# Zone-Based Firewall

> Zone-based firewall configuration on VyOS with security zones (LAN, WAN, DMZ, Local) - inter-zone policies, stateful inspection, and default deny rules

Source: https://opennix.org/en/docs/vyos/examples/firewall-zones/


A zone-based firewall enforces granular security policy between different network segments (zones).

## Scenario

- Enterprise Security: Segmenting LAN, WAN, and DMZ
- Granular Control: Traffic filtering between zones
- Stateful Inspection: Connection tracking

## Zones

```
┌─────────────────────────────────────┐
│  VyOS Firewall                      │
│                                     │
│  ┌────┐  ┌─────┐  ┌──────┐  ┌────┐ │
│  │LAN │  │ DMZ │  │ WAN  │  │LOC │ │
│  └─┬──┘  └──┬──┘  └──┬───┘  └────┘ │
└────┼───────┼────────┼──────────────┘
     │       │        │
   Users  Servers  Internet
```

## VyOS Zone Configuration

```bash
# Define Zones
set firewall zone LAN interface 'eth1'
set firewall zone LAN default-action 'drop'

set firewall zone DMZ interface 'eth2'
set firewall zone DMZ default-action 'drop'

set firewall zone WAN interface 'eth0'
set firewall zone WAN default-action 'drop'

set firewall zone LOCAL local-zone

# Zone Policies (LAN → WAN)
set firewall ipv4-name LAN-TO-WAN default-action 'accept'
set firewall ipv4-name LAN-TO-WAN rule 1 state established 'enable'
set firewall ipv4-name LAN-TO-WAN rule 1 state related 'enable'

set firewall zone LAN from WAN firewall name 'LAN-TO-WAN'

# LAN → DMZ (only HTTP/HTTPS to web servers)
set firewall ipv4-name LAN-TO-DMZ default-action 'drop'
set firewall ipv4-name LAN-TO-DMZ rule 10 action 'accept'
set firewall ipv4-name LAN-TO-DMZ rule 10 protocol 'tcp'
set firewall ipv4-name LAN-TO-DMZ rule 10 destination port '80,443'

set firewall zone LAN from DMZ firewall name 'LAN-TO-DMZ'

# WAN → DMZ (web servers only)
set firewall ipv4-name WAN-TO-DMZ default-action 'drop'
set firewall ipv4-name WAN-TO-DMZ rule 10 action 'accept'
set firewall ipv4-name WAN-TO-DMZ rule 10 protocol 'tcp'
set firewall ipv4-name WAN-TO-DMZ rule 10 destination address '10.20.1.10'
set firewall ipv4-name WAN-TO-DMZ rule 10 destination port '443'

set firewall zone WAN from DMZ firewall name 'WAN-TO-DMZ'

commit
```

## Yandex/VK Cloud Integration

In cloud environments, the DMZ can be a dedicated subnet for public-facing services.

## References

- [VyOS Zone Policy](https://docs.vyos.io/en/latest/configuration/firewall/zone.html)
- [VyOS Zone Example](https://docs.vyos.io/en/latest/configexamples/zone-policy.html)