Filter Rules

For each client connection, Enterprise Server scans the rules specified for the endpoint, if there are any, and the rules for the communications process and server, if any. Each of the rules which match the client's IP address, or its fully qualified hostname, if there are any hostname rules, are ranked based on how well the rule matches. A rule with no wildcards and matches is an exact match and overrides any rule containing wildcards. Rules with wildcards are ranked based on how many characters the wildcard replaces; fewer replaced characters means a closer, or more exact match.

For example, if the client's IP address is 192.168.1.100, then for the following rules:

deny:**

This would match with rank 14.

allow:192.168.2.*

This would not match.

allow:192.168.1.*

This would match with rank 4.

Note: Lower rank is a closer match.

deny:192.168.1.100

This would be an exact match, or rank 0.

The result would be that the last rule would be applied to the client and the connection would be denied (blocked).

You can configure rules using Enterprise Server Administration Web interface. Specify the rules in the Configuration Information field, in any or all of the following locations:

• The Server page (c000), on the General tab:
  1. On the Enterprise Server Administration home page, click Edit in the row that corresponds to the region you want the rules to apply to.
  2. Click the General tab.
  3. In the Configuration Information field, type the filter rules you want to apply.
  4. Click Apply.
• The Listener page for the communications process control listener (c400). This is the first listener listed on the Listeners tab for each communications process:
  Note: Rules configured here apply to all listeners in the communications process.
  1. On the Enterprise Server Administration home page, click Details in the Communication Process cell for the region whose communication process you want the rules to apply to.

     This opens the Listeners page.

  2. Click Edit, in the top left cell.
     Note: Most servers only have a single communications process.

     This opens the Communications Process page.

  3. In the Configuration Information field, type the filter rules you want to apply.
  4. Click OK.
• The Listener page for each individual listener (l301):
  1. On the Enterprise Server Administration home page, click Details in the Communication Process cell for the region that owns the listener you want the rules to apply to.

     This opens the Listeners page.

  2. In the Listeners column, click Edit that correspond to the listener you want the rules to apply to.
  3. In the Configuration Information field, type the rules to apply to the listeners.
  4. Click Apply.
  5. Click OK.

In the Configuration Information field, add the [Connection rules] section header if it does not already exist, and then type your rules. One rule per line. Comments can be added after a hash "#" and can go to the end of the line. Blank lines are also permitted.

The rule options in the connection rules section:

[Connection rules]
action:source[:options]

where:

action

Can be allow or deny.

source

Specifies which clients the rule applies to, described below.

options

Optional - Currently the only option is log, which causes additional logging when the rule applies to a client connection.

The source has three possible forms, which can include the wildcards "*" and "**". The "*" wildcard matches zero or more characters but not the "." character; the "**" wildcard matches anything, including ".". The source forms are:

• IPv4 address, for example, 192.168.1.2 or 192.**.
• IPv6 address, for example 2600:1405:1000::17d0:8c09, ::1, or 2600:1405:*.
  Note: IPv6 addresses do not use the "." character, so the "**" wildcard does not need to be used with them.
• IPv4 CIDR network address, for example, 192.168.1.0/24 or 10/8. Any valid CIDR network length can be used, and trailing 0 octets can be omitted as in the second example.
• Fully-qualified DNS name, for example, *.microfocus.com.