ZyXEL Communications ZyWall USG 50-H Series, Руководство пользователя

Страница: 290 / 704

Chapter 18 Firewall
ZyWALL USG 50-H User’s Guide
290
18.1.2 What You Need to Know About the Firewall
Stateful Inspection
The ZyWALL has a stateful inspection firewall. The ZyWALL restricts access by screening
data packets against defined access rules. It also inspects sessions. For example, traffic from
one zone is not allowed unless it is initiated by a computer in another zone first.
Zones
A zone is a group of interfaces or VPN tunnels. Group the ZyWALL’s interfaces into different
zones based on your needs. You can configure firewall rules for data passing between zones or
even between interfaces and/or VPN tunnels in a zone.
Default Firewall Behavior
Firewall rules are grouped based on the direction of travel of packets to which they apply.
Here are the default firewall behavior for traffic going through the ZyWALL. By default the
ZyWALL forces authentication for WLAN users. Un-authenticated WLAN users can only
access the WAN.
To-ZyWALL Rules
Rules with ZyWALL as the To Zone apply to traffic going to the ZyWALL itself. By default:
Table 107 Default Firewall Rules
FROM ZONE TO ZONE STATEFUL PACKET INSPECTION
From ANY to ANY Traffic that does not match any firewall rule is allowed. This
includes traffic to or from interfaces or VPN tunnels that are not
assigned to any zone (extra-zone traffic).
From WAN to LAN Traffic from the WAN to the LAN is denied.
From WAN to WLAN Traffic from the WAN to the WLAN is denied.
From WAN to ZyWALL
(Default services) Traffic from the WAN to the ZyWALL (default services) is
allowed. Default services are traffic types described in
To-
ZyWALL Rules on page 290 .
From WAN to ZyWALL Traffic from the WAN to the ZyWALL itself is denied except for
the traffic types described in
To-ZyWALL Rules on page 290 .
From DMZ to LAN Traffic from the DMZ to the LAN is denied.
From DMZ to WLAN Traffic from the DMZ to the WLAN is denied.
From DMZ to ZyWALL
(Default services) Traffic from the DMZ to the ZyWALL (default services) is
allowed. Default services are traffic types described in
To-
ZyWALL Rules on page 290 .
From DMZ to ZyWALL Traffic from the DMZ to the ZyWALL itself is denied except for
the traffic types described in
To-ZyWALL Rules on page 290 .
From WLAN to LAN Traffic WLAN to LAN is rejected.
From WLAN to WAN (guest) Traffic from the WLAN to the WAN (guest) is allowed.
From WLAN to WAN (DNS) Traffic from the WLAN to the WAN (DNS) is allowed.
From WLAN to WAN Traffic from WLAN to WAN is rejected.
From WLAN to DMZ Traffic from WLAN to DMZ is rejected.
From WLAN to ZyWALL Traffic from the DMZ to the ZyWALL is denied.