• SonicOS 7.0 Rules and Policies
• Access Rules
  • Setting Firewall Access Rules
    • About Connection Limiting
    • Using Bandwidth Management with Access Rules
      • Enabling Bandwidth Management on an Access Rule
    • Creating Access Rules
    • Configuring Access Rules for IPv6
      • About Stateful Packet Inspection Default Access Rules
    • Enabling and Disabling Access Rules
    • Editing Access Rules
    • Deleting Access Rules
    • Restoring Access Rules to Default Settings
    • Displaying Access Rules
      • By Zones
      • By Column
    • Displaying Access Rule Traffic Statistics
    • Configuring Access Rules for NAT64
    • Configuring Access Rules for a Zone
    • Access Rules for DNS Proxy
    • User Priority for Access Rules
  • Access Rule Configuration Examples
    • Enabling Ping
    • Blocking LAN Access for Specific Services
    • Allowing WAN Primary IP Access from the LAN Zone
• NAT Rules
  • About NAT in SonicOS
  • About NAT Load Balancing
    • Determining the NAT LB Method to Use
    • Caveats
    • How Load Balancing Algorithms are Applied
    • Sticky IP Algorithm Examples
      • Example One - Mapping to a Network
      • Example Two - Mapping to an IP Address Range
  • About NAT64
    • Use of Pref64::/n
  • About FQDN-based NAT
  • About Source MAC Address Override
  • Viewing NAT Policy Entries
    • Changing the Display
    • Filtering the Display
    • Displaying Information about Policies
  • Adding or Editing NAT or NAT64 Rule Policies
  • Deleting NAT Policies
  • Creating NAT Rule Policies: Examples
    • Creating a One-to-One NAT Policy for Inbound Traffic
    • Creating a One-to-One NAT Policy for Outbound Traffic
    • Inbound Port Address Translation via One-to-One NAT Policy
    • Inbound Port Address Translation via WAN IP Address
    • Creating a Many-to-One NAT Policy
    • Creating a Many-to-Many NAT Policy
    • Creating a One-to-Many NAT Load Balancing Policy
    • Creating a NAT Load Balancing Policy for Two Web Servers
    • Creating a WAN-to-WAN Access Rule for a NAT64 Policy
    • DNS Doctoring
• Routing
  • About Routing
    • About Metrics and Administrative Distance
      • About Metrics
      • About Administrative Distance
    • Route Advertisement
    • ECMP Routing
    • Policy-based Routing
    • Policy-based TOS Routing
    • PBR Metric-based Priority
    • Policy-based Routing and IPv6
    • OSPF and RIP Advanced Routing Services
      • About Routing Services
        • Protocol Type
        • Maximum Hops
        • Split-Horizon
        • Poison Reverse
        • Routing Table Updates
        • Subnet Sizes Supported
        • Autonomous System Topologies
      • OSPF Terms
    • Drop Tunnel Interface
    • App-based Routing
  • Rules and Policies >
    • Configuring
      • Adding Static Routes
      • Probe-Enabled Policy-based Routing Configuration
• Content Filter Rules
  • About Content Filtering Rules (CFS)
    • About Content Filter Rules
    • About UUIDs for CFS Policies
    • About Content Filter Action Objects
    • How CFS Works
  • Configuring CFS Policies
    • About the Content Filter Rule Table
      • Searching the Content Filter Rule Table
    • Adding a Content Filter Rule
    • Editing a Content Filter Rule
    • Deleting Content Filter Rules
• App Rules
  • About App Rules
    • What are App Rules?
      • About App Rules Policies
      • About App Rules Capabilities
    • Benefits of App Rules
    • How Does Application Control Work?
    • About App Rules Policy Creation
    • Licensing App Rules and App Control
    • Terminology
  • Rules and Policies > App Rules
    • Configuring an App Rules Policy
  • Verifying App Rules Configuration
    • Useful Tools
      • Wireshark
      • Hex Editor
  • App Rules Use Cases
    • Creating a Regular Expression in a Match Object
    • Policy-based Application Rules
    • Logging Application Signature-based Policies
    • Compliance Enforcement
    • Server Protection
    • Hosted Email Environments
    • Email Control
    • Web Browser Control
    • HTTP Post Control
    • Forbidden File Type Control
    • ActiveX Control
    • FTP Control
      • Blocking Outbound Proprietary Files Over FTP
      • Blocking Outbound UTF-8 / UTF-16 Encoded Files
      • Blocking FTP Commands
    • Bandwidth Management
    • Bypass DPI
    • Custom Signature
    • Reverse Shell Exploit Prevention
      • Generating the Network Activity
      • Capturing and Exporting the Payload to a Text File Using Wireshark
      • Creating a Match Object
      • Defining the Policy
• Endpoint Rules
• SonicWall Support
  • About This Document

Creating Access Rules

Access Rules provide the interface to add, delete, and modify policies. You can also select the desired zones for the traffic flow with the Zone Matrix Selector.

To create Access Rules

1. Navigate to POLICY | Rules and Policies | Access Rules.

   

2. Click the Zone Matrix Selector drop-down menu from the top bar and assign your LAN to the appropriate To Zone access rule. (This is the Zone of the private IP the server resides on.)

   

3. Click +Add at the bottom of the access rules page and create the required Access Rule by configuring the Adding Rule fields as follows.

   

4. Select an Action for this service whether to Allow, Deny, or Discard.

5. Select a Source and Destination from the Zone/Interface drop-down menus, which list any custom and default address objects created.

6. Specify the Source and Destination Port/Services for the ingress and egress traffic. By default, you can keep the Source service as Any and keep the Destination Port configured.

7. Click the User & TCP/UDP tab. Specify if this rule applies to all users or to an individual user or group in the User Include and Exclude options.

   

8. Specify how long (in minutes) TCP connections might remain idle before the connection is terminated in the TCP Inactivity Timeout field.

9. Specify how long (in seconds) UDP connections might remain idle before the connection is terminated in the UDP Inactivity Timeout field.

10. Clicking into the Security Profiles tab, you can configure a security profile for your access rule that includes enabling or disabling the DPI, Client DPI-SSL, and Server DPI-SSL services, as well as the Botnet/CC and Geo-IP Filters based on firewall rule connections.

    

11. You can configure egress and ingress bandwidth management on the firewall access rules for specific sources, destinations, and services.

    

12. To track bandwidth usage for this service, enable Track Bandwidth Usage.

13. To enable logging for this rule, click the Logging tab.

14. The last tab is the Optional Settings tab. Specify the percentage of the maximum connections this rule is to allow in the Number of connections allowed (% of maximum connections) field.

    

15. Set a limit for the maximum number of connections allowed per source IP address by selecting Enable Connection Threshold for each Source IP and entering the value in the field.

    Only available for Allow rules.

16. Set a limit for the maximum number of connections allowed per destination IP address by selecting Enable Connection for each Destination IP and entering the value in the field.

    Only available for Allow rules.

17. You can enable fragmented packets on the access rule as well as allow management traffic over the access rule, Click Add when finished.

18. You can also show the diagram flow of the access rule created by enabling Show Diagram.