ZyXEL Communications ZyWall USG 50-H Series, Руководство пользователя

Страница: 294 / 704

Chapter 18 Firewall
ZyWALL USG 50-H User’s Guide
294
Your firewall would have the following configuration.
• The first row allows any LAN1 computer to access the IRC service on the WAN by
logging into the ZyWALL with the CEO’s user name.
• The second row blocks LAN access to the IRC service on the WAN.
• The third row is (still) the firewall’s default policy of allowing all traffic from LAN1 to go
to the WAN.
The rule for the CEO must come before the rule that blocks all LAN1 to WAN IRC traffic. If
the rule that blocks all LAN1 to WAN IRC traffic came first, the CEO’s IRC traffic would
match that rule and the ZyWALL would drop it and not check any other firewall rules.
18.1.4 Firewall Rule Configuration Example
The following Internet firewall rule example allows a hypothetical MyService from the WAN
to IP addresses 192.168.1.10 through 192.168.1.15 (Dest_1) on LAN1.
1 Click Firewall . Click the Add icon ( ) in the heading row to configure a new first
entry (as in this example) or the Add icon ( ) in an entry to add a rule below the
selected entry. Remember the sequence (priority) of the rules is important since they are
applied in order.
Figure 224 Firewall Example: Select the Traveling Direction of Traffic
2 Select From WAN and To LAN1 . Select Create Object in the Destination drop-down
list box.
Table 110 Limited LAN to WAN IRC Traffic Example 2
# USER SOURCE DESTINATION SCHEDULE SERVICE ACTION
1 CEO Any Any Any IRC Allow
2 Any Any Any Any IRC Deny
Default Any Any Any Any Any Allow