Fujitsu PRIMEQUEST 1000 Series Installation Manual page 165

PRIMEQUEST 1000 Series Installation Manual
CHAPTER 6 Work after Operating System Installation (PRIMEQUEST 1800E)
MMLAN all
Chain FORWARD (policy DROP)
target prot
Chain OUTPUT (policy DROP)
target prot
MMLAN all
Chain MMLAN (2 references)
target prot
ACCEPT udp
ACCEPT udp
ACCEPT udp
ACCEPT udp
ACCEPT udp
ACCEPT udp
ACCEPT udp
ACCEPT udp
Note
After changing the IP address of the management LAN interface, delete the settings once, and set their values
again. For details on how to delete the settings, see (7) Configuration deletion procedure in 4.11 Firewall
Setting Command for the Management LAN Interface (setmlanfw.sh) in the PRIMEQUEST 1000 Series Tool
Reference (C122-E110EN).
[For PSA version 2.6 or later]
Add the "MMLAN" setting chain to INPUT and OUTPUT chains. At this time, take care to prevent
interruptions by an existing REJECT setting in an INPUT or OUTPUT chain or by a user definition chain.
Example: REJECT setting in INPUT and FORWARD
# iptables –L
Chain INPUT (policy ACCEPT)
target prot
ACCEPT all
ACCEPT icmp
ACCEPT all
ACCEPT tcp
REJECT all
prohibited
Chain FORWARD (policy ACCEPT)
target prot
REJECT all
prohibited
-- 0.0.0.0/0
opt source
opt source
-- 0.0.0.0/0
opt source
-- 192.168.0.0/24
-- 192.168.0.1
-- 192.168.0.0/24
-- 192.168.0.1
-- 192.168.1.5
-- 192.168.0.1
-- 192.168.1.5
-- 192.168.0.1
opt source destination
-- 0.0.0.0/0 0.0.0.0/0
-- 0.0.0.0/0 0.0.0.0/0
-- 0.0.0.0/0 0.0.0.0/0
-- 0.0.0.0/0 0.0.0.0/0
-- 0.0.0.0/0 0.0.0.0/0
opt source destination
-- 0.0.0.0/0 0.0.0.0/0
0.0.0.0/0
destination
destination
0.0.0.0/0
destination
192.168.0.1
192.168.0.0/24
192.168.0.1
192.168.0.0/24
192.168.0.1
192.168.1.5
192.168.0.1
192.168.1.5
state RELATED,ESTABLISHED
state NEW tcp dpt:22
reject-with icmp-host-
reject-with icmp-host-
137
udp dpts:7000:7100
udp spts:7000:7100
udp dpt:162
udp spt:162
udp dpts:7000:7100
udp spts:7000:7100
udp dpt:162
udp spt:162
C122-E107-09EN