我有一个需要进入公共 ip 的 IBM I 系列 (AS/400)。我想关闭面向互联网的端口,只向外界开放一些端口,并保持内部网络对 ftp、5250 等开放。
我打开 System i Navigator 并查看 IP Policies 编辑器,但不完全确定如何处理 this.Public ip 211 .. .* 刚刚编辑为不显示真实 IP,* 不是通配符。昨天我把每个人都锁在了 as400 之外,因为我弄错了,不太确定我是怎么出错的,所以对此进行了修改 - RMVTCPTBL TBL(*IPFTR) 挽救了这一天....之类的;
#Assign IP Addresses to Names
ADDRESS External_AS400 IP = 211.*.*.* TYPE = BORDER
#Internal lan network address
ADDRESS INTERNAL_AS400 IP = 192.168.1.201 TYPE = TRUSTED
ADDRESS Internal_Lan IP = 192.168.1.0 MASK = 255.255.255.0 TYPE = TRUSTED
#Inbound from Internet rules
FILTER SET Inbound_AS400 ACTION = PERMIT DIRECTION = INBOUND SRCADDR = * DSTADDR = INTERNAL_AS400 PROTOCOL = TCP DSTPORT = 22 SRCPORT = * FRAGMENTS = NONE JRN = OFF
FILTER SET Inbound_AS400 ACTION = PERMIT DIRECTION = INBOUND SRCADDR = * DSTADDR = External_AS400 PROTOCOL = TCP DSTPORT = 22 SRCPORT = * FRAGMENTS = NONE JRN = OFF
FILTER SET Inbound_AS400 ACTION = PERMIT DIRECTION = INBOUND SRCADDR = * DSTADDR = INTERNAL_AS400 PROTOCOL = TCP DSTPORT = 25 SRCPORT = * FRAGMENTS = NONE JRN = OFF
FILTER SET Inbound_AS400 ACTION = PERMIT DIRECTION = INBOUND SRCADDR = * DSTADDR = External_AS400 PROTOCOL = TCP DSTPORT = 25 SRCPORT = * FRAGMENTS = NONE JRN = OFF
FILTER SET Inbound_AS400 ACTION = PERMIT DIRECTION = INBOUND SRCADDR = * DSTADDR = INTERNAL_AS400 PROTOCOL = TCP DSTPORT = 110 SRCPORT = * FRAGMENTS = NONE JRN = OFF
FILTER SET Inbound_AS400 ACTION = PERMIT DIRECTION = INBOUND SRCADDR = * DSTADDR = External_AS400 PROTOCOL = TCP DSTPORT = 110 SRCPORT = * FRAGMENTS = NONE JRN = OFF
#Allow local lan access to server
FILTER SET Inbound_AS400 ACTION = PERMIT DIRECTION = INBOUND SRCADDR = Interal_Lan DSTADDR = INTERNAL_AS400 PROTOCOL = * DSTPORT = * SRCPORT = * FRAGMENTS = * JRN = OFF
FILTER SET Inbound_AS400 ACTION = PERMIT DIRECTION = INBOUND SRCADDR = Interal_Lan DSTADDR = External_AS400 PROTOCOL = * DSTPORT = * SRCPORT = * FRAGMENTS = * JRN = OFF
#Outbound to Internet Rules
FILTER SET Outbound_AS400 ACTION = PERMIT DIRECTION = OUTBOUND SRCADDR = INTERNAL_AS400 DSTADDR = * PROTOCOL = * DSTPORT = * SRCPORT = * FRAGMENTS = * JRN = OFF
FILTER SET Outbound_AS400 ACTION = PERMIT DIRECTION = OUTBOUND SRCADDR = External_AS400 DSTADDR = * PROTOCOL = * DSTPORT = * SRCPORT = * FRAGMENTS = * JRN = OFF
#Get Out of Jail Free
FILTER SET ALLOWALL ACTION PERMIT DIRECTION = * SRCADDR = * DSTADDR = * PROTOCOL = * DSTPORT = * SRCPORT = * FRAGMENTS = * JRN = OFF
#Allocate FILTER SET to Network INTERFACE
FILTER_INTERFACE LINE = TCPLIN2 SET = Inbound_AS400
FILTER_INTERFACE LINE = TCPLIN2 SET = Outbound_AS400
FILTER_INTERFACE LINE = TCPLIN2 SET = ALLOWALL