netrule Command
Purpose
Adds, removes, lists, or queries rules, flags and security labels for interfaces and hosts.
Syntax
netrule hq { i | o } src_host_rule_specification dst_host_rule_specification
netrule h- [ i | o ][u] [ src_host_rule_specification dst_host_rule_specification ]
netrule h+ { i | o } [ u ] src_host_rule_specification dst_host_rule_specification [ flags ][ RIPSO/CIPSO options ] security_label_information
netrule i+ [ u ] interface [ flags ][ RIPSO/CIPSO options ] security_label_information
Description
The netrule command lists, queries, adds and removes rule specifications for interfaces and hosts. The system default interface rules are set using the interface name. When an interface is removed using the i- flag, it will be given these default interface rules. The default interface rules are also set using the tninit load command.
Flags
Item | Description |
---|---|
e { on | off } | Sets the policy for sending the ICMP error response to incoming packets that are not accepted by the system. This setting is off by default and must be set with this flag to be on. You cannot specify the e flag when you specify the h or i flag. |
h | Specifies that the object of the netrule command is a host. You cannot specify the h flag when you specify the i or e flag. |
i | Specifies that the object of the netrule command is an interface. You cannot specify the i flag when you specify the h or e flag. |
l | Lists all rules for interfaces or hosts. |
o | Specifies the host out rules (for host rule only). |
q | Queries an interface, a host rule, or the status of the error response setting. |
u | Specifies that the /etc/security/rules.host and /etc/security/rules.int files will be updated after the host or interface rule is successfully added or removed. |
+ | Adds an interface or a host rule. |
- | Removes an interface or a host rule. |
interface | Specifies an interface name. |
src_host_rule_specification | This parameter takes the following format: Requirement: There is a space or tab in between
each field.
|
dst_host_rule_specification | This parameter takes the following format: Requirement: There is a space or tab in between
each field.
|
flags | This parameter takes the following format:
|
RIPSO/CIPSO options | This parameter takes the following format:
|
security_label_information | This parameter takes the following format:
|
Security
A user must have the aix.mls.network.config and the aix.mls.network.init authorizations to run the netrule command.
Examples
- To add in host rule, and update the local database after in host
rule is successfully added to kernel, enter:
netrule h+iu 9.3.149.25 9.41.86.19 +impl_lo +ts all +pub
- To add out host rule, enter:
netrule h+o 9.41.86.19 9.3.149.25 -s /tmp/rule
or:
impl_lo ts all pub
The following are the contents of the input /tmp/rule file:impl_lo ts \ all pub
- To drop all incoming UDP packets from a host, enter:
netrule h+i 192.0.0.5 =udp 9.41.86.19 =udp -dr +impl_lo +impl_lo +impl_lo
- To remove all host rules and update the local, enter:
netrule h-u
- To list all host rules, enter:
netrule hl
- To list all interface rules, enter:
netrule il
- To add an interface rule, enter:
netrule i+ en0 -dn -fa:n +public +ts +secret
- To remove a particular host rule, enter:
netrule h-i 192.0.0.5 =udp 9.41.86.19 =udp
- To add a particular host rule, enter:
netrule h+i 9.41.86.19 /24 =tcp :ftp :telnet 9.3.149.6 /28 +public +ts +secret
- To set the default interface rule, enter:
netrule i+ default -dn -fa:n +impl_lo +ts all +impl_lo
- To set the default interface rule to the system drop-all-packets
default, enter:
netrule i- default
- To set the interface to send and only receive CIPSO packets, enter:
netrule i+ en0 -fc:c +impl_lo +ts all +impl_lo
- To set the interface to receive either CIPSO or RIPSO packets
and send RIPSO packets with PAF values, a CIPSO DOI, and CIPSO flags,
enter:
netrule i+ en0 -fe:r -rpafs=SCI,NSA+DOE -epaf=SCI -tpaf=NSA -DOI=0x010 -tags=1,2 +impl_lo +ts all +impl_lo
- To set the system-wide policy for sending ICMP responses on incoming
packets that are not valid, enter:
netrule e on