (Page 339)

Chapter 19 Firewall
ZyWALL USG 100/200 Series User’s Guide
339
• The second row is the firewall’s default policy that allows all traffic from the LAN to go to
the WAN.
The ZyWALL applies the firewall rules in order. So for this example, when the ZyWALL
receives traffic from LAN1, it checks it against the first rule. If the traffic matches (if it is IRC
traffic) the firewall takes the action in the rule (drop) and stops checking the firewall rules.
Any traffic that does not match the first firewall rule will match the default rule and the
ZyWALL forwards it.
Now suppose that your company wants to let the CEO use IRC. You can configure a LAN1 to
WAN firewall rule that allows IRC traffic from the IP address of the CEO’s computer. You
can also configure a LAN1 to WAN rule that allows IRC traffic from any computer through
which the CEO logs into the ZyWALL with his/her user name. In order to make sure that the
CEO’s computer always uses the same IP address, make sure it either:
• Has a static IP address,
or
• You configure a static DHCP entry for it so the ZyWALL always assigns it the same IP
address (see DHCP Settings on page 266 for information on DHCP).
Now you configure a LAN1 to WAN firewall rule that allows IRC traffic from the IP address
of the CEO’s computer (192.168.1.7 for example) to go to any destination address. You do not
need to specify a schedule since you want the firewall rule to always be in effect. The
following figure shows the results of your two custom rules.
Figure 239 Limited LAN to WAN IRC Traffic Example
Your firewall would have the following configuration.
• The first row allows the LAN1 computer at IP address 192.168.1.7 to access the IRC
service on the WAN.
• The second row blocks LAN access to the IRC service on the WAN.
Table 111 Limited LAN to WAN IRC Traffic Example 1
# USER SOURCE DESTINATION SCHEDULE SERVICE ACTION
1 Any 192.168.1.7 Any Any IRC Allow
2 Any Any Any Any IRC Deny
Default Any Any Any Any Any Allow