Advanced POWER Virtualization on IBM System p5 - Previous ...

The firewall can be switched on and off. If enabled with the -on switch,
connections to the ports ftp-data (20), ftp (21), ssh (22), www (80), https (443),
rmc (657), and cimon (32768) will be allowed, all other traffic will be denied.
Example 5-50 shows this procedure.
Example 5-50 Activating the firewall with the viosecure command
$ viosecure -firewall on
$ viosecure -firewall view
Firewall ON
ALLOWED PORTS
Local Remote
Interface Port Port Service IPAddress Expiration
Time(seconds)
--------- ---- ---- ------- --------- ---------------
$
Further configuration can allow access to specific ports generally or just for
specified remote machine(s). We show as an example here how to restrict the
rsh command connections (Port 112) to a single machine with an IP address of
9.3.5.111. This could well be an administrative machine from which connections
to the HMC can be allowed, as the HMC is also able to restrict connections to
specified machines (Example 5-51).
Example 5-51 Allowing rsh connections from a specified IP address
$ viosecure -firewall allow -port exec -address 9.3.5.111
$ viosecure -firewall view
Firewall ON
ALLOWED PORTS
Local Remote
Interface Port Port Service IPAddress Expiration
Time(seconds)
--------- ---- ---- ------- --------- ---------------
all 512 any exec 9.3.5.111 0
$
The login will now succeed from the IP address 9.3.5.111, while other machines
will not be able to connect. To deny connections to a specified port as well as to
remove the opened port from the firewall list, use the following command
(Example 5-52 on page 361).
360 <strong>Advanced</strong> <strong>POWER</strong> <strong>Virtualization</strong> on IBM System p5