Visit Our UNIX and Linux User Community


AIX firewall accept established connection


 
Thread Tools Search this Thread
Operating Systems AIX AIX firewall accept established connection
# 1  
Old 09-29-2016
AIX firewall accept established connection

I'm trying to configure a firewall for AIX to accept incoming connections on ports 22 and 443 and deny everything else. All is ok; the server accepts connections only on 22 and 443, but after that I also need to accept all outgoing connections -- ssh and telnet, for example. So I started with
Code:
genfilt -v 4 -a P -s 0.0.0.0 -m 0.0.0.0 -d x.x.x.x -M 255.255.255.255 -c tcp -o any -p 0 -O eq -P 22 -w I -i all
genfilt -v 4 -a P -s 0.0.0.0 -m 0.0.0.0 -d x.x.x.x -M 255.255.255.255 -c tcp -o any -p 0 -O eq -P 443 -w I -i all
genfilt -v 4 -a D -s 0.0.0.0 -m 0.0.0.0 -d x.x.x.x -M 255.255.255.255 -c tcp -o any -p 0 -O any -P 0 -w I -i all

Afterwards, I had to accept outgoing connections, so I introduced another rule:
Code:
genfilt -v 4 -a P -s 0.0.0.0 -m 0.0.0.0 -d x.x.x.x -M 255.255.255.255 -c tcp -o any -p 0 -O eq -P 22 -w I -i all
genfilt -v 4 -a P -s 0.0.0.0 -m 0.0.0.0 -d x.x.x.x -M 255.255.255.255 -c tcp -o any -p 0 -O eq -P 443 -w I -i all
**genfilt -v 4 -a P -s x.x.x.x -m 255.255.255.255 -d 0.0.0.0 -M 0.0.0.0 -c tcp -o any -p 0 -O any -P 0 -r L -w O -i all**
genfilt -v 4 -a D -s 0.0.0.0 -m 0.0.0.0 -d x.x.x.x -M 255.255.255.255 -c tcp -o any -p 0 -O any -P 0 -w I -i all

and after that tried more rules:
Code:
genfilt -v 4 -a P -s 0.0.0.0 -m 0.0.0.0 -d 0.0.0.0 -M 0.0.0.0 -c tcp/syn -o any -p 0 -O any -P 0 -w O -i all
genfilt -v 4 -a P -s 0.0.0.0 -m 0.0.0.0 -d 0.0.0.0 -M 0.0.0.0 -c tcp -o any -p 0 -O any -P 0 -w O -i all

But outgoing connections still not working, does anyone have any knowledge about this?

Last edited by Don Cragun; 09-29-2016 at 03:36 PM.. Reason: Change HTML tags to CODE tags.

Previous Thread | Next Thread
Test Your Knowledge in Computers #941
Difficulty: Medium
A ping of death is a type of attack on a computer system that involves sending a malformed or otherwise malicious ping to a computer.
True or False?

10 More Discussions You Might Find Interesting

1. AIX

AIX LPAR FC connection to SAN

Hi all, In my system, I have HMC 7 with Power Machine 6 & 7. On the managed system, we have many lpars. In some lpars, I can see they are using virtual fiber channel to connect to DS8K storage. In search with google, I understand that it is configured with VIOS server to share the physical FC... (7 Replies)
Discussion started by: Phat
7 Replies

2. UNIX for Dummies Questions & Answers

I have firewall rules to open ports, why telnet refuses connection?

Alright... this question comes from the fact that I'm trying to setup postfix to relay messages to Office 365 SMTP but its giving me connection refused... I read that if you have doubts if your port is open or not you should telnet to them so thats what I did. This is a Red Hat 6.3 box. My... (4 Replies)
Discussion started by: RedSpyder
4 Replies

3. Shell Programming and Scripting

Script for checking firewall connection

Dear all I am writing a shell script to use telnet for the connection test There are 3 cases to test and detail as: /* Case 1 - The port can be connected */ # telnet host_a 20101 < /dev/null 2>&1 | grep -q Connected # echo $? return 0 /* Case 2 - The port cannot be connected */ #... (1 Reply)
Discussion started by: on9west
1 Replies

4. Programming

Accept (sockets) queuing up connection requests

Yes, I guess that is what it is sort of meant to do but it is sort of a problem. Scenario: Server is running and is blocked at ACCEPT Client A connects with server Server returns from ACCEPT and moves to RECV call waiting for incoming string Client... (4 Replies)
Discussion started by: Kam5FCC
4 Replies

5. AIX

MVS DB2 Connection from AIX

Hi, I want to try to connect to a DB2 (MVS) database from an AIX, through my c++ custom program. Is anybody who knows how can I do this? Which libraries should I use? Should I have a DB2 connect installed on my AIX? Thank you in advance. (3 Replies)
Discussion started by: develo
3 Replies

6. Solaris

Solaris 10 ftp connection problem (connection refused, connection timed out)

Hi everyone, I am hoping anyone of you could help me in this weird problem we have in 1 of our Solaris 10 servers. Lately, we have been having some ftp problems in this server. Though it can ping any server within the network, it seems that it can only ftp to a select few. For most servers, the... (4 Replies)
Discussion started by: labdakos
4 Replies

7. Solaris

How to kill the TCP ESTABLISHED connection in netstat

Hello, Actually there are some bugs in application which does not close the TCP connection to other server though CORBA. We need to kill that ESTABLISHED connections as new connection are not happeneing as the allocated ports were used and showing as ESTABLISHED Is there any... (4 Replies)
Discussion started by: GIC1986
4 Replies

8. UNIX for Advanced & Expert Users

tunneling commands and file transfers through established ssh connection

Hi - I frequently run commands, and transfer files to/from a host that uses SecurID ssh authentication. It is a real pain to have to enter the authentication information every time I want to interact with this host. I am wondering if there is a way to establish a one-time ssh connection to this... (2 Replies)
Discussion started by: cpp6f
2 Replies

9. AIX

Setup Window server to accept AIX SFTP client

To all the expert out there, I have successfully setup a AIX to AIX auto-SFTP with no password requested. Now my aim is to setup a AIX to Window auto-SFTP with no password requested as well. But I faced some problem that I do not know how to solve it. I have followed the setting of AIX's... (8 Replies)
Discussion started by: kwliew999
8 Replies

10. AIX

AIX NIM backup with Firewall

Hi- I'm using NIM functionality (AIX5.3) to backup all AIX Servers but some Servers are in the DmZ and many tcpip ports (nfs, ping,etc...) should be open and... it's really a security risks! As anyone experience about NIM Backup through Firewall? Which tcpip ports should be open? Could we... (1 Reply)
Discussion started by: nymus7
1 Replies

Featured Tech Videos