AIX

Recently the network auditor found a security hole at port 50000. The port 50000 is used by db2.
When I enter command "netstat -Aan |grep 50000", it showed some established connections and are all db2 processes.

I have asked the application team and they answered that the port 50000 connection is needed only in local machine. They want the local machine to allow access to this port, while blocking all other connections not from local machine.

I tried to use IP security to block connections to port 50000, below are the filter rules:
1 *** Dynamic filter placement rule for IKE tunnels *** no
2 deny 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 yes all any 0 eq 50000 both both no all packets 0 en0 0 none
3 permit 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 yes all any 0 any 0 both both no all packets 0 all 0 none

After activating this IP filter, I tried using another machine to test connection to this port by command : "telnet <IP> 50000". If the IP security is function properly, I should not be able to connect to it, but the result showed that I can connect into it.

I tried to change the port from 50000 to 21 and try telnet test. This time it behaves properly, I cannot telnet from remote machine to port 21, but can telnet to localhost port 21. I expect to have this result with port 50000.

Is there any error in my setting in IP filter? Please help!!

Another solution would be for them to change the interface they are running on from the interface with the IP (en2 in the example below) to instead run it on 127.0.0.1 (your loopback address). Of course they would have to change where they are conneting to but it may work.

Code:

hostname:/:$ ifconfig -a
en2: flags=1e080863,480<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST,GROUPRT,64BIT,CHECKSUM_OFFLOAD(ACTIVE),CHAIN>
        inet 10.177.1.20 netmask 0xffff0000 broadcast 10.177.1.255
         tcp_sendspace 262144 tcp_recvspace 262144 rfc1323 1
lo0: flags=e08084b,c0<UP,BROADCAST,LOOPBACK,RUNNING,SIMPLEX,MULTICAST,GROUPRT,64BIT,LARGESEND,CHAIN>
        inet 127.0.0.1 netmask 0xff000000 broadcast 127.255.255.255
        inet6 ::1%1/0
         tcp_sendspace 131072 tcp_recvspace 131072 rfc1323 1
hostname:/:$

If you consider the incoming packet, you need to focus on destination port. You have to set destination port equals to 50000. Which you did. But, why not setting the direction to only "inbound"? What's the point of setting it "both" when you are concentrating mainly on incoming packets? Also, consider changing the source IP and subnet mask to be more precise for your network. Can you test this and check if it works?