Testing the matrix
Test every cell of the matrix that matters, from a host in each zone:
- LAN reaches the internet and the DMZ.
- DMZ reaches the internet (servers need updates), but not the LAN. The connection to lanhost times out, which is exactly the DMZ rule.
- DMZ → router: pubhost pings 10.0.0.1, the router's LAN address, and gets an answer. That address belongs to the router, so the traffic is judged by DMZ → LOCAL (TO-ROUTER, which allows ICMP), not DMZ → LAN. Addresses on the router are always the LOCAL zone, whichever interface they're on.
- WAN reaches the DMZ's web server, but not its database port (5432 times out). It reaches lanhost only through the port forward. It can't open SSH to the router: the connection times out, so the firewall dropped it rather than SSH refusing it.
The per-ruleset counters confirm it: the established rules carry most of the traffic, each allow rule shows its hits, and the WAN-TO-DMZ default drop counted the database attempts.
IPv6
Every zone takes an IPv6 ruleset as well (from X firewall ipv6-name …). IPv6 has no NAT to hide the LAN, so without IPv6 rulesets the LAN is open to anything the WAN can route. Write both from the start (see the IPv6 on VyOS lesson for why ICMPv6 must be allowed).
root@lanhost:~# curl -sS -m 5 http://192.0.2.10/
hello from server
root@lanhost:~# curl -sS -m 5 http://198.51.100.2/
hello from pubhost
root@pubhost:~# curl -sS -m 5 http://192.0.2.10/
hello from server
root@pubhost:~# curl -sS -m 5 http://10.0.0.10/
curl: (28) Connection timed out after 5005 milliseconds
root@pubhost:~# ping -c 1 -W 2 10.0.0.1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=6.03 ms
--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 6.027/6.027/6.027/0.000 ms
root@server:~# curl -sS -m 5 http://198.51.100.2/
hello from pubhost
root@server:~# nc -zv -w 3 198.51.100.2 5432
nc: connect to 198.51.100.2 port 5432 (tcp) timed out: Operation now in progress
root@server:~# curl -sS -m 5 http://203.0.113.2:8080/
hello from lanhost
root@server:~# nc -zv -w 3 203.0.113.2 22
nc: connect to 203.0.113.2 port 22 (tcp) timed out: Operation now in progress- Lines 1–4: LAN → WAN and LAN → DMZ.
- Line 5: DMZ → WAN.
- Lines 7–8: DMZ → LAN: blocked.
- Lines 9–11: DMZ → the router's LAN address: LOCAL zone, ICMP allowed.
- Line 16: WAN → DMZ web.
- Lines 18–19: WAN → DMZ database: blocked.
- Lines 20–21: WAN → LAN via the port forward.
- Lines 22–23: WAN → router SSH: dropped.
vyos@R1:~$ show firewall ipv4 name WAN-TO-LAN
Ruleset Information
---------------------------------
ipv4 Firewall "name WAN-TO-LAN"
Rule Action Protocol Packets Bytes Conditions
------- -------- ---------- --------- ------- -----------------------------------------
10 accept all 10 819 ct state { established, related } accept
20 accept tcp 1 60 ip daddr 10.0.0.10 tcp dport 80 accept
default drop all 0 0 comment "NAM-WAN-TO-LAN default-action "
vyos@R1:~$ show firewall ipv4 name WAN-TO-DMZ
Ruleset Information
---------------------------------
ipv4 Firewall "name WAN-TO-DMZ"
Rule Action Protocol Packets Bytes Conditions
------- -------- ---------- --------- ------- -----------------------------------------
10 accept all 9 755 ct state { established, related } accept
20 accept tcp 1 60 tcp dport { 80, 443 } accept
30 accept icmp 0 0 meta l4proto icmp accept
default drop all 3 180 comment "NAM-WAN-TO-DMZ default-action "- Line 9: Replies: most of the traffic.
- Line 10: The port forward.
- Line 22: Web to the DMZ.
- Line 24: Everything else, including the database attempts.
Check your understanding
A DMZ server pings the router's LAN-side address and gets a reply, although DMZ → LAN is replies only. Why?
- The router's own addresses are in the LOCAL zone, so DMZ → LOCAL applies
- ICMP is never filtered
- The ping is a reply
- Zones don't apply to ICMP