ZyXEL Communications ZyWall USG 50-H Series, User Manual

Page: 292 / 704

Chapter 18 Firewall
ZyWALL USG 50-H User’s Guide
292
Finding Out More
• See Section 5.4.11 on page 86 for related information on the Firewall screens.
• See Section 6.6.6 on page 119 for an example of creating firewall rules as part of
configuring user-aware access control ( Section 6.6 on page 114 ).
• See Section 6.9.3 on page 126 for an example of creating a firewall rule to allow H.323
traffic from the WAN to LAN1.
18.1.3 Firewall Rule Example Applications
Suppose that your company decides to block all of the LAN users from using IRC (Internet
Relay Chat) through the Internet. To do this, you would configure a LAN1 to WAN firewall
rule that blocks IRC traffic from any source IP address from going to any destination address.
You do not need to specify a schedule since you need the firewall rule to always be in effect.
The following figure shows the results of this rule.
Figure 222 Blocking All LAN to WAN IRC Traffic Example
Your firewall would have the following configuration.
• The first row blocks LAN1 access to the IRC service on the WAN.
• The second row is the firewall’s default policy that allows all traffic from the LAN to go to
the WAN.
The ZyWALL applies the firewall rules in order. So for this example, when the ZyWALL
receives traffic from LAN1, it checks it against the first rule. If the traffic matches (if it is IRC
traffic) the firewall takes the action in the rule (drop) and stops checking the firewall rules.
Any traffic that does not match the first firewall rule will match the default rule and the
ZyWALL forwards it.
Table 108 Blocking All LAN1 to WAN IRC Traffic Example
# USER SOURCE DESTINATION SCHEDULE SERVICE ACTION
1 Any Any Any Any IRC Deny
Default Any Any Any Any Any Allow