vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* JavaScript challenge (Defense mode)



For example, if you notice that a particular IP is causing malicious requests, you can block that user by IP address.

IP rules apply to TCP, HTTP, and HTTPS [Range](https://cloud.ibm.com/docs/cis?topic=cis-cis-range) apps, because IP rules are applied to Open System Interconnection (OSI) Layer 3 and Layer 4.





 User-agent blocking rules 

With User-agent blocking rules, you can act on any user-agent string you select. This capability works like domain lockdown, except that the block examines the incoming user-agent string instead of the IP. You can choose how to handle a matching request with the same list of actions that you established in the IP rules (block, challenge, and JS challenge). User-agent blocking applies to your entire zone. You cannot specify subdomains in the same manner as you can with a domain lockdown.

This tool is useful for blocking any user-agent strings that you deem suspicious.





 Domain lockdown 

By using Domain lockdown, you can allowlist specific IP addresses and IP ranges, such that all other IPs are blocklisted. Domain lockdown supports the following items.



* Specific subdomains - For example, you can allow IP 1.2.3.4 access to the domain foo.example.com and allow IP 5.6.7.8 access to domain bar.example.com, without allowing the reverse.
* Specific URLs - For example, you can allow IP 1.2.3.4 access to directory example.com/foo/ and allow IP 5.6.7.8 access to directory example.com/bar/, but not allow the reverse.



This capability is useful when you need more granularity in your access rules because, with IP rules, you can either apply the block to all subdomains of the current domain, or all domains on your account. You cannot specify URIs.







 Firewall rules 

Create rules that examine incoming HTTP traffic against a set of filters to block, challenge, log, or allow matching requests.
(Primary Private Subnet 1102/Storage)
set firewall group network-group 1102STORAGEA network ... (Portable Private Subnet 1102/Storage Path A)
set firewall group network-group 1102STORAGEB network ... (Portable Private Subnet 1102/Storage Path B)
set firewall group network-group 1103VMACCESS network ... (Portable Private Subnet 1103/Virtual Machines)
commit
save
Show more





 Configuring firewall name rules 

Define the firewall rules for each direction of traffic.

Use the following commands in configure mode:

set firewall name INSIDE2OUTSIDE
set firewall name INSIDE2OUTSIDE default-action drop
set firewall name INSIDE2OUTSIDE rule 10 action accept
set firewall name INSIDE2OUTSIDE rule 10 protocol all
set firewall name INSIDE2OUTSIDE rule 10 source group network-group 1101MGMT
set firewall name INSIDE2OUTSIDE rule 20 action accept
set firewall name INSIDE2OUTSIDE rule 20 protocol all
set firewall name INSIDE2OUTSIDE rule 20 source group network-group 1103VMACCESS
set firewall name OUTSIDE2INSIDE
set firewall name OUTSIDE2INSIDE default-action drop
set firewall name OUTSIDE2INSIDE rule 10 action accept
set firewall name OUTSIDE2INSIDE rule 10 protocol udp
set firewall name OUTSIDE2INSIDE rule 20 action accept
set firewall name OUTSIDE2INSIDE rule 20 protocol udp
set firewall name OUTSIDE2INSIDE rule 20 destination port 4500
set firewall name OUTSIDE2INSIDE rule 30 action accept
set firewall name OUTSIDE2INSIDE rule 30 protocol udp
set firewall name OUTSIDE2INSIDE rule 30 destination port 500
set firewall name OUTSIDE2INSIDE rule 40 action accept
set firewall name OUTSIDE2INSIDE rule 40 ipsec match-ipsec
set firewall name OUTSIDE2INSIDE rule 50 action accept
set firewall name OUTSIDE2INSIDE rule 50 protocol gre
set firewall name OUTSIDE2INSIDE rule 60 action accept
set firewall name OUTSIDE2INSIDE rule 60 protocol tcp
type = "ipAddress"
value = "202.38.89.897"
}
name = "an example of zone"
}







 Creating rules 

Define restrictions to your cloud resources by creating rules.

To create a rule, complete the following steps.



1. In the IBM Cloud console, click Manage > Context-based restrictions, and select Rules.
2. Click Create.
3. Select the service that you want to target in your rule. Then, click Next.

When you create context-based restriction for the IAM Access Groups service, users who don't satisfy the rule can't view any groups in the account, including the public access group.
4. (Optional) Select the scope of APIs whose operations are restricted by your rule. For more information, see [Defining the scope of a rule](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis&interface=uirule-scope).

Not all services support the ability to scope a rule by API.
5. Scope the restriction to All resources or Specific resources based on selected attributes.
6. Click Review > Continue.
7. Add one or more contexts. Select endpoint types and network zones, and click Add.



* By default, access is allowed from all service-supported endpoint types when the toggle is set to No. Set the toggle to Yes to allow only specific endpoint types.



If you want to allow access from a VPC to public endpoints in your rule, include any public gateway IP addresses in the zone definition along with the VPC.



* You can add existing network zones to your rule or create new zones to add to your rule. For more information, see [Creating network zones](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-createnetwork-zones-create).



8. Click Continue.
9. Provide a unique description.
10. Select how you want to enforce the rule.
Rule 5: DNS-1 (allow)
Rule 6: 0.0.0.0/0 (deny)

The new rule is added as an allow rule (Rule 5).







 Allowing connections only from on premises and take backups, load or unload data by using Cloud Object Store 

If you want applications or users only from their on-premises network to connect to their Netezza Performance Server database, follow these steps.



1. Use a public NAT gateway.

The on-premises network is a private enterprise network, which uses a private IP address space. If the applications and users want to connect to services outside the on-premises network, they must use a public NAT gateway.

The public NAT gateway has interfaces with public IP addresses in a range that is represented by CIDR-1 and replaces the source IP address of the instances in the enterprise network with one of the public IP address of the NAT gateway.

As a result, external applications see all the traffic that comes from one of the public interfaces of the NAT gateway that is represented by CIDR-1.
2. Add CIDR-1 as an allow rule (Rule 1).

Rule 1: CIDR-1 (allow)
3. Add a deny all rule (Rule 2) to restrict connections that originate only from the on-premises network.

Rule 1: CIDR-1    (allow)
Rule 2: 0.0.0.0/0 (deny)
4. Make connections from the database to the respective Cloud Object Store endpoints (such as AWS S3 and Azure Blob Storage).

You must add endpoints to the allows list if you want your database admins to back up data to Cloud Object Store and developers to use external tables in applications to load and unload data.





 Adding AWS S3 endpoint to network allow policies 

If you have a bucket, for example, in the us-east-1 region and want to use it for backups and loading and unloading of external tables, follow these steps.



1. Provide the CIDR range that represents the complete IP address range that is associated with the S3 endpoint.

To retrieve the CIDR ranges that are used by the S3 endpoints in a particular AWS region:
Managing permissions 

To view and manage your FortiGate Security Appliance (FSA) 10 Gbps firewalls you need the correct permissions. After your account administrator grants your user account permissions and access, you can view your FSA 10 Gbps firewall details by using the IBM Cloud® console, or by using the SoftLayer API. The information or actions that you see depend on your permissions.

The following permissions are required for viewing and managing various parts of your FSA 10 Gbps firewalls:



*  Manage firewalls - Allows you to view your list of firewalls. It also allows you to view and manage the details of a specific firewall.
*  Manage network gateways - Allows you to view your list of FSA 10 Gbps firewalls. It also allows you to view and manage the details of a specific FSA 10 Gbps firewall.
*  Cancel services - Allows you to cancel a firewall.





  Adding permissions for your users 

If you are the account administrator and you want to grant a user permission to view and manage gateway appliance details, complete the following steps.



1.  Log in to the [Access (IAM)](https://cloud.ibm.com/iam/users) page in the IBM Cloud® console.
2.  Select View: My classic infrastructure users.
3.  Select a user, click the Classic infrastructure tab, then click the Permissions tab.
4.  Expand the Devices category and select Manage firewalls.
5.  Expand the Network category and select Manage network gateways.
6.  Expand the Account category and select Cancel services.
7.  Click Apply.







  Next steps 

User permissions are updated immediately after the changes are submitted. If permissions are granted, the user can view or interact with the selected features. If permissions are removed, the user can no longer view or interact with the selected features. Permissions can be updated again at any time.
ibmcloud cis firewall-rules 31984fea73a15b45779fa0df4ef62f9b -i "cis-demo"
<-- </section "id="section-list-firewall-rules-examples" "> --><-- </section "id="section-list-firewall-rules" "> --><-- <section "id="section-show-a-firewall-rule" "> --> ibmcloud cis firewall-rule Retrieve a specific firewall-rule for a given DNS domain. ibmcloud cis firewall-rule DNS_DOMAIN_ID FIREWALL_RULE_ID -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
<-- <section "id="section-show-a-firewall-rule-options" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.FIREWALL_RULE_ID: The ID of firewall-rule. Required.-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-show-a-firewall-rule-options" "> --><-- <section "id="section-show-a-firewall-rule-examples" "> --> Examples Get the details of firewall-rule 372e67954025e0ba6aaa6d586b9e0b60. ibmcloud cis firewall-rule 31984fea73a15b45779fa0df4ef62f9b 372e67954025e0ba6aaa6d586b9e0b60 -i "cis-demo"
A user must also have either the Editor or Administrator role on the context-based restrictions service to create, update, or delete network zones. A user with the Viewer role on the context-based restrictions service can add only network zones to a rule.

Any IBM Cloud Activity Tracker or audit log events that are generated come from the context-based restrictions service, not Secrets Manager. For more information, see [Monitoring context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-cbr-monitor).

To get started with protecting your Secrets Manager resources with context-based restrictions, see the tutorial for [Leveraging context-based restrictions to secure your resources](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-tutorial).





 How Secrets Manager integrates with context-based restrictions 

To restrict access, you must create [zones](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create&interface=uinetwork-zones-create) and [rules](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create&interface=uicontext-restrictions-create-rules).

First, create a zone with the appropriate details for network or resource definitions. Then, attach that zone to the specified resource to restrict access. You can create zones and rules by using a RESTful [API](https://cloud.ibm.com/apidocs/context-based-restrictionsintroduction) or with [context-based restrictions](https://cloud.ibm.com/context-based-restrictions/overview). After you create or update a zone or a rule, it might take a few minutes for the change to take effect.

CBR rules do not apply to provisioning or deprovision processes.





 Limitations 

When a user has instance level IAM access, CBR rules that are applied to specific secret groups do not take effect. To work around this limitation, set the user's IAM access policies to only secret groups.
For more information, see [Add an Edge Services Gateway](https://docs.vmware.com/en/VMware-NSX-Data-Center-for-vSphere/6.4/com.vmware.nsx.install.doc/GUID-B9A97F20-4996-4E16-822C-0B98DDE70571.html). 
 Configure NSX edge firewall rules An edge firewall monitors North-South traffic to provide perimeter security functions, including firewall, Network Address Translation (NAT), and site-to-site IPsec and SSL VPN. Only the firewall rules on management and uplink interfaces are applicable. For more information, see [Working with NSX Edge firewall rules](https://docs.vmware.com/en/VMware-NSX-Data-Center-for-vSphere/6.4/com.vmware.nsx.admin.doc/GUID-178B11B8-FEB1-49B8-B6FF-D069C41EEB32.html). 
 Distributed firewall The distributed firewall is a hypervisor kernel-embedded firewall that provides network access control for VMs. You create access control policies based on VMware vCenter objects like: data centers, cluster, VM names, IP, VLAN (DVS port-groups), VXLAN (logical switches), security groups, and user group identity from Active Directory. Firewall rules are enforced at the vNIC level of each VM to provide consistent access control even when the VM gets vMotioned. For more information, see [Distributed firewall](https://docs.vmware.com/en/VMware-NSX-Data-Center-for-vSphere/6.4/com.vmware.nsx.admin.doc/GUID-95600C1C-FE9A-4652-821B-5BCFE2FD8AFB.html).
set security firewall name APP-TO-OUTSIDE rule 100 action accept
set security firewall name APP-TO-OUTSIDE rule 100 destination port 443

set security firewall name APP-TO-OUTSIDE rule 200 protocol icmp
set security firewall name APP-TO-OUTSIDE rule 200 icmp type 8
set security firewall name APP-TO-OUTSIDE rule 200 action accept
commit
Show more
2. Create firewall rules OUTSIDE-TO-APP

set security firewall name OUTSIDE-TO-APP default-action drop
set security firewall name OUTSIDE-TO-APP description 'Internet traffic to APP'
set security firewall name OUTSIDE-TO-APP default-log

set security firewall name OUTSIDE-TO-APP rule 100 protocol tcp
set security firewall name OUTSIDE-TO-APP rule 100 action accept
set security firewall name OUTSIDE-TO-APP rule 100 destination port 443

set security firewall name OUTSIDE-TO-APP rule 90 protocol tcp
set security firewall name OUTSIDE-TO-APP rule 90 action accept
set security firewall name OUTSIDE-TO-APP rule 90 destination port 80

set security firewall name OUTSIDE-TO-APP rule 200 protocol icmp
set security firewall name OUTSIDE-TO-APP rule 200 icmp type 8
set security firewall name OUTSIDE-TO-APP rule 200 action accept
commit
Show more







 Step 4: Create Zone and apply rules 



1. Create zone OUTSIDE to control access to the external Internet.

set security zone-policy zone OUTSIDE default-action drop
set security zone-policy zone OUTSIDE interface dp0bond1
set security zone-policy zone OUTSIDE description 'External Internet'
2. Assign firewalls to control traffic to and from the Internet.

set security zone-policy zone APP to OUTSIDE firewall APP-TO-OUTSIDE
set security zone-policy zone OUTSIDE to APP firewall OUTSIDE-TO-APP
commit
3. Validate the VSI in the APP zone can now access services on the Internet. Login to the local VSI using SSH:

ssh root@<VSI Private IP>
This behavior can be simulated by applying a zone-based firewall to physical interfaces, and an interface-firewall to the loopback interface. The firewall in the loopback interface filters everything that ingress and egress from the router.

For example:

set security zone-policy zone internal default-action 'drop'
set security zone-policy zone internal description 'Private zone'
set security zone-policy zone internal interface 'dp0bond0'
set security zone-policy zone internal to external firewall 'internal-2-external'
set security zone-policy zone internal to ovpn firewall 'internal-2-ovpn'

set security zone-policy zone ovpn default-action 'drop'
set security zone-policy zone ovpn description 'OpenVPN'
set security zone-policy zone ovpn interface 'vtun0'
set security zone-policy zone ovpn to external firewall 'ovpn-2-external'
set security zone-policy zone ovpn to internal firewall 'ovpn-2-internal'
 
set interfaces loopback lo firewall local 'Local'
 
set security firewall name ovpn-2-external default-action accept
set security firewall name ovpn-2-internal default-action accept
 
set security firewall name external-2-ovpn default-action accept
set security firewall name external-2-internal default-action accept
 
set security firewall name internal-2-external default-action accept
set security firewall name internal-2-ovpn default-action accept
 
set security firewall name Local default-action 'drop'
set security firewall name Local 'default-log'
set security firewall name Local rule 10 action 'accept'
set security firewall name Local rule 10 description 'RIP' ("/opt/vyatta/etc/cpp.conf" )







 Order of operation for firewalls, NAT, routing and DNS 



 Order of operation issues
In the Expression Preview, you can click to edit your expression manually instead of using the Visual Expression Builder, or switch between the two. However, depending on the complexity of a manually constructed expression, the Visual Expression Builder might be unable to render it.
6. Pick an action from the Response list menu.
7. To save your rule, choose the most appropriate option by clicking either:



* Save as draft to save your rule, but leave it disabled.
* Save and deploy to save your rule and activate it.









 Editing a firewall rule 

Take the following steps to edit an existing rule:



1. Navigate to Security > Firewall Rules.
2. In the Firewall Rules table, locate the rule you want to modify, then click the overflow menu on the right of the row.
3. Select Edit.
4. Make your changes to the rule.
5. To save your rule, choose the most appropriate option by clicking either:



* Save as draft to save your rule, but leave it disabled.
* Save and deploy to save your rule and activate it.





To pause or activate any rule in the list of existing rules, click the Enabled toggle.





 Deleting a firewall rule 

Take the following steps to delete an existing rule:



1. Navigate to Security > Firewall Rules.
2. In the Firewall Rules table, locate the rule to modify and click the overflow menu on the right of the row.
3. Select Delete.
4. Confirm the rule deletion.
Review the following example requests to create rules. For more information about the v1/rules API, see the [API docs](https://cloud.ibm.com/apidocs/context-based-restrictionscreate-rule).

When you create a rule with context attribute to restrict requests to private endpoint, it is not possible to restrict access to an overlay IP for an individual VPC virtual server instance or bare-metal server. You must specify the VPC zone's underlay IP addresses, which are also known as Cloud Service Endpoint IPs.

The following example payload creates a rule that protects the DNS Services instance and allows access only from the specified network zone via a private endpoint.

{
"contexts": [
{
"attributes":
{
"name": "endpointType",
"value": "private"
},
{
"name": "networkZoneId",
"value": "65810ac762004f22ac19f8f8edf70a34"
}
]
}
],
"resources": [
{
"attributes":
{
"name": "serviceName",
"value": "dns-svcs"
},
{
"name": "serviceInstance",
"operator": "stringEquals",
"value": "3bd0bc3c-232c-4886-a0c4-72aa26ec0d38"
}
]
}
]
}





 Creating rules by using the CLI 



1. To create rules from the CLI, [install the CBR CLI plug-in](https://cloud.ibm.com/docs/account?topic=cli-cbr-plugininstall-cbr-plugin).
2.
Following are examples of how you can apply network policies.



 Allowing connections only from a defined set of sources with the specified IP addresses and hostnames 

If you want to allow connections to the Netezza Performance Server database only from devices with IP addresses in the range that is represented by CIDR-1, CIDR-2, and hostnames H1 and H2, and reject connections from all other sources, follow these steps.



1. Create the policies in order from Rule 1 to Rule 5.

Rule 1: CIDR-1    (allow)
Rule 2: CIDR-2 (allow)
Rule 3: H1 (allow)
Rule 4: H2 (allow)
Rule 5: 0.0.0.0/0 (deny)

These rules ensure that connections are matched against Rule 1-4 to determine whether they can be allowed. If they are not allowed, Rule 5 rejects them.

If someone is trying to connect to the Netezza Performance Server database with hostnames H1 and H2, the database first tries to resolve the hostname to its IP address to complete the connection. Because the database might not have the DNS entry cached locally, the database tries to resolve the hostname by using a public DNS server. The DNS lookup fails because Rule 5 is in place. As a result, the connection attempt fails.
2. Add the public authoritative DNS server hostname or CIDR (DNS-1) to the allow rules for the DNS lookup to succeed.

Rule 1: CIDR-1 (allow)
Rule 2: CIDR-2 (allow)
Rule 3: H1 (allow)
Rule 4: H2 (allow)
Rule 5: DNS-1 (allow)
Rule 6: 0.0.0.0/0 (deny)

The new rule is added as an allow rule (Rule 5).







 Allowing connections only from on premises and take backups, load or unload data by using Cloud Object Store 

If you want applications or users only from their on-premises network to connect to their Netezza Performance Server database, follow these steps.



1. Use a public NAT gateway.
Securing data using context-based restrictions 

In this tutorial, you will establish [context-based restrictions](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-setting-a-firewall) that prevent any access to object storage data unless the request originates from a trusted network zone.



 Before you begin 

Before you plan on using [context-based restrictions](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-setting-a-firewall) with Cloud Object Storage buckets, you need:



* An [IBM Cloud™ Platform account](http://cloud.ibm.com/)
* An [instance of IBM Cloud Object Storage](http://cloud.ibm.com/catalog/services/cloud-object-storage)
* A role of Administrator for context-based restrictions
* A bucket







 Step 1: Navigate to the context-based restrictions console 

From the Manage menu, select Context-based restrictions.

![Navigate to CBR](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/images/cbr_1.png)





 Step 2: Create a new rule 



1. Click on Rules.
2. Choose a name for the rule. This will help keep things organized if you end up with a lot of different rules across all of your cloud services.
3. Click Continue.



![Name the rule](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/images/cbr_3.png)





 Step 3: Scope the rule 

Now you can choose the specific object storage resources to which you would like to apply the context-based restrictions.