Modifying a Firewall Rule for Incoming Activity by IPv6 Addresses

To modify an existing rule for filtering incoming activity by IPv6 address, enter 1 in the Opt field for the rule in the Dynamic Filtering - Incoming IPv6 Address Security screen, shown in Setting Firewall Rules for Incoming Activity by IPv6 Addresses (STRFW > 2 > 2).

The Dynamic Filtering - Modify Incoming IPv6 Address screen appears:

​                ​ Dynamic Filtering- Modify Incoming IPv6 Address​                
                                                                                
​
 Type choices, press Enter.                                                    ​ 
                                                                                
​
 IPv6 Address  . . . . .​ ​ 2001:CF8:2:5D11:3440:B5FF:FE8D:1              ​        
​
 Address prefix length .​ ​ 128​                             ​ 1-128​                
​
 Text  . . . . . . . . .​ ​                               ​                        
                                                                                
​
                        ​ FTP/ ​ ​ Tel-​ ​ DB ​ ​ TCP ​                                 
                        ​
 REXEC​ ​ net ​ ​ Srv​ ​ SGN ​ ​ DDM​                            
​
 Secure value. . . . . .​  ​ Y​    ​ Y​    ​  ​   ​ Y​    ​ Y​       ​ Y=Yes, S=SSL only​    
                                                          ​
 A=Skip checks     ​   
                         ​
 Rmt​  ​ Fil​                       ​ B=SSL+Skip checks ​   
                         ​
 Srv​  ​ Srv​                       ​ L=Skip checks+Log ​   
                          ​
 Y​    ​ Y​                        ​ M=SSL+Skip checks+Log
​
 Equivalent IP range:   ​                                                        
 ​
 IP from:​ ​ 2001:0CF8:0002:5D11:3440:B5FF:FE8D:0001 ​                            
 ​
 IP to  :​ ​ 2001:0CF8:0002:5D11:3440:B5FF:FE8D:0001 ​                            
                                                                                
​
 SQL statments are not parsed when checks are skipped or rejected.​              
​
 FTP=FTPLOG, REXLOG. DDM=DDM, DRDA. DB Srv=SQLENT, SQL, NDB, OBJINF.​            
                                                                                
​
 F3=Exit​                                             ​ F12=Cancel​                
​
                                                                                
​

Enter or modify information in the following fields:

IPv6 Address

The IPv6 address for the range of addresses. In addition to an IPv6 address, you can set this field to *ALL for rules applied to all IPv6 ranges that aren't otherwise specified.

Address prefix length

The length of the IPv6 address prefix. This can be set to from 1-128.

Text

A free-form text description of the IPv6 address range.

Secure value

A letter or blank space showing how the rule handles incoming activity for that address range for the protocol indicated by the label above the column. The protocols include:

  • FTP/REXLOG including FTPLOG and REXLOG
  • TELNET for TELNET connections
  • DB Srv including SQLENT, SQL, NDB, and OBJINF.
  • TCP SGN, the TCP Sign-On Server
  • DDM including DRDA
  • Rmt Srv, for Remote Program/Command Call
  • Fil Srv, for File Server

The possible values are:

  • Blank or N: Reject all incoming activity
  • S: Allow activity, but do not log this
  • Y: Allow activity
In many situations, you can dramatically improve performance by using options B or L. For example, you might use them when an IP address that you know to be well secured and is using SSL, and which doesn't require checking the SQL statements, sends a high volume of requests.