TTR Networks

Intermediate · Zone-based firewall on VyOS · section 1 of 6

Zones instead of one filter

✓ Lab-tested 18 October 2026 on VyOS 2026.10.16-0024-rolling

Rebuild the NAT lesson's router with a zone-based firewall: WAN, LAN, a DMZ and the router itself, with one ruleset per direction. Includes the missing-return-traffic mistake, post-NAT matching, and a full test matrix.

By the end you will be able to:

  • Explain zones, zone pairs and the local zone
  • Write named rulesets and attach them per direction
  • Explain why every direction needs its own return-traffic rule
  • Match port-forwarded traffic after destination NAT
  • Test a zone policy as a matrix

Prerequisites: Setting up VyOS with NAT

The NAT lesson protected its router with one forward filter: a single list of rules for all traffic passing through, matched by inbound and outbound interface. That works for three interfaces. With more, or with several people maintaining the rules, it turns into a long list where every rule has to remember which interfaces it's about.

A zone-based firewall organises the same policy differently:

  • Put each interface into a zone: WAN, LAN, DMZ and so on. The router itself is a special zone, LOCAL.
  • For each pair of zones, in each direction, attach one named ruleset: "from WAN to DMZ, use WAN-TO-DMZ".
  • Traffic between zones with no ruleset is dropped (each zone's default action). Traffic within a zone isn't filtered.

You can read the whole policy as a matrix, and adding an interface means adding it to a zone, not editing every rule.

This lesson rebuilds the NAT lesson's router with zones. eth0 is WAN, eth1 the private LAN (10.0.0.0/24, source-NATed, with a port forward to lanhost), and eth2, the routed public subnet, becomes a DMZ for public servers. The NAT configuration is unchanged. Every output comes from the NAT lesson's lab.

From \ ToWANLANDMZLOCAL (the router)
WANreplies, plus the port forwardreplies, web, ICMPreplies, ICMP
LANeverythingeverythingeverything
DMZeverythingreplies onlyreplies, ICMP
LOCALeverythingeverythingeverything

The rule that makes a DMZ a DMZ: DMZ → LAN is replies only. If a public server is compromised, it can't open connections into the private network.

Diagram: Four zones — WAN, LAN, DMZ and the router itself. Step through the policy.
  1. LAN goes anywhere. LAN → WAN and LAN → DMZ use ALLOW-ALL.
  2. Replies need their own rule. The reply from WAN to LAN is judged by WAN-TO-LAN. Without an established rule there, it's dropped.
  3. WAN to the DMZ: web only. The internet can reach the public web servers, nothing else.
  4. DMZ to LAN: replies only. A compromised public server can't open connections into the private network.

Check your understanding

Traffic from a host in the LAN to another host in the same LAN. Which ruleset applies?

  • None: traffic within a zone isn't filtered
  • LAN to LAN
  • LOCAL
  • The zone's default action