:lastproofread: 2026-03-30 .. _firewall-zone: ################### Zone-Based Firewall ################### ******** Overview ******** .. note:: All VyOS versions built after 2023-10-22 (VyOS 1.4 and 1.5) support this feature. This section provides information on firewall configuration for the zone-based firewall. This section covers the following configuration commands: .. cfgcmd:: set firewall zone ... To learn about the general traffic flow in VyOS firewalls, see :doc:`Firewall `. .. code-block:: none - set firewall * zone - custom_zone_name + ... In zone-based policy, you assign interfaces to zones and apply inspection policy to traffic moving between zones. The firewall acts on traffic according to rules. A zone is a group of interfaces that have similar functions or features. It establishes the security borders of a network. A zone defines a boundary where the system subjects traffic to policy restrictions as it crosses to another region of a network. Key Points: * A zone must be configured before you assign an interface to it, and you can assign an interface to only a single zone. * All traffic to and from an interface within a zone flows freely. * Existing policies affect all traffic between zones. * Traffic cannot flow between a zone member interface and any interface that is not a zone member. * You must define 2 separate firewalls to define traffic: one for each direction. .. note:: In :vytask:`T2199` the syntax of the zone configuration was changed. The zone configuration moved from ``zone-policy zone `` to ``firewall zone ``. ************* Configuration ************* As an alternative to applying policy to an interface directly, you can create a zone-based firewall to simplify configuration when multiple interfaces belong to the same security zone. Instead of applying rule-sets to interfaces, you apply them to source-destination zone pairs. You can find a basic introduction to zone-based firewalls in the `VyOS Knowledge Base `_, and an example at :ref:`examples-zone-policy`. The following steps are required to create a zone-based firewall: 1. Define both the source and destination zones 2. Define the rule-set 3. Apply the rule-set to the zones Define a Zone ============= To define a zone, set up either one with interfaces or as the local zone. .. cfgcmd:: set firewall zone interface Assign interfaces as a member of a zone. .. note:: * An interface can only be a member of one zone. * You can have multiple interfaces in a zone. Traffic between interfaces in the same zone follows the intra-zone-filtering policy (allowed by default). .. cfgcmd:: set firewall zone local-zone Define the zone as the local zone for traffic that originates from or is destined to the router itself. .. note:: * A local zone cannot have any member interfaces * You cannot have multiple local zones .. cfgcmd:: set firewall zone default-action [drop | reject] Modify the zone default-action, which applies to traffic destined to this zone that does not match any of the source zone rulesets applied. .. cfgcmd:: set firewall zone default-log Enable logging of packets that match this zone's default-action (disabled by default). .. cfgcmd:: set firewall zone description Add a meaningful description. Defining a Rule-Set ============================= Zone-based firewall rule-sets define traffic from a *Source Zone* to a *Destination Zone*. You create rule-sets as a custom firewall chain using the commands below (refer to the firewall IPv4/IPv6 sections for the full syntax): * For :ref:`IPv4`: ``set firewall ipv4 name ...`` * For :ref:`IPv6`: ``set firewall ipv6 name ...`` It is helpful to name the rule-sets in the format ``--`` to make them easily identifiable. Applying a Rule-Set to a Zone ============================= After you define a rule-set, apply it to the source and destination zones. The configuration syntax anchors to the destination zone, with each of the source zone rule-sets listed against the destination. .. cfgcmd:: set firewall zone from firewall name .. cfgcmd:: set firewall zone from firewall ipv6-name You should create two rule-sets for each source-destination zone pair. .. code-block:: none set firewall zone DMZ from LAN firewall name LAN-DMZ-v4 set firewall zone LAN from DMZ firewall name DMZ-LAN-v4 Applying a Default Rule-Set to a Zone ===================================== When a destination zone shares a common rule-set for multiple source zones, or when you require a complex set of default policies, you can apply an optional default rule-set. The default rule-set applies to all zones that do not have a rule-set configured as defined in :ref:`IPv4` .. cfgcmd:: set firewall zone default-firewall name .. cfgcmd:: set firewall zone default-firewall ipv6-name ************** Operation-mode ************** .. opcmd:: show firewall zone-policy Display a basic summary of the zone configuration. .. code-block:: none vyos@vyos:~$ show firewall zone-policy Zone Interfaces From Zone Firewall IPv4 Firewall IPv6 ------ ------------ ----------- --------------- --------------- LAN eth1 WAN WAN-LAN-v4 eth2 LOCAL LOCAL LAN LAN-LOCAL-v4 WAN WAN-LOCAL-v4 WAN-LOCAL-v6 WAN eth3 LAN LAN-WAN-v4 eth0 LOCAL LOCAL-WAN-v4 .. opcmd:: show firewall zone-policy zone Display a basic summary of a particular zone. .. code-block:: none vyos@vyos:~$ show firewall zone-policy zone WAN Zone Interfaces From Zone Firewall IPv4 Firewall IPv6 ------ ------------ ----------- --------------- --------------- WAN eth3 LAN LAN-WAN-v4 eth0 LOCAL LOCAL-WAN-v4 vyos@vyos:~$ show firewall zone-policy zone LOCAL Zone Interfaces From Zone Firewall IPv4 Firewall IPv6 ------ ------------ ----------- --------------- --------------- LOCAL LOCAL LAN LAN-LOCAL-v4 WAN WAN-LOCAL-v4 WAN-LOCAL-v6