Watchguard Firebox X15, User Manual

Page: 130 / 266

Configuring Firewall Settings
116 WatchGuard Firebox X Edge
Filtering incoming traffic for services
To limit the computers that can send incoming traffic from the
external network using the service, see “Filtering incoming traffic
for services” on page 110.
Filtering outgoing traffic for services
To limit what computers can send traffic from the internal network
using the service, and what computers on the external network can
receive that traffic, see “Filtering outgoing traffic for services” on
page 110.
Services for the Optional Network
By default, the Firebox® X Edge allows all traffic that starts in the
trusted network and tries to go to the optional network, and denies
all traffic that starts in the optional network and tries to go to the
trusted network.
Here are some examples of how you can use the optional network:
• You can use the optional network for servers that the external
network can get to. This helps to protect the trusted network,
because no traffic is allowed to the trusted network from the
optional network when the Firebox is in default configuration.
When computers are accessible from the external network, they
are more vulnerable to attack. If your public Web or FTP server
on the optional network is hacked or compromised, the attacker
cannot get to your trusted network.
• You can use the optional network to secure a wireless network.
Wireless networks are usually less secure than wired networks. If
you have a Wireless Access Point you can increase the security of
your trusted network by keeping the Wireless Access Point on
the optional network.
• You can use the optional network to have a different network IP
address range that is allowed to communicate with the trusted
network. See the section “Disabling Traffic Filters,” below.