Inline Rules

Navigation: Rules & Policies → Inline Rules

Inline rules are the core firewall policies. They control which traffic is allowed or denied, which security profiles are applied, and how NAT behaves. Rules are evaluated top to bottom — place more specific rules above general ones.

Add / Edit forms

Click + Add New to open the creation dialog, or Edit on an existing row to modify a record.

List view

Add form

Empty form after clicking + Add New:

Same form filled with example data (do not save in production):

Edit form

Existing record opened with Edit:

Form fields explained

Dialog title: New Record — Inline Rule

Tabs: General · Interfaces · Source · Destination · NAT/SDWAN · Security Profiles

Technical background

Stateful firewall inspection

TOORCE inline rules implement stateful packet inspection (SPI). When a connection is allowed outbound, the return traffic is automatically permitted without a separate inbound rule. Denied traffic is dropped and may be logged as Implicit Deny.

Rule evaluation

Rules are processed top-down, first-match. This is the same model used by iptables/nftables, FortiGate, and Sophos. Best practice:

1. Specific deny rules (block known threats)
2. Specific allow rules (business applications)
3. General allow (internet access)
4. Implicit deny (everything else blocked)

Security profiles in rules

Modern NGFW rules attach deep inspection profiles:

NAT and DNAT

Rules can include DNAT (Destination NAT / port forwarding) to publish internal services (e.g. mail server on WAN IP port 25 → internal 192.168.100.20).

Prerequisites

Before creating inline rules, configure these objects first:

1. Address Objects — source/destination IPs
2. Port Objects — services
3. Interfaces — source/destination interfaces
4. Security Profiles — AV, Web, IPS, Time (optional)

Table columns

How to create an inline rule

1. Go to Rules & Policies → Inline Rules.
2. Click Add New.
3. Fill in each section:

Basic settings

Source

Destination

Security & scheduling

4. Click Save.
5. Click Install Policy if prompted to apply changes to the running firewall.

Example: Allow LAN to Internet

Example: Allow specific PC to mail server

Rule evaluation order

Rules are processed top to bottom. The first matching rule wins.

1. Place specific rules (single host, single service) at the top
2. Place general allow rules in the middle
3. Implicit deny catches everything not matched (logged as Implicit Deny in Firewall Logs)

Where rule names appear

Related topics

• Address Objects
• Time Profiles
• Firewall Security Logs
• Object Reference Guide