Zones and interfaces

Goal

Create security zones, assign interfaces to them, and understand how zone membership drives every firewall decision that follows.

Zones: the unit of trust

A zone is a named trust boundary — for example wan, lan, dmz, or mgmt. Firewall policy in ShieldGate is written between zones ("allow lan to wan"), never between raw interfaces. This keeps rules readable and survives hardware changes.

Steps

1. Create your zones

In the console open Network → L2, then create zones for each trust level. A minimal deployment usually has:

• wan — the untrusted internet-facing side
• lan — trusted internal clients
• dmz — public-facing servers that should never initiate connections inward

2. Assign interfaces

Bind each network interface to exactly one zone. An interface inherits the trust level of its zone, so traffic arriving on a wan interface is treated as untrusted regardless of its source address.

3. Publish

Zone and interface changes take effect when you publish the network configuration. The appliance applies the snapshot and reports status under Network → Monitor.

Default posture

Until you write rules, inter-zone traffic is denied. Intra-zone traffic (same zone to same zone) is allowed by default.

Verify

• Each interface shows its zone in the interface list.
• After publish, the appliance node reports the new version as applied.

Pitfalls

• Do not put management interfaces in lan "temporarily" — create a mgmt zone from day one. Retro-fitting management isolation is painful.