Checklist and troubleshooting

Checklist

• Every interface in a zone; the router itself as the local zone.
• A ruleset for every zone pair that needs traffic, in each direction; everything else falls to the default drop.
• established, related accepted in every ruleset facing a zone that users connect to.
• DMZ → LAN: replies only.
• Port-forward rules written against the inside (post-NAT) address and port.
• IPv6 rulesets alongside IPv4.
• Test every important cell of the matrix from a host in each zone, and watch the counters.

When it doesn't work

Symptom	Look at	Usual cause
Outbound connections time out	The reverse direction's ruleset counters	No established/related rule for replies
Port forward doesn't work	Which address the rule matches	Rule written for the public address; zones see the post-DNAT address
Can't reach the router from one zone	X → LOCAL ruleset	Router addresses are the LOCAL zone, not the interface's zone
Commit fails with "has no interfaces"	The zone's member lines	A zone without members (often old interface syntax)
One interface completely isolated	show firewall zone-policy	Interface not in any zone