Search <book_title>...

Veritas Access Appliance Administrator's Guide

Last Published: 2023-10-29

Product(s): Appliances (8.0)

Platform: Access Appliance OS,Veritas 3340,Veritas 3350

Changing the firewall settings

The network firewall commands are used to view or change the firewall settings.

To display the current firewall status

To display whether the current firewall status is enabled or disabled, enter the following:
```
Network> firewall status
Firewall status : DISABLED
```

To enable the firewall setting

To enable the firewall setting to allow specific IPs to connect to the ports while blocking the other connections, enter the following:
```
Network> firewall enable
ACCESS net INFO V-288-0 Firewall successfully enabled
```

To disable the firewall setting

To disable the firewall setting and allow connections on any port from any IP, enter the following:
```
Network> firewall disable
It is not advisable to disable firewall. Do you want you continue (y/n): y
ACCESS net INFO V-288-0 Firewall successfully disabled
```
The applied rules do not work when the firewall setting is disabled.

To display the list of firewall rules

To display the list the firewall rules set on the cluster nodes by the user, enter the following:

Network> firewall rule list
iptype   filter   interface   client   protocols   sport   dport   match_state
=======  =======  ==========  =======  ==========  ======  ======  ============
ipv4     INPUT    pubeth0     ALL      tcp         101     102     NEW
ipv6     INPUT    pubeth0     ALL      tcp         101     102     NEW
ipv4     INPUT    pubeth0     ALL      udp         101     102     NEW
ipv6     INPUT    pubeth0     ALL      udp         101     102     NEW
ipv4     INPUT    pubeth1     ALL      tcp         101     102     NEW
ipv6     INPUT    pubeth1     ALL      tcp         101     102     NEW
ipv4     INPUT    pubeth1     ALL      udp         101     102     NEW
ipv6     INPUT    pubeth1     ALL      udp         101     102     NEW
ipv4     INPUT    pubeth2     ALL      tcp         101     102     NEW
ipv6     INPUT    pubeth2     ALL      tcp         101     102     NEW
ipv4     INPUT    pubeth2     ALL      udp         101     102     NEW
ipv6     INPUT    pubeth2     ALL      udp         101     102     NEW
ipv4     INPUT    pubeth3     ALL      tcp         101     102     NEW
ipv6     INPUT    pubeth3     ALL      tcp         101     102     NEW
ipv4     INPUT    pubeth3     ALL      udp         101     102     NEW
ipv6     INPUT    pubeth3     ALL      udp         101     102     NEW

To add a firewall rule

To add the iptable rule in the current iptable configuration, enter the following:

Network> firewall rule add iptype flter interface 
client protocols [sport] [dport] [match_state]

iptype	Specifies the network IP type. Allowed values are ipv4/ ipv6/ ipv4,ipv6.
filter	Specifies the iptable chain filter type. Allowed values are INPUT or OUTPUT
interface	Specifies the name of the network interface by which the packet will be received. If you enter ALL , an iptable entry is added for all public interfaces which are in control of the product.
client	Specifies the source IP from which the packet is received. ALL should be entered to apply the rule to all sources.
protocols	Specifies the protocol. Allowed values are tcp, udp, icmp and tcp,udp. When (tcp,udp) is given, two separate rules will be added, one for each protocol.
sport	Specifies the port through which the packet leaves the machine. The ALL option applies the rule to all the ports. NONE option is used to unspecify a port or enter specific port number. Note: sport and dport cannot both have NONE value at the same time.
dport	Specifies the port through which the packet is received. The ALL option applies the rule to all the ports. NONE option is used to unspecify a port or enter specific port number. Note: sport and dport cannot both have NONE value at the same time.
match_state	Specifies the match state for the connection. Enter NONE if you do not want to specify any state. Match state can be NEW/ ESTABLISHED/ RELATED.

To remove a firewall rule

To remove the rule from the current iptable configuration, enter the following:

Network> firewall rule remove iptype flter	interface 
client	protocols [sport] [dport] [match_state]