Troubleshooting packet rules

This topic provides troubleshooting advice for some common packet rules problems.

• i5/OS^® communications trace capability enables you to see all datagram traffic for a specified interface. Use the Start Communications Trace (STRCMNTRC) and Print Communications Trace (PRTCMNTRC) commands to collect and print the information.

• NAT and IP filtering rule order determines how your rules are processed. They are processed in the order which they appear in the file. If the order is not correct, the packets will not be processed as you intend. This leaves your system vulnerable to attack. Place your filter set names in the FILTER_INTERFACE statement in the same order in which the sets are physically defined in the file.

  Remember the process shown in the following table.

  Inbound traffic process	Outbound traffic process
  1. NAT rules	1. IP filter rules
  2. IP filter rules	2. NAT rules

• Removing all rules is the best way to reset your system and clear out errors. On the System i™ platform, issue the Remove TCP/IP Table (RMVTCPTBL) command. If you lock yourself out of the iSeries™ Navigator application, you can also use this command to go back and repair any rules.

  The Remove TCP/IP Table command also starts the virtual private network (VPN) servers, only if the VPN servers (IKE and ConMgr) were running before.

• Allowing IP datagram forwarding in your TCP/IP configuration on the system is essential if you are using NAT. Use the Change TCP/IP Attributes (CHGTCPA) command to verify that the IP datagram forwarding is set to YES.

• Verifying default return routes ensures that the address that you map to or hide behind is correct. This address must be routable on the return route back to the system and pass through the correct line to be untranslated by network address translation (NAT).

  If your System i platform has more than one network or line connected to it, you need to be especially careful about routing inbound traffic. Inbound traffic is handled on any line that it comes in on, which might not be the correct line waiting to untranslate it.

• Viewing error and warning messages in the EXPANDED.OUT file to ensure that the rules are ordered as you intend. When you verify and activate a set of filters, these filters are merged with any iSeries Navigator-generated rules. The combination produces the merged rules in a new file called EXPANDED.OUT, which is placed in the same directory that contains your rules (typically /QIBM). Warning and error messages refer to this file. To view this file, complete the following steps to open it from the Packet Rules Editor:

  1. Access the Packet Rules Editor in iSeries Navigator.

  2. From the File menu, select Open.

  3. Go to the directory, QIBM/UserData/OS400/TCPIP/PacketRules/ or to the directory where you have saved your packet rules if it is different than the default.

  4. From the Open File window, select EXPANDED.OUT file. The EXPANDED.OUT file should appear.

  5. Select this file and click Open.

  The EXPANDED.OUT file is for your information only. You cannot edit it.

Parent topic:

Related concepts
Scenario: Mapping IP addresses using NAT