主页 / server / 问题 / 797332
Accepted
Squid_Vicious
Asked: 2016-08-18 02:15:38 +0800 CST

ibm i 系列/as400 ip 策略/防火墙规则

  • 772

我有一个需要进入公共 ip 的 IBM I 系列 (AS/400)。我想关闭面向互联网的端口，只向外界开放一些端口，并保持内部网络对 ftp、5250 等开放。

我打开 System i Navigator 并查看 IP Policies 编辑器，但不完全确定如何处理 this.Public ip 211 .. .* 刚刚编辑为不显示真实 IP，* 不是通配符。昨天我把每个人都锁在了 as400 之外，因为我弄错了，不太确定我是怎么出错的，所以对此进行了修改 - RMVTCPTBL TBL(*IPFTR) 挽救了这一天....之类的；

#Assign IP Addresses to Names
ADDRESS External_AS400 IP = 211.*.*.* TYPE = BORDER
#Internal lan network address
ADDRESS INTERNAL_AS400 IP = 192.168.1.201 TYPE = TRUSTED
ADDRESS Internal_Lan IP = 192.168.1.0 MASK = 255.255.255.0 TYPE = TRUSTED
#Inbound from Internet rules
FILTER SET Inbound_AS400   ACTION = PERMIT   DIRECTION = INBOUND   SRCADDR = *   DSTADDR = INTERNAL_AS400   PROTOCOL = TCP   DSTPORT = 22   SRCPORT = *   FRAGMENTS = NONE JRN = OFF
FILTER SET Inbound_AS400   ACTION = PERMIT   DIRECTION = INBOUND   SRCADDR = *   DSTADDR = External_AS400   PROTOCOL = TCP   DSTPORT = 22   SRCPORT = *   FRAGMENTS = NONE JRN = OFF
FILTER SET Inbound_AS400   ACTION = PERMIT   DIRECTION = INBOUND   SRCADDR = *   DSTADDR = INTERNAL_AS400   PROTOCOL = TCP   DSTPORT = 25   SRCPORT = *   FRAGMENTS = NONE JRN = OFF
FILTER SET Inbound_AS400   ACTION = PERMIT   DIRECTION = INBOUND   SRCADDR = *   DSTADDR = External_AS400   PROTOCOL = TCP   DSTPORT = 25   SRCPORT = *   FRAGMENTS = NONE JRN = OFF
FILTER SET Inbound_AS400   ACTION = PERMIT   DIRECTION = INBOUND   SRCADDR = *   DSTADDR = INTERNAL_AS400   PROTOCOL = TCP   DSTPORT = 110   SRCPORT = *   FRAGMENTS = NONE JRN = OFF
FILTER SET Inbound_AS400   ACTION = PERMIT   DIRECTION = INBOUND   SRCADDR = *   DSTADDR = External_AS400   PROTOCOL = TCP   DSTPORT = 110   SRCPORT = *   FRAGMENTS = NONE JRN = OFF
#Allow local lan access to server
FILTER SET Inbound_AS400    ACTION = PERMIT   DIRECTION = INBOUND   SRCADDR = Interal_Lan DSTADDR = INTERNAL_AS400 PROTOCOL = * DSTPORT = * SRCPORT = * FRAGMENTS = * JRN = OFF
FILTER SET Inbound_AS400    ACTION = PERMIT   DIRECTION = INBOUND   SRCADDR = Interal_Lan DSTADDR = External_AS400 PROTOCOL = * DSTPORT = * SRCPORT = * FRAGMENTS = * JRN = OFF
#Outbound to Internet Rules
FILTER SET Outbound_AS400   ACTION = PERMIT   DIRECTION = OUTBOUND   SRCADDR = INTERNAL_AS400   DSTADDR = *   PROTOCOL = *   DSTPORT = *   SRCPORT = *   FRAGMENTS = * JRN = OFF
FILTER SET Outbound_AS400   ACTION = PERMIT   DIRECTION = OUTBOUND   SRCADDR = External_AS400   DSTADDR = *   PROTOCOL = *   DSTPORT = *   SRCPORT = *   FRAGMENTS = * JRN = OFF
#Get Out of Jail Free
FILTER SET ALLOWALL ACTION PERMIT DIRECTION = * SRCADDR = * DSTADDR = * PROTOCOL = * DSTPORT = * SRCPORT = * FRAGMENTS = * JRN = OFF
#Allocate FILTER SET to Network INTERFACE
FILTER_INTERFACE   LINE = TCPLIN2   SET = Inbound_AS400
FILTER_INTERFACE   LINE = TCPLIN2   SET = Outbound_AS400
FILTER_INTERFACE   LINE = TCPLIN2   SET = ALLOWALL
ibm ibm-midrange ipfilter

2 个回答

  1. 对不起，我不做这种事情。但是你不想在物理服务器前面安装一个硬件防火墙吗？这样，您就可以在 Internet 和服务器之间获得额外的保护层。

    • 0
  2. Best Answer

    我认为它变得混乱，因为您将所有规则设置为同一行描述 LINE = TCPLIN2。

    你知道这个系统上有多少个网络适配器吗？WRKHDWRSC TYPE(*CMN) 并检查 5767 类型的适配器和运行状态。大多数 iSeries 至少有 2 个。如果您有几个适配器，您可以分配一个用于内部流量，一个用于外部流量。

    您还可以使用硬件管理控制台创建虚拟以太网适配器，再次为外部/内部流量创建一个。使用 2 个适配器，您可能可以更轻松地实现所需的功能。

    • 0

相关问题