WaveData
18
Although the forwarding policy is reject by default, packet is forwarded if
match a Forwarding Traffic Rule or Port Forwarding rule. Figure show how
IPSec is enabled to traverse from WAN to LAN.
Packet is forwarded if match an active connection (packet belong to a valid
Connection with ESTABLISHED or RELATED states on Connection tracking).
Most of the WAN to LAN traffic belongs to this category.
Inter-zone forwarding: Packet is forwarded if is enabled to traverse between
zones. Most of the Traffic from WAN to LAN do not need enable inter-zone
forwarding since is related with an active connection but LAN packets to
WAN destination need to be enabled to forward since connections are
started from LAN.
LAN Zone
LAN zone covers all traffic from and to local interfaces.
When router receives a packet from LAN, default policy is accept input and
output traffic to CPU. Local host have access to router services like web or
SSH without any restrictions.
Default policy to Forward traffic is reject traffic from unknown zones. Use
Inter-Zone Forwarding to enable forwarding to/from another zones or add
custom Traffic Rules.
Normally packet comes from a network covered by a zone, but if router receives
a packet from interface what is not covered by a firewall zone, applies default
policies.
By default Firewall defines two zones
LAN zone
: Default policy is accept all traffic to CPU (Input and Output) and
reject Forward.
WAN zone
: Default policy is accept only Output. Input and Forward are
rejected. WAN zone also enable Masquerading (NAT) and MSS Clamping.
This policy rejects all input and forwarding traffic but some exceptions are
added like Port Forwarding and Traffic Rules (open Web or SSH ports by
example).
WAN Zone
WAN zone covers WAN and WAN6 network interfaces.
Default policy for WAN is reject input traffic (to avoid hack router services)
and accept all output from CPU to WAN.
Forwarding to unknown zones is rejected but you can use Inter-Zone
Forwarding to enable forwarding to/from another zones.
Although the input policy is reject by default, policy is override by custom
rules. Figure shows some input rules defined for WAN zone that accept
some input protocols like ping or DHCP.
