ZyXEL Communications Prestige 662HW Series, User Manual

Page: 129 / 458

Prestige 662HW Series User’s Guide
Firewall Configuration 12-1
Chapter 12
Firewall Configuration
This chapter shows you how to enable and configure the Prestige firewall.
12.1 Access Methods
The web configurator is, by far, the most comprehensive firewall configuration tool your Prestige has
to offer. For this reason, it is recommended that you configure your firewall using the web
configurator. SMT screens allow you to activate the firewall. CLI commands provide limited
configuration options and are only recommended for advanced users.
12.2 Firewall Policies Overview
Firewall rules are grouped based on the direction of travel of packets to which they apply:
•
LAN to LAN/Router
•
WAN to LAN
•
LAN to WAN
•
WAN to WAN/Router
By default, the Prestige’s stateful packet inspection allows packets traveling in the following
directions:
•
LAN to LAN/Router
This allows computers on the LAN to manage the Prestige and communicate between
networks or subnets connected to the LAN interface.
•
LAN to WAN
By default, the Prestige’s stateful packet inspection blocks packets traveling in the following
directions:
•
WAN to LAN
•
WAN to WAN/Router
This prevents computers on the WAN from using the Prestige as a gateway to communicate
with other computers on the WAN and/or managing the Prestige.
You may define additional rules and sets or modify existing ones but please exercise extreme caution
in doing so.
If you configure firewall rules without a good understanding of
how they work, you might inadvertently introduce security risks to
the firewall and to the protected network. Make sure you test your
rules after you configure them.
For example, you may create rules to:
♦
Block certain types of traffic, such as IRC (Internet Relay Chat), from the LAN to the Internet.
♦
Allow certain types of traffic, such as Lotus Notes database synchronization, from specific hosts
on the Internet to specific hosts on the LAN.