Why this item
When I was searching how to setup my new EdgeRouter Lite, I came across
a
link
that would explain why using a zone based firewall is better than a
per-interface firewall. Unfortually the webpage was no longer reachable,
but at least google
cache
still had the text available.
Because it is a good article, I put the text here as a backup. The
original also has some pictures as can be seen by the archived
page.
Per Interface vs. Zone Based Firewall
Every so often, I get asked the question of why I feel a Zone based
firewall is better than a per-interface firewall. It can be a
complicated question to answer depending on the asker’s level of
understanding. So my goal here is to provide a simple and clear
description of why a zone based firewall is the more secure solution.
In all firewall variants, we do matching against multiple attributes of
a packet. Source IP, Source Port, Destination IP, Destination Port,
session state, protocol and various other logical values depending on
the implementation. The primary difference between ACLs and Zones are
how they apply to the physical or layer 2 characteristics.