diff options
| author | Ganawa Juanah <ganawa@juanah.com> | 2021-06-29 19:12:13 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-06-29 19:12:13 -0500 |
| commit | a8f2f59e337e39c8aa7b2f781dd3734f2c3a1e3d (patch) | |
| tree | 1691399ce3467e84d6b5e4aee3c9405fa9efc5a8 /docs/configexamples/zone-policy.rst | |
| parent | b693706c66470d6b8b89f6d2c42c8f153a360673 (diff) | |
| parent | f0c1ad02e79a2fe6b9afa637b0625c446a5ec448 (diff) | |
| download | vyos-documentation-a8f2f59e337e39c8aa7b2f781dd3734f2c3a1e3d.tar.gz vyos-documentation-a8f2f59e337e39c8aa7b2f781dd3734f2c3a1e3d.zip | |
Merge branch 'vyos:master' into master
Diffstat (limited to 'docs/configexamples/zone-policy.rst')
| -rw-r--r-- | docs/configexamples/zone-policy.rst | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/docs/configexamples/zone-policy.rst b/docs/configexamples/zone-policy.rst index bfe77c2e..cf11a01e 100644 --- a/docs/configexamples/zone-policy.rst +++ b/docs/configexamples/zone-policy.rst @@ -1,3 +1,5 @@ +:lastproofread: 2021-06-29 + .. _examples-zone-policy: Zone-Policy example @@ -132,7 +134,7 @@ To add logging to the default rule, do: set firewall name <ruleSet> enable-default-log -By default, iptables does not allow traffic for established session to +By default, iptables does not allow traffic for established sessions to return, so you must explicitly allow this. I do this by adding two rules to every ruleset. 1 allows established and related state packets through and rule 2 drops and logs invalid state packets. We place the @@ -367,7 +369,7 @@ IPv6 Tunnel ^^^^^^^^^^^ If you are using a IPv6 tunnel from HE.net or someone else, the basis is -the same except you have two WAN interface. One for v4 and one for v6. +the same except you have two WAN interfaces. One for v4 and one for v6. You would have 5 zones instead of just 4 and you would configure your v6 ruleset between your tunnel interface and your LAN/DMZ zones instead of |