Download Mac OS X Server Network Services Administration

To create an IP filter for TCP ports:
1 In Server Admin, choose Firewall from the Computers & Services list.
2 Click Settings.
3 Select the Advanced tab.
4 Click the New button.
Alternatively, you can select a rule similar to the one you want to create, and click
Duplicate then Edit.
Step 5: Save firewall service changes
Once you have configured your filters and determined which services to allow, save
your changes so the new settings take effect.
Important: If you add or change a filter after starting firewall service, the new filter
will affect connections already established with the server. For example, if you deny
all access to your FTP server after starting firewall service, computers already
connected to your FTP server will be disconnected.
5 Select whether this filter will allow or deny access in the Action pop-up menu.
6 Choose TCP from the Protocol pop-up menu.
Managing Firewall Service
7 Choose a TCP service from the pop-up menu.
This section gives step-by-step instructions for starting, stopping, and configuring
firewall address groups and filters.
If you want to select a nonstandard service port, choose Other.
8 If desired, choose to log packets that match the filter.
Starting and Stopping Firewall Service
9 Enter the Source IP address range you want to filter.
By default, firewall service blocks all incoming TCP connections and allows all UDP
connections. Before you turn on firewall service, make sure you’ve set up filters
allowing access from IP addresses you choose. Otherwise, no one will have access to
your server.
If you want it to apply to any address, choose Any from the pop-up menu.
If you have selected a nonstandard service port, enter the source port number.
10 Enter the Destination IP address range you want to filter.
If you want it to apply to any address, choose Any from the pop-up menu.
If you have selected a nonstandard service port, enter the source port number.
11 Choose which network interface this filter applies to.
12 Click OK.
13 Click Save to apply the filter immediately.
Creating an Advanced IP Filter for UDP Ports
You can use the Advanced Settings pane to configure very specific filters for UDP
ports. Many services use User Datagram Protocol (UDP) to communicate with the
server. By default, all UDP connections are allowed. You should apply filters to UDP
ports sparingly, if at all, because “deny” filters could create severe congestion in your
server traffic.
If you filter UDP ports, don’t select the “Log all allowed packets” option in the filter
configuration windows in Server Admin. Since UDP is a “connectionless” protocol, every
packet to a UDP port will be logged if you select this option.
You should also allow UDP port access for specific services, including:
•
•
•
•
52
DNS
DHCP
SLP
Windows Name Service browsing
Chapter 3 IP Firewall Service
Important: If you add or change a filter after starting firewall service, the new filter
will affect connections already established with the server. For example, if you deny
all access to your FTP server after starting firewall service, computers already
connected to your FTP server will be disconnected.
To start or stop firewall service:
1 In Server Admin, choose Firewall from the Computers & Services list.
2 Click Start Firewall.
When the service is started, the Stop Service button is available.
Opening the Firewall for Standard Services
By default, firewall service blocks all incoming TCP connections and allows all UDP
connections. Before you turn on firewall service, make sure you’ve set up filters
allowing access from IP addresses you choose; otherwise, no one will have access to
your server.
You can easily allow standard services through the firewall without advanced and
extensive configuration. Standard services include (but are not limited to):
•
•
•
•
•
Web service
Apple File service
Windows File service
FTP service
Printer Sharing
Chapter 3 IP Firewall Service
49