TTR Networks

Intermediate · Zone-based firewall on VyOS · section 2 of 6

Rulesets and zones

✓ Lab-tested 18 October 2026 on VyOS 2026.10.16-0024-rolling

The configuration has two halves.

Named rulesets describe policies, independent of interfaces:

  • ALLOW-ALL: accept everything (for directions you trust).
  • RETURN-ONLY: accept established and related traffic only (replies to connections the other side opened).
  • WAN-TO-DMZ: replies, plus web (TCP 80/443) and ICMP to the public servers.
  • WAN-TO-LAN: the port forward. Zone rules are evaluated after destination NAT, so the rule matches the inside address and port, 10.0.0.10:80, not 203.0.113.2:8080.
  • TO-ROUTER: replies and ICMP, for traffic addressed to the router itself.

Zones bind interfaces to names and attach a ruleset to each from direction. LOCAL is marked local-zone instead of having interfaces.

If you follow an older guide

This VyOS build (rolling 2026.10.16) uses member interface inside a zone. Older guides write zone WAN interface eth0, which this version rejects (is not valid). The commit then fails as a whole, because a zone with no interfaces isn't allowed. Check the syntax against your version's documentation, or use tab completion on the router.

The zone policy (with one gap)
set firewall ipv4 name ALLOW-ALL default-action 'accept'
set firewall ipv4 name RETURN-ONLY default-action 'drop'
set firewall ipv4 name RETURN-ONLY rule 10 action 'accept'
set firewall ipv4 name RETURN-ONLY rule 10 state 'established'
set firewall ipv4 name RETURN-ONLY rule 10 state 'related'
set firewall ipv4 name WAN-TO-DMZ default-action 'drop'
set firewall ipv4 name WAN-TO-DMZ rule 10 action 'accept'
set firewall ipv4 name WAN-TO-DMZ rule 10 state 'established'
set firewall ipv4 name WAN-TO-DMZ rule 10 state 'related'
set firewall ipv4 name WAN-TO-DMZ rule 20 action 'accept'
set firewall ipv4 name WAN-TO-DMZ rule 20 description 'Public web servers'
set firewall ipv4 name WAN-TO-DMZ rule 20 protocol 'tcp'
set firewall ipv4 name WAN-TO-DMZ rule 20 destination port '80,443'
set firewall ipv4 name WAN-TO-DMZ rule 30 action 'accept'
set firewall ipv4 name WAN-TO-DMZ rule 30 protocol 'icmp'
set firewall ipv4 name WAN-TO-LAN default-action 'drop'
set firewall ipv4 name WAN-TO-LAN rule 20 action 'accept'
set firewall ipv4 name WAN-TO-LAN rule 20 description 'Port forward to lanhost web (after DNAT)'
set firewall ipv4 name WAN-TO-LAN rule 20 protocol 'tcp'
set firewall ipv4 name WAN-TO-LAN rule 20 destination address '10.0.0.10'
set firewall ipv4 name WAN-TO-LAN rule 20 destination port '80'
set firewall ipv4 name TO-ROUTER default-action 'drop'
set firewall ipv4 name TO-ROUTER rule 10 action 'accept'
set firewall ipv4 name TO-ROUTER rule 10 state 'established'
set firewall ipv4 name TO-ROUTER rule 10 state 'related'
set firewall ipv4 name TO-ROUTER rule 20 action 'accept'
set firewall ipv4 name TO-ROUTER rule 20 protocol 'icmp'
set firewall zone WAN member interface 'eth0'
set firewall zone WAN default-action 'drop'
set firewall zone WAN from LAN firewall name 'ALLOW-ALL'
set firewall zone WAN from DMZ firewall name 'ALLOW-ALL'
set firewall zone WAN from LOCAL firewall name 'ALLOW-ALL'
set firewall zone LAN member interface 'eth1'
set firewall zone LAN default-action 'drop'
set firewall zone LAN from WAN firewall name 'WAN-TO-LAN'
set firewall zone LAN from DMZ firewall name 'RETURN-ONLY'
set firewall zone LAN from LOCAL firewall name 'ALLOW-ALL'
set firewall zone DMZ member interface 'eth2'
set firewall zone DMZ default-action 'drop'
set firewall zone DMZ from WAN firewall name 'WAN-TO-DMZ'
set firewall zone DMZ from LAN firewall name 'ALLOW-ALL'
set firewall zone DMZ from LOCAL firewall name 'ALLOW-ALL'
set firewall zone LOCAL local-zone
set firewall zone LOCAL default-action 'drop'
set firewall zone LOCAL from LAN firewall name 'ALLOW-ALL'
set firewall zone LOCAL from DMZ firewall name 'TO-ROUTER'
set firewall zone LOCAL from WAN firewall name 'TO-ROUTER'
  • Line 1: Trust everything in this direction.
  • Lines 2–5: Replies only.
  • Lines 6–15: The internet to public servers.
  • Lines 16–21: The gap: only the port forward, no rule for replies.
  • Lines 20–21: The inside address and port: zones see traffic after DNAT.
  • Lines 22–27: To the router itself.
  • Lines 28–32: WAN: what may enter it from each zone.
  • Lines 33–37: LAN.
  • Line 36: DMZ → LAN: replies only.
  • Lines 38–42: DMZ.
  • Lines 43–47: The router itself.
If you follow an older guide (real output)
vyos@R1# set firewall zone WAN interface 'eth0'

  Configuration path: firewall zone WAN [interface] is not valid
  Set failed

[edit]
vyos@R1# commit
[ firewall ]
Zone "DMZ" has no interfaces and is not the local zone

[[firewall]] failed
Commit failed
  • Lines 1–4: Old syntax, rejected by this build.
  • Lines 8–11: …so the zone has no members, and the whole commit fails.