Although the z/OS operating system is not an ideal operating system to run as a routing host, it does have the capability of running fully functional firewall filtering rules.

In z/OS, IP filtering rules are activated using the policy agent. Packets can be permitted or denied based upon source, destination, or port number. Probably the best usage of IP filters on z/OS would be as a secondary line of defense: if a boundary firewall has been compromised, the IP filters on z/OS could form another hurdle to a potential hacker.