Intermediate · Zone-based firewall on VyOS · section 3 of 6

Return traffic

✓ Lab-tested 18 October 2026 on VyOS 2026.10.16-0024-rolling

The policy above has a deliberate gap: WAN-TO-LAN has no rule for replies. It only allows the port forward.

Test from the LAN: lanhost tries to fetch a page from the internet server, and times out. LAN → WAN is ALLOW-ALL, so the request leaves. But the reply travels WAN → LAN, a different direction with a different ruleset, and WAN-TO-LAN drops it. Its default-action counter shows the dropped replies piling up.

This is the most common zone-firewall mistake. Every zone pair is evaluated separately in each direction, so allowing traffic one way says nothing about the replies. Every ruleset that faces a zone your users connect to needs an established, related accept rule. That's why RETURN-ONLY, WAN-TO-DMZ and TO-ROUTER all start with one.

Add it to WAN-TO-LAN, and the LAN works.

The LAN can't reach the internet (real output)

root@lanhost:~# curl -sS -m 5 http://192.0.2.10/
curl: (28) Connection timed out after 5006 milliseconds
vyos@R1:~$ show firewall zone-policy
Zone    Members    From Zone    Firewall IPv4    Firewall IPv6
------  ---------  -----------  ---------------  ---------------
DMZ     eth2       LAN          ALLOW-ALL
                   LOCAL        ALLOW-ALL
                   WAN          WAN-TO-DMZ
LAN     eth1       DMZ          RETURN-ONLY
                   LOCAL        ALLOW-ALL
                   WAN          WAN-TO-LAN
LOCAL   LOCAL      DMZ          TO-ROUTER
                   LAN          ALLOW-ALL
                   WAN          TO-ROUTER
WAN     eth0       DMZ          ALLOW-ALL
                   LAN          ALLOW-ALL
                   LOCAL        ALLOW-ALL
vyos@R1:~$ show firewall ipv4 name WAN-TO-LAN
Ruleset Information

---------------------------------
ipv4 Firewall "name WAN-TO-LAN"

Rule     Action    Protocol      Packets    Bytes  Conditions
-------  --------  ----------  ---------  -------  ----------------------------------------
20       accept    tcp                 0        0  ip daddr 10.0.0.10 tcp dport 80  accept
default  drop      all                 8      480  comment "NAM-WAN-TO-LAN default-action "

Line 2: The request leaves; the reply never arrives.
Lines 6–17: The matrix: one ruleset per direction.
Line 11: Replies from WAN to LAN go through WAN-TO-LAN…
Line 27: …and its default drop.

The missing rule

set firewall ipv4 name WAN-TO-LAN rule 10 action 'accept'
set firewall ipv4 name WAN-TO-LAN rule 10 state 'established'
set firewall ipv4 name WAN-TO-LAN rule 10 state 'related'

Lines 1–3: Accept replies, as every inward-facing ruleset should.

Check your understanding

LAN → WAN is ALLOW-ALL, but LAN users can't load websites. What's missing?

An established/related rule in WAN-TO-LAN, for the replies
A NAT rule
An ALLOW-ALL rule from LAN to LOCAL
A larger MTU