Chapter 18 Firewall
NXC5200 User’s Guide
253
The NXC applies the firewall rules in order. So for this example, when the NXC
receives traffic from the LAN, it checks it against the first rule. If the traffic
matches (if it is IRC traffic) the firewall takes the action in the rule (drop) and
stops checking the firewall rules. Any traffic that does not match the first firewall
rule will match the second rule and the NXC forwards it.
Now suppose that your company wants to let the CEO use IRC. You can configure
a LAN to WAN firewall rule that allows IRC traffic from the IP address of the CEO’s
computer. You can also configure a LAN to WAN rule that allows IRC traffic from
any computer through which the CEO logs into the NXC with his/her user name. In
order to make sure that the CEO’s computer always uses the same IP address,
make sure it either:
• Has a static IP address,
or
• You configure a static DHCP entry for it so the NXC always assigns it the same IP
address.
Now you configure a LAN to WAN firewall rule that allows IRC traffic from the IP
address of the CEO’s computer (192.168.1.7 for example) to go to any destination
address. You do not need to specify a schedule since you want the firewall rule to
always be in effect. The following figure shows the results of your two custom
rules.
Figure 112
Limited LAN to WAN IRC Traffic Example
Your firewall would have the following configuration.
Table 90
Limited LAN to WAN IRC Traffic Example 1
#
USER
SOURCE
DESTINATION
SCHEDULE SERVICE
ACTION
1
Any
192.168.1.7 Any
Any
IRC
Allow
2
Any
Any
Any
Any
IRC
Deny
3
Any
Any
Any
Any
Any
Allow