topic Re: Blocking specific IP's in Operating System - OpenVMS

Blocking specific IP's

robert70 — Wed, 12 Nov 2008 11:08:34 GMT

Hi, We are trying to setup a block to a specific workstation in our office. blocking everything eg FTP, TELNET, SQLPLUS
what is the TCPIP commands to enable this?
many thanks

Re: Blocking specific IP's

Volker Halle — Wed, 12 Nov 2008 11:45:49 GMT

Robert,

which TCPIP stack are you using ?

For HP TCP/IP, you can reject connections from specific host at the TCPIP service level, e.g.

TCPIP> set service ftp/reject=(specific-host-ip)

Volker.

Re: Blocking specific IP's

marsh_1 — Wed, 12 Nov 2008 11:46:05 GMT

robert,

try this :-
$ tcpip
tcpip> disable serv ftp
tcpip> set serv ftp/reject=hosts=(nnn.nnn.nnn.nnn)
tcpip> enable serv ftp

do for each service required

good luck

Re: Blocking specific IP's

Volker Halle — Wed, 12 Nov 2008 11:48:12 GMT

Robert,

sorry, Mark's example is correct, mine isn't. You need to specify /REJECT=HOST=xxx

Volker.

Re: Blocking specific IP's

Thomas Ritter — Wed, 12 Nov 2008 12:06:34 GMT

Does the workstation have a fixed IP ? Most use DHCP.

Re: Blocking specific IP's

robert70 — Wed, 12 Nov 2008 12:24:31 GMT

the station will have a fixed Ip i think
also any thing else required for specific Oracle9 connections using sqlplus strings at the dollar promt on the pc?

Re: Blocking specific IP's

Wim Van den Wyngaert — Wed, 12 Nov 2008 12:57:12 GMT

I assume that all communications must be disabled.

Then use set [conf] comm/reject=host=
(with conf after set when perm db must be modified).

Wim

Re: Blocking specific IP's

Hoff — Wed, 12 Nov 2008 12:59:52 GMT

OpenVMS doesn't include a firewall, though the roadmap indicates that is planned.

You can hack around that with various commands and such (and for specific IP hosts), but for lower-level IP traffic a decent consumer or "pro-sumer" grade firewall (or M0n0wall or Smoothwall) will likely work just fine for this task.

As for what ports Oracle uses, check the Oracle documentation. That stuff can vary, though most any vendor that needs IP ports will document that. (Google with the site keyword (eg: site:oracle.com) can be very handy for finding this detail.)

The other approach here is to use a VLAN construct. Most mid-grade managed network switches can provide this capability, and this is ideal for isolating network traffic. (Which reminds me: various managed network switches can also provide firewall capabilities.)

Here's a more general write-up on using a firewall with OpenVMS, and why I recommend it to my customers:

http://64.223.189.234/node/621

Stephen Hoffman
HoffmanLabs LLC

Re: Blocking specific IP's

Wim Van den Wyngaert — Thu, 13 Nov 2008 11:02:14 GMT

The solution I posted blocks all traffic, also Oracle.

Wim

Re: Blocking specific IP's

robert70 — Thu, 13 Nov 2008 15:36:26 GMT

thanks all
all working well now