UNIX for Dummies Questions & Answers

hi, say we have servers whose ip is 100.100.100.1 to 100.100.100.10. now we have another server which is 200.200.200.2. is it possible to restrict servers from the range of (100.100.100.1 and etc.. ) to telnet to 200.200.200.2

thanks

Set up a packet-filtering firewall on 200.200.200.2 then.

what do u mean by a packet-filtering firewall?


thanks

A packet filtering firewall filters packets passing through by examining the fields of the packet, and you set up rules to decide how to deal with packets satisfying certain rules you defined.

You can set up a firewall with a rule stating something like "packets destined to port 23 whose IP is not in 100.100.100.1-10 range should be dropped.". Packets matching this rule will be dropped at the firewall before having the chance of reaching the telnet daemon.

On Linux, ipchains or iptables does exactly that. There are similar tools in other Unix variants.

so in this case the packet filter firewall is a software version.
how does a software firewall differs from a hardware one.

If you do care about critical performance, you'd better go the hardware way. Otherwise, a software firewall should suffice in my opinion.

At least it doesn't cost anything to set one up, and it's sufficiently flexible.

While cbkihong suggestion relating to firewalls is definately a component in a long-term solution to secure your servers - in this instance it may be easier to setup the inetd.sec file to specifically limit access to the telnet daemon.

The syntax is:

<service name> <allow|deny> <host/net addresses, host/net names>

The man page will help further.