Vyatta Network OS Documentation

Learn how to install, configure and operate the Vyatta NOS, which helps drive our virtual networking & physical platforms portfolio.

Filtering traffic between zones

The following example shows how to filter traffic between zones by attaching rule sets to zone.

Table 1. Creating the zone policies
Step Command

Create a zone named private and attach interfaces to it.

vyatta@R1# set security zone-policy zone private description PRIVATE

vyatta@R1# set security zone-policy zone private interface dp0p1p1

vyatta@R1# set security zone-policy zone private interface dp0p1p2

Create a zone named dmz and attach an interface to it.

vyatta@R1# set security zone-policy zone dmz description DMZ

vyatta@R1# set security zone-policy zone dmz interface dp0p1p3

Create a zone named public and attach an interface to it.

vyatta@R1# set security zone-policy zone public description PUBLIC

vyatta@R1# set security zone-policy zone public interface dp0p1p4

Create rule sets named to_private , to_dmz , and to_public .

vyatta@R1# set security firewall name to_private rule 1 action accept

vyatta@R1# set security firewall name to_dmz rule 1 action accept

vyatta@R1# set security firewall name to_public rule 1 action accept

Attach the rule sets to each zone.

vyatta@R1# set security zone-policy zone private to dmz firewall to_dmz

vyatta@R1# set security zone-policy zone private to public firewall to_public

vyatta@R1# set security zone-policy zone dmz to private firewall to_private

vyatta@R1# set security zone-policy zone dmz to public firewall to_public

vyatta@R1# set security zone-policy zone public to dmz firewall to_dmz

vyatta@R1# set security zone-policy zone public to private firewall to_private

Commit the changes.

vyatta@R1# commit
Note: Before committing changes to a zone, firewall requires that you should have an interface and a rule set attached to the zone.

The following example shows how to view the configuration.

vyatta@R1# show security zone-policy

zone dmz {
     description DMZ
     interface dp0p1p3
     to private {
         firewall to_private
     }
     to public {
         firewall to_public
     }
}
zone private {
     description PRIVATE
     interface dp0p1p1
     interface dp0p1p2
     to dmz {
         firewall to_dmz
     }
     to public {
         firewall to_public
     }
}
zone public {
     description PUBLIC
     interface dp0p1p4
     to dmz{
         firewall to_dmz
     }
     to private {
         firewall to_private
     }
}