Re: IP filtering

[Ken Sims <mr3111@xxxxxxxxx>]

Hi Steve -

> I guess it *is* IP forwarding . . .
 <snip>
> We are trying to open up an existing intranet site to Internet access.
 <snip>
> The corporate guys are not amenable to direct access to our
> production iSeries through our firewall so, in an effort to appease them, we
> came up with the front-end iSeries (a 170 which used to be our D/R box) on
> which all ports except 80 are shut off and which passes HTTP to our
> production system and returns the results to the requestor.  The config of t
> he front-end system fell to me and I've not been very successful so far
> (unfortunately).

Unless you are just passing the port 80 packets through untouched except to 
accept or reject each packet, what you want is NOT ip forwarding nor ip 
filtering.

As I mentioned in a previous message, if you want the first iSeries to 
actually read the HTTP request and then pass it on to the second iSeries 
(possibly after doing some validation or something), then it is acting as a 
proxy.

A proxy can be on the same subnet as the machine it is proxying 
for.  Normally it wouldn't be that way, but for your proof-of-concept it is 
fine.

Even IP forwarding can be done on the same subnet though it's rather 
pointless.  (Speaking strictly from an IP point of view; I don't know if an 
iSeries system could actually be configured to do that, but other systems can.)

--
Ken
http://www.ke9nr.net/
Opinions expressed are my own and do not necessarily represent the views of 
my employer or anyone in their right mind.