ibm i 系列/as400 ip 策略/防火牆規則

我有一個需要進入公共 ip 的 IBM I 系列 (AS/400)。我想關閉面向網際網路的埠，只向外界開放一些埠，並保持內部網路對 ftp、5250 等開放。

我打開 System i Navigator 並查看 IP Policies 編輯器，但不完全確定如何處理 this.Public ip 211 .. .* 剛剛編輯為不顯示真實 IP，* 不是萬用字元。昨天我把每個人都鎖在了 as400 之外，因為我弄錯了，不太確定我是怎麼出錯的，所以對此進行了修改 - RMVTCPTBL TBL(*IPFTR) 挽救了這一天……類似的東西；

#Assign IP Addresses to Names
ADDRESS External_AS400 IP = 211.*.*.* TYPE = BORDER
#Internal lan network address
ADDRESS INTERNAL_AS400 IP = 192.168.1.201 TYPE = TRUSTED
ADDRESS Internal_Lan IP = 192.168.1.0 MASK = 255.255.255.0 TYPE = TRUSTED
#Inbound from Internet rules
FILTER SET Inbound_AS400   ACTION = PERMIT   DIRECTION = INBOUND   SRCADDR = *   DSTADDR = INTERNAL_AS400   PROTOCOL = TCP   DSTPORT = 22   SRCPORT = *   FRAGMENTS = NONE JRN = OFF
FILTER SET Inbound_AS400   ACTION = PERMIT   DIRECTION = INBOUND   SRCADDR = *   DSTADDR = External_AS400   PROTOCOL = TCP   DSTPORT = 22   SRCPORT = *   FRAGMENTS = NONE JRN = OFF
FILTER SET Inbound_AS400   ACTION = PERMIT   DIRECTION = INBOUND   SRCADDR = *   DSTADDR = INTERNAL_AS400   PROTOCOL = TCP   DSTPORT = 25   SRCPORT = *   FRAGMENTS = NONE JRN = OFF
FILTER SET Inbound_AS400   ACTION = PERMIT   DIRECTION = INBOUND   SRCADDR = *   DSTADDR = External_AS400   PROTOCOL = TCP   DSTPORT = 25   SRCPORT = *   FRAGMENTS = NONE JRN = OFF
FILTER SET Inbound_AS400   ACTION = PERMIT   DIRECTION = INBOUND   SRCADDR = *   DSTADDR = INTERNAL_AS400   PROTOCOL = TCP   DSTPORT = 110   SRCPORT = *   FRAGMENTS = NONE JRN = OFF
FILTER SET Inbound_AS400   ACTION = PERMIT   DIRECTION = INBOUND   SRCADDR = *   DSTADDR = External_AS400   PROTOCOL = TCP   DSTPORT = 110   SRCPORT = *   FRAGMENTS = NONE JRN = OFF
#Allow local lan access to server
FILTER SET Inbound_AS400    ACTION = PERMIT   DIRECTION = INBOUND   SRCADDR = Interal_Lan DSTADDR = INTERNAL_AS400 PROTOCOL = * DSTPORT = * SRCPORT = * FRAGMENTS = * JRN = OFF
FILTER SET Inbound_AS400    ACTION = PERMIT   DIRECTION = INBOUND   SRCADDR = Interal_Lan DSTADDR = External_AS400 PROTOCOL = * DSTPORT = * SRCPORT = * FRAGMENTS = * JRN = OFF
#Outbound to Internet Rules
FILTER SET Outbound_AS400   ACTION = PERMIT   DIRECTION = OUTBOUND   SRCADDR = INTERNAL_AS400   DSTADDR = *   PROTOCOL = *   DSTPORT = *   SRCPORT = *   FRAGMENTS = * JRN = OFF
FILTER SET Outbound_AS400   ACTION = PERMIT   DIRECTION = OUTBOUND   SRCADDR = External_AS400   DSTADDR = *   PROTOCOL = *   DSTPORT = *   SRCPORT = *   FRAGMENTS = * JRN = OFF
#Get Out of Jail Free
FILTER SET ALLOWALL ACTION PERMIT DIRECTION = * SRCADDR = * DSTADDR = * PROTOCOL = * DSTPORT = * SRCPORT = * FRAGMENTS = * JRN = OFF
#Allocate FILTER SET to Network INTERFACE
FILTER_INTERFACE   LINE = TCPLIN2   SET = Inbound_AS400
FILTER_INTERFACE   LINE = TCPLIN2   SET = Outbound_AS400
FILTER_INTERFACE   LINE = TCPLIN2   SET = ALLOWALL

我認為它很困惑，因為您將所有規則設置為同一行描述 LINE = TCPLIN2。

你知道這個系統上有多少個網路適配器嗎？WRKHDWRSC TYPE(*CMN) 並檢查類型為 5767 且狀態為執行的適配器。大多數 iSeries 至少有 2 個。如果您有幾個適配器，您可以分配一個用於內部流量，一個用於外部流量。

您還可以使用硬體管理控制台創建虛擬乙太網適配器，再次為外部/內部流量創建一個。使用 2 個適配器，您可能可以更輕鬆地實現所需的功能。

引用自：https://serverfault.com/questions/797332