Configuring packet rules

__	Access the Packet Rules Editor. Follow these instructions to access the Packet Rules Editor in iSeries™ Navigator.
__	Use the wizards provided as part of the Packet Rules Editor (V5R2 and later) to create your rules files: Permit a Service Wizard This wizard generates and inserts a set of packet rule statements that permits the necessary traffic for a given TCP or User Datagram Protocol (UDP) service. Spoof Protection Wizard This wizard generates and inserts a set of packet rule statements that denies any traffic on an interface that should only be entering this server through a different interface. Address Translation Wizard This wizard generates and inserts a set of either map or hide packet rules statements. Depending on what type of rules you want to configure, these wizards create all of the required filter and network address translation (NAT) statements for you. You can access the wizards from the Wizards menu in the Packet Rules Editor. If you prefer to write the rules yourself, continue to the next item in the checklist.
__	Define addresses and services by creating aliases for the addresses and services for which you plan to create multiple rules. You must define addresses if you want to create NAT rules.
__	Create NAT rules. Perform this task only if you plan to use NAT.
__	Create filter rules to define what filters to apply to the network that this system administrates.
__	Specify any additional files that you want to include in your master rules file. Complete this task only if you have existing rules files that you want to reuse in a new rules file.
__	Define the interfaces by applying your rules.
__	Make comments to describe what each rules file does.
__	Verify your rules files to ensure that your rules will be activated error free and without problems.
__	Activate your rules file. Packet rules must be activated in order for them to work.
__	Manage packet rules. After you have activated your packet rules, manage them periodically to maintain the security of your system.

1. Accessing the packet rules editor
   You can use the Packet Rules Editor to start creating packet rules on your system. You can create a new file, edit an existing one, or you can work with the sample files provided on the system.
2. Defining addresses and services
   When you create packet rules, specify the IP addresses and services to which you want the rules to apply.
3. Creating NAT rules
   You must define the nicknames for the IP addresses you intend to use if you want to use network address translation (NAT).
4. Creating IP filter rules
   When you create a filter, you specify a rule that governs the IP traffic flow into and out of your system.
5. Defining IP filter interfaces
   You can define filter interfaces to establish the filter rules that you want the system to apply to each interface.
6. Including files in packet rules
   By using the Include feature of the Packet Rules Editor, you can activate more than one packet rules file on your system.
7. Adding comments in the packet rules
   You can record how you intend your rules to work by adding comments about your rules files.
8. Verifying packet rules
   You always need to verify your rules before you activate them. This ensures that the rules can be activated without problems.
9. Activating packet rules
   Activating the packet rules that you create is the final step in configuring packet rules.

 

Parent topic:

IP filtering and network address translation