vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* This limits the URL to just simple wildcard patterns.



* configurations: List of IP addresses or CIDR ranges to use for this rule.



* This can include any number of ip or ip_range configurations that can access the provided URLs.
* target: The request property to target. Valid values: ip, ip_range.
* value: IP addresses or CIDR. If target is ip, then value should be an IP addresses, otherwise CIDR.





* Option fields are paused, description.



* paused: Whether this rule is currently disabled.
* description: Some useful information about this rule to help identify the purpose of it.







Sample JSON data:

{
"urls": [
"api.mysite.com/some/endpoint"
],
"configurations": [
{
"target": "ip",
"value": "127.0.0.1"
},
{
"target": "ip_range",
"value": " 2.2.2.0/24"
}
]
}

-s, --json-str
: Deprecated. The JSON data describing a firewall rule.

-j, --json-file
: Deprecated. A file contains input JSON data.

-i, --instance
: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.

--output
: Specify output format, only JSON is supported.





 Examples 

Update firewall rules.

ibmcloud cis firewall-update bc014906ccce4e7ea2e28be7df70d0d2 -t access-rules --json '{"mode": "challenge", "notes": "This rule is added because of event X that occurred on date xyz"}' -i "cis-demo"
A subnet restricts access from users who are not part of the subnet. For example, the following rule allows incoming ssh connections from the 192.168.100.X network only:

iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
* Allow access through a single, approved IP address only. For example:

iptables -A INPUT -i eth0 -p tcp -s 192.168.100.11 --dport 22 -m state --state NEW, ESTABLISHED -j ACCEPT







 Server instance information 

IBM provides you with an initially configured IBM Informix on Cloud for IBM Cloud server ready to interact with clients that use SQLI, DRDA, Mongo, and REST protocols. The initial configuration represents a starting point, and can be further customized by you to suit your business needs. You have complete flexibility and control to customize Informix, including the operating system, and more. The Informix on Cloud server is configured to interact with clients using the following protocols on the following ports. The firewall is configured to allow traffic through to the SSL ports only.



Table 1. Server Instance Ports

 Protocol Without SSL With SSL 

 SQLI 9088 9089 
 DRDA 9090 9091 
 Mongo 27017 27018 
 REST 80 443 
 InformixHQ Server HTTP 8080 8443 






As part of the initial configuration, an Informix operating system user is created without a password. To connect to the database, a number of options are available to you as a client to choose from:



* Set the password for the Informix user.
* Create a new operating system user.
* Configure Informix to authenticate through a PAM service.
* [Create a mapped user](http://www.ibm.com/support/knowledgecenter/SSGU8G_14.1.0/com.ibm.sec.doc/ids_am_037.htm).







 Connecting to your Informix on Cloud server
For more information, see [Tips for enhanced security of hardened repository](https://helpcenter.veeam.com/docs/backup/vsphere/hardened_repository.html?ver=120).

- name: Create the veeamlhbr group
ansible.builtin.group:
name: veeamlhbr
state: present

- name: Add the user 'veeamlhbr' with a bash shell
ansible.builtin.user:
name: veeamlhbr
shell: /bin/bash
create_home: yes
password: "{{ password | password_hash('sha512') }}"
state: present
groups: veeamlhbr,wheel
append: yes

- name: Change ownership of /mnt/veeamrepo01 to veeamlhbr
ansible.builtin.file:
path: /mnt/veeamrepo01
state: directory
owner: veeamlhbr
group: veeamlhbr
mode: "700"
Show more





 Configuring Linux firewall 

The code snippet does the following actions:



* Allows SSH from the Veeam backup server on TCP port 22. This rule is removed after the Veeam backup server is initially connected and the required Veeam services are installed.
* Allows SSH access from the automation server. This rule can be removed after the configurations task is complete. However, the future maintenance tasks might become more difficult.
* Allows the Veeam backup server access on TCP port 6162. This port is the Veeam control channel that is used to communicate with the repository server.
* The firewall is started, enabled on startup, and enabled for logging.



- name: Enable firewalld on system reboot
service:
name: firewalld
enabled: yes

- name: Allow SSH
ansible.posix.firewalld:
service: ssh
permanent: yes
state: enabled

- name: Allow incoming access from the vbr server for management
Equal-Cost Multi-Path (ECMP) routing is used when two routes have the same destination and priority (extending the current behavior where ECMP is used for two routes with same destination). At most, two routes in a routing table are allowed to have the same destination and priority. For example, if the custom routing table has three routes with the same destination, one route with priority 1 and the other two routes with priority 4 (ECMP), the route with priority 1 is selected and the ECMP routes are ignored (no ECMP). Now, if the two routes with the same destination and priority have the highest priority, the system selects these two routes and performs ECMP. Then, if one of these routes is deleted, the route that still exists is selected and ECMP is not performed.

For route priority limitations, see [Limitations and guidelines](https://cloud.ibm.com/docs/vpc?topic=vpc-about-custom-routes&interface=uiroute-rules-considerations).







 Use cases 

The following use cases illustrate different routing scenarios.



 Use case 1: Edge proxy firewall 

Zoom

![Edge proxy firewall use case](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/cr_use_case_1.png)

Figure 1. Edge proxy firewall use case



Table 1. Edge proxy firewall egress routing table

 Destination Action Next hop Location 

 10.10.0.0/16 Delegate Dallas DC 1 
 10.11.0.0/16 Delegate Dallas DC 1 
 0.0.0.0/0 Deliver 10.10.1.5 Dallas DC 1 





 Objective: Edge proxy firewall 

Secure flows to the public internet from behind a client-defined gateway, proxy, or firewall appliance, while also allowing resources on the other subnets to flow through the VPC-managed public gateway.
If you also have a firewall on the private network, [allow communication between worker nodes and let your cluster access infrastructure resources over the private network](https://cloud.ibm.com/docs/containers?topic=containers-firewallfirewall_private).



* VPC clusters:



* Expose your apps with [public networking services](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_planningpublic_access) or [private networking services](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_planningprivate_access).
* Connect your cluster with services in private networks outside of your IBM Cloud account or with resources in other VPCs by [setting up the IBM Cloud VPC VPN](https://cloud.ibm.com/docs/containers?topic=containers-vpc-vpnaas).
* [Add rules to the security group for your worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-vpc-network-policy) to control ingress and egress traffic to your VPC subnets.
For more information, see [Add a gateway firewall policy and rule](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/administration/GUID-DE6FE8CB-017E-41C8-85FC-D71CF27F85C2.html).



Table 2. Firewall rule

 Parameter Suggested values 

 Name Outbound Proxy01 
 Source Proxy server IP 
 Destination Any 
 Service HTTP/HTTPS/ICMP Echo 
 Action Allow 







 Defining the NAT rule 

Add a NAT rule by using the parameters in the following table. For more information, see [Configure SNAT/DNAT/No SNAT/No DNAT/Reflexive NAT](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/administration/GUID-DDB35A76-BD12-4F09-8D88-2490E4DAA8F6.html).



Table 3. NAT rule

 Parameter Suggested values 

 Name Proxy01 SNAT 
 Action SNAT 
 Source IP Proxy server IP 
 Destination IP Any 
 Translated IP Address NAT IP 
 Enabled Yes 









 Installing and configuring a proxy server 

The following steps deploy a Linux VM hosting Squid from the Content Library. In this example, a Windows® VSI is provisioned for use as a jump server and Remote Desktop Protocol to the VSI’s public interface is being used to access the jump server.



* Download the Linux ISO file from the distributions' repository.
* Configure a vCenter Content library and populate it with the Linux ISO file.
* Configure the VM and install Linux and Squid.





 Downloading the Linux ISO file 

Using a browser on your jump server download the required Linux ISO file.





 Configuring a content library and populating it with the CentOS ISO file
For example, ip.src eq 93.184.216.0
* action: The rule action to perform. Valid values: log, allow, challenge, js_challenge, block, bypass.

<-- </ul> -->

* The optional fields are description, priority, paused, products.

<-- <ul> -->

* description: To briefly describe the rule.
* priority: The rule's priority. Valid values: 0 2147483647. Value 0 means to set to the default value.
* paused: Indicates if the rule is active. Valid values: on, off.Default value is off.
* products: The list of security products to be bypassed. Valid values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf For example: --products zoneLockdown,rateLimit

<-- </ul> -->

* Note: Fields description, priority, paused which aren't explicitly set in JSON data will be overwritten by the default value.

<-- </ul> -->

Sample JSON data: {
"expression": "ip.src eq 93.184.216.1 and http.request.uri.path "^./wp-login.php$"",
"action": "allow",
"priority": 100,
"paused": false,
"description": "do not challenge login from office"
}
-s, --json-str: Deprecated. The JSON data describing a firewall-rule.-j, --json-file: Deprecated. A file contains input JSON data.-i, --instance: Instance name or ID.
wdc04 BCR02 10.0.192.128/26 <br>10.170.0.0/16 
 wdc04 BCR03 10.183.0.0/16 <br>10.216.0.0/16 
 wdc04 BCR04 10.65.0.0/16 <br>10.201.11.0/24 <br>10.211.0.0/16 
 wdc04 BCR05 10.213.0.0/16 
 wdc06 BCR01 10.3.4.0/24 <br>10.188.0.0/15 <br>10.200.171.0/24 
 wdc07 BCR01 10.3.5.0/24 <br>10.39.0.0/16 <br>10.190.0.0/15 <br>10.200.187.0/24 









 Service network (on back-end/private network) 

[CHANGE LOG](https://cloud.ibm.com/docs/hardware-firewall-shared?topic=hardware-firewall-shared-ibm-cloud-ip-rangescloud-infrastructure-jul2522)

To provision and reload classic Virtual Servers and classic Bare Metal Servers, the following private service networks must be allowed through your gateway appliances and firewalls.

Be sure to configure rules and verify routes for the service networks listed in the table below for dal10, wdc04, and the location of your server.

Additionally, complete the following steps:
If you translate an IP inbound, you must translate that IP outbound for traffic to go both ways.

The following commands are for a source and destination rule. Type show nat in configuration mode to see the NAT rule type.

Use the following command to help troubleshoot NAT: run show nat source translations detail.

Enter the following commands after ensuring that you are in configuration mode:

set nat source rule 9 outbound-interface 'bond1'
set nat source rule 9 protocol 'all'
set nat source rule 9 source address '10.52.69.202'
set nat source rule 9 translation address '50.97.203.227'
set nat destination rule 9 destination address '50.97.203.227'
set nat destination rule 9 inbound-interface 'bond1'
set nat destination rule 9 protocol 'all'
set nat destination rule 9 translation address '10.52.69.202'
commit

If traffic comes in on IP 50.97.203.227 on bond1, that IP is mapped to IP 10.52.69.202 on any interface defined. If traffic goes outbound with the IP of 10.52.69.202 (on any interface defined), it gets translated to IP 50.97.203.227 and proceed out bound on interface bond1.

IP addresses that are mapped one-to-one cannot be masqueraded. If you translate an IP inbound, you must translate that same IP outbound for its traffic to go both ways.





 Adding IP ranges through your VRA 

Depending on your VRA configuration, you might want to accept specific IBM Cloud IP addresses.

New vRouter deployments come with IBM Cloud services network IP addresses defined in a firewall rule named SERVICE-ALLOW.

The following is an example of SERVICE-ALLOW. This is not a complete private IP rule set.

set firewall name SERVICE-ALLOW rule 1 action 'accept'
set firewall name SERVICE-ALLOW rule 1 destination address '10.0.64.0/19'
set firewall name SERVICE-ALLOW rule 2 action 'accept'
set firewall name SERVICE-ALLOW rule 2 destination address '10.1.128.0/19'
[SSH from the Internet](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution58-vmware-solutions-getting-started/internet-ssh.svg)

SSH from the Internet

This tutorial does not get into securing SSH, it is recommended that you configure the VM to use Public/Private keys for SSH authentication. The VM deployed in this tutorial is CentOS and you can read their [Securing SSH](https://wiki.centos.org/HowTos/Network/SecuringSSH) documentation.

In vCloud Director you can Launch Web Console or Launch VM Remote Console from the card of the VM. If you prefer to use that facility to access the VM and do not want to configure SSH directly into the VM, set the allow_ssh variable in Terraform to false. You can also toggle it as needed and re-apply the plan in Schematics.

resource "vcd_nsxv_firewall_rule" "rule_internet_ssh" {
count = var.allow_ssh == true ? 1 :0

edge_gateway = module.ibm_vmware_solutions_shared_instance.edge_gateway_name
name = "${vcd_network_routed.tutorial_network.name}-Internet-SSH"

action = "accept"

source {
ip_addresses = []
}

destination {
ip_addresses = [module.ibm_vmware_solutions_shared_instance.default_external_network_ip]
}

service {
protocol = "tcp"
port = 22
}
}

resource "vcd_nsxv_dnat" "rule_internet_ssh" {
count = var.allow_ssh == true ? 1 :0

edge_gateway = module.ibm_vmware_solutions_shared_instance.edge_gateway_name
See [Schematics firewall, allowed IPs](https://cloud.ibm.com/docs/schematics?topic=schematics-allowed-ipaddresses) for details of the IP addresses Schematics uses and must be allowed access. When using a bastion host, SSH forwarding is used to connect to the target VSIs. To validate access the command ssh -J bastion-ip vsi-ip. Actions has only been tested with IBM Cloud VPC VSIs.

Example as-is IBM Cloud® VPC configurations with bastion hosts are available in the [Cloud-Schematics repo](https://github.com/orgs/Cloud-Schematics/repositories?q=bastion&type=all&language=&sort=). Follow the tutorial [Discover best-practice VPC configuration for application deployment](https://developer.ibm.com/articles/secure-vpc-access-with-a-bastion-host-and-terraform/) for guidance on creating a suitable network configuration.





 Using Actions 

To use Ansible capabilities in Schematics, you create an action that points to the Ansible playbook that you want to run.



1. Add tasks to your playbook: Use Ansible YAML syntax to describe the configuration tasks that you want to run on your cloud infrastructure, such as installing software or starting, stopping, and rebooting a virtual server. You add these tasks to an Ansible playbook and store the playbook in a GitHub, GitLab, or Bitbucket repository to ensure source control and enable collaboration, review, and auditing in your organization. If you are not familiar with Ansible, you can use one of the [IBM provided playbooks](https://github.com/Cloud-Schematics), or browse the [Ansible Galaxy library](https://galaxy.ansible.com/).
2. Create a Schematics action: When you create an action, you point your action to the repository that stores your Ansible playbook. Then, you select the cloud resources where you want to run the tasks that are defined in your Ansible playbook.
wdc04 BCR02 10.0.192.128/26 <br>10.170.0.0/16 
 wdc04 BCR03 10.183.0.0/16 <br>10.216.0.0/16 
 wdc04 BCR04 10.65.0.0/16 <br>10.201.11.0/24 <br>10.211.0.0/16 
 wdc04 BCR05 10.213.0.0/16 
 wdc06 BCR01 10.3.4.0/24 <br>10.188.0.0/15 <br>10.200.171.0/24 
 wdc07 BCR01 10.3.5.0/24 <br>10.39.0.0/16 <br>10.190.0.0/15 <br>10.200.187.0/24 









 Service network (on back-end/private network) 

[CHANGE LOG](https://cloud.ibm.com/docs/gateway-appliance?topic=gateway-appliance-ibm-cloud-ip-rangescloud-infrastructure-jul2522)

To provision and reload classic Virtual Servers and classic Bare Metal Servers, the following private service networks must be allowed through your gateway appliances and firewalls.

Be sure to configure rules and verify routes for the service networks listed in the table below for dal10, wdc04, and the location of your server.

Additionally, complete the following steps:
name = "vmware-tutorial-vApp"
}

resource "vcd_vapp_org_network" "tutorial_network" {
vapp_name = vcd_vapp.vmware_tutorial_vapp.name
org_network_name = vcd_network_routed.tutorial_network.name
}

resource "vcd_vapp_vm" "vm_1" {
vapp_name = vcd_vapp.vmware_tutorial_vapp.name
name = "vm-centos8-01"
catalog_name = "Public Catalog"
template_name = "CentOS-8-Template-Official"
memory = 8192
cpus = 2

guest_properties = {
"guest.hostname" = "vm-centos8-01"
}

network {
type = "org"
name = vcd_vapp_org_network.tutorial_network.org_network_name
ip_allocation_mode = "POOL"
is_primary = true
}
}
Show more





 Create a firewall rule to allow to SSH into the VM from the Internet 

You can create rules to allow or deny traffic, this section creates a rule to allow SSH from the Internet to the VM.

Zoom

![SSH from the Internet](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution58-vmware-solutions-getting-started/internet-ssh.svg)

SSH from the Internet

This tutorial does not get into securing SSH, it is recommended that you configure the VM to use Public/Private keys for SSH authentication. The VM deployed in this tutorial is CentOS and you can read their [Securing SSH](https://wiki.centos.org/HowTos/Network/SecuringSSH) documentation.
wdc04 BCR02 10.0.192.128/26 <br>10.170.0.0/16 
 wdc04 BCR03 10.183.0.0/16 <br>10.216.0.0/16 
 wdc04 BCR04 10.65.0.0/16 <br>10.201.11.0/24 <br>10.211.0.0/16 
 wdc04 BCR05 10.213.0.0/16 
 wdc06 BCR01 10.3.4.0/24 <br>10.188.0.0/15 <br>10.200.171.0/24 
 wdc07 BCR01 10.3.5.0/24 <br>10.39.0.0/16 <br>10.190.0.0/15 <br>10.200.187.0/24 









 Service network (on back-end/private network) 

[CHANGE LOG](https://cloud.ibm.com/docs/fortigate-10g?topic=fortigate-10g-ibm-cloud-ip-rangescloud-infrastructure-jul2522)

To provision and reload classic Virtual Servers and classic Bare Metal Servers, the following private service networks must be allowed through your gateway appliances and firewalls.

Be sure to configure rules and verify routes for the service networks listed in the table below for dal10, wdc04, and the location of your server.

Additionally, complete the following steps:
Use the following command to allow TCP 5022 through the Windows firewall if you are going to configure availability groups New-NetFirewallRule -DisplayName 'SQL-AG-Inbound' -Profile Domain -Direction Inbound -Action Allow -Protocol TCP -LocalPort 5022





 Configure the NTP server 

To synchronize time automatically from the AD domain hierarchy, run the following commands:

w32tm /config /syncfromflags:domhier /update
net stop w32time
net start w32time
w32tm /query /status





 Install the Powershell SQL Server module 

As the SQL server is not Internet connected, the module will need to be downloaded to the bastion host copied across to SQL server's C:\Program Files\WindowsPowerShell\Modules directory and then installed. The following PowerShell commands assume you have downloaded the module to the bastion host and configured a share connected to the Z: drive

Copy-Item "Z:SqlServer" -Destination "C:Program FilesWindowsPowerShellModules" -Recurse
Import-Module SQLServer
Using NAT with prefix-based IPsec 

In [Configuring a VFP interface with IPsec and zone firewalls](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-configuring-a-vfp-interface-with-ipsec-and-zone-firewalls), a VFP interface was created and set for use with an IPsec tunnel. You can use the same interface in NAT rules, as well as the inbound and outbound interface declaration, with one additional caveat.

Here are some example NAT rules:

set service nat destination rule 10 destination address '172.16.200.2'
set service nat destination rule 10 inbound-interface 'vfp0'
set service nat destination rule 10 translation address '10.177.137.251'
set service nat source rule 10 outbound-interface 'vfp0'
set service nat source rule 10 source address '10.177.137.251'
set service nat source rule 10 translation address '172.16.200.2'

This example is a standard bidirectional one-to-one source and destination NAT for the same IPs. But, to ensure that the NAT traffic goes through the tunnel properly, you need a static route for the other end:

set protocols static interface-route 172.16.100.2/32 next-hop-interface 'vfp0'

The reason for using a static route is because the IPsec daemon already created a kernel route for the remote prefix:

K > 172.16.100.0/24 via 169.63.66.49, dp0bond1

Pinging with a source of 10.177.137.251 to 172.16.100.2, the traffic leaves through dp0bond1, fails to transit the tunnel, and never matches the NAT rules properly. The static route fixes this:

K > 172.16.100.0/24 via 169.63.66.49, dp0bond1
S > 172.16.100.2/32 [1/0] is directly connected, vfp0
wdc04 BCR02 10.0.192.128/26 <br>10.170.0.0/16 
 wdc04 BCR03 10.183.0.0/16 <br>10.216.0.0/16 
 wdc04 BCR04 10.65.0.0/16 <br>10.201.11.0/24 <br>10.211.0.0/16 
 wdc04 BCR05 10.213.0.0/16 
 wdc06 BCR01 10.3.4.0/24 <br>10.188.0.0/15 <br>10.200.171.0/24 
 wdc07 BCR01 10.3.5.0/24 <br>10.39.0.0/16 <br>10.190.0.0/15 <br>10.200.187.0/24 









 Service network (on back-end/private network) 

[CHANGE LOG](https://cloud.ibm.com/docs/security-groups?topic=cloud-infrastructure-ibm-cloud-ip-rangescloud-infrastructure-jul2522)

To provision and reload classic Virtual Servers and classic Bare Metal Servers, the following private service networks must be allowed through your gateway appliances and firewalls.

Be sure to configure rules and verify routes for the service networks listed in the table below for dal10, wdc04, and the location of your server.

Additionally, complete the following steps:
wdc04 BCR02 10.0.192.128/26 <br>10.170.0.0/16 
 wdc04 BCR03 10.183.0.0/16 <br>10.216.0.0/16 
 wdc04 BCR04 10.65.0.0/16 <br>10.201.11.0/24 <br>10.211.0.0/16 
 wdc04 BCR05 10.213.0.0/16 
 wdc06 BCR01 10.3.4.0/24 <br>10.188.0.0/15 <br>10.200.171.0/24 
 wdc07 BCR01 10.3.5.0/24 <br>10.39.0.0/16 <br>10.190.0.0/15 <br>10.200.187.0/24 









 Service network (on back-end/private network) 

[CHANGE LOG](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-ibm-cloud-ip-rangescloud-infrastructure-jul2522)

To provision and reload classic Virtual Servers and classic Bare Metal Servers, the following private service networks must be allowed through your gateway appliances and firewalls.

Be sure to configure rules and verify routes for the service networks listed in the table below for dal10, wdc04, and the location of your server.

Additionally, complete the following steps: