Filter
Top Products
Firewall > Access Rules
604
SonicOS 5.8.1 Administrator Guide
Stateful Packet Inspection Default Access Rules Overview
By default, the SonicWALL security appliance’s stateful packet inspection allows all
communication from the LAN to the Internet, and blocks all traffic to the LAN from the Internet.
The following behaviors are defined by the “Default” stateful inspection packet access rule
enabled in the SonicWALL security appliance:
• Allow all sessions originating from the LAN, WLAN to the WAN, or DMZ (except when the
destination WAN IP address is the WAN interface of the SonicWALL appliance itself)
• Allow all sessions originating from the DMZ to the WAN.
• Deny all sessions originating from the WAN to the DMZ.
• Deny all sessions originating from the WAN and DMZ to the LAN or WLAN.
Additional network access rules can be defined to extend or override the default access rules.
For example, access rules can be created that allow access from the LAN zone to the WAN
Primary IP address, or block certain types of traffic such as IRC from the LAN to the WAN, or
allow certain types of traffic, such as Lotus Notes database synchronization, from specific hosts
on the Internet to specific hosts on the LAN, or restrict use of certain protocols such as Telnet
to authorized users on the LAN.
Custom access rules evaluate network traffic source IP addresses, destination IP addresses,
IP protocol types, and compare the information to access rules created on the SonicWALL
security appliance. Network access rules take precedence, and can override the SonicWALL
security appliance’s stateful packet inspection. For example, an access rule that blocks IRC
traffic takes precedence over the SonicWALL security appliance default setting of allowing this
type of traffic.
Caution The ability to define network access rules is a very powerful tool. Using custom access rules
can disable firewall protection or block all access to the Internet. Use caution when creating
or deleting network access rules.