ZyXEL Communications P-3202HN-Ba, User Manual

Page: 155 / 250

Chapter 12 Firewalls
IAD User’s Guide
155
4
Does this rule conflict with any existing rules?
Once these questions have been answered, adding rules is simply a matter of
entering the information into the correct fields in the web configurator screens.
12.5.3 Triangle Route
When the firewall is on, your IAD acts as a secure gateway between your LAN and
the Internet. In an ideal network topology, all incoming and outgoing network
traffic passes through the IAD to protect your LAN against attacks.
Figure 71 Ideal Firewall Setup
12.5.3.1 The “Triangle Route” Problem
A traffic route is a path for sending or receiving data packets between two
Ethernet devices. You may have more than one connection to the Internet
(through one or more ISPs). If an alternate gateway is on the LAN (and its IP
address is in the same subnet as the IAD’s LAN IP address), the “triangle route”
(also called asymmetrical route) problem may occur. The steps below describe the
“triangle route” problem.
1
A computer on the LAN initiates a connection by sending out a SYN packet to a
receiving server on the WAN.
2
The IAD reroutes the SYN packet through Gateway A on the LAN to the WAN.
3
The reply from the WAN goes directly to the computer on the LAN without going
through the IAD.
1
2
WAN
LAN