ZyXEL Communications ZyWALL 110 Series, Руководство пользователя, Страница: 278 / 562

Chapter 19 Firewall
ZyWALL 110/310/1100 Series User’s Guide
278
19.5 Firewall Rule Example Applications
Suppose you decide to block LAN users from using IRC (Internet Relay Chat) through the Internet.
To do this, you would configure a LAN to WAN firewall rule that blocks IRC traffic from any source IP
address from going to any destination address. You do not need to specify a schedule since you
need the firewall rule to always be in effect. The following figure shows the results of this rule.
Figure 172
Blocking All LAN to WAN IRC Traffic Example
Your firewall would have the following rules.
• The first row blocks LAN access to the IRC service on the WAN.
• The second row is the firewall’s default policy that allows all LAN1 to WAN traffic.
The ZyWALL applies the firewall rules in order. So for this example, when the ZyWALL receives
traffic from the LAN, it checks it against the first rule. If the traffic matches (if it is IRC traffic) the
firewall takes the action in the rule (drop) and stops checking the firewall rules. Any traffic that
does not match the first firewall rule will match the second rule and the ZyWALL forwards it.
Now suppose you need to let the CEO use IRC. You configure a LAN1 to WAN firewall rule that
allows IRC traffic from the IP address of the CEO’s computer. You can also configure a LAN to WAN
rule that allows IRC traffic from any computer through which the CEO logs into the ZyWALL with
his/her user name. In order to make sure that the CEO’s computer always uses the same IP
address, make sure it either:
• Has a static IP address,
or
• You configure a static DHCP entry for it so the ZyWALL always assigns it the same IP address
(see DHCP Settings on page 173 for information on DHCP).
Table 102
Blocking All LAN to WAN IRC Traffic Example
# USER SOURCE DESTINATION SCHEDULE SERVICE ACTION
1 Any Any Any Any IRC Deny
2 Any Any Any Any Any Allow