vania-janet/multiturn-rag-retrieval-data huggingface dataset:
acl localnet src 10.0.0.0/8 RFC1918 possible internal network
acl localnet src 172.16.0.0/12 RFC1918 possible internal network
acl localnet src 192.168.0.0/16 RFC1918 possible internal network
acl localnet src fc00::/7 RFC 4193 local private network range
acl localnet src fe80::/10 RFC 4291 link-local (directly plugged) machines
acl localnet src all
acl ibmprivate dst 161.26.0.0/16
acl ibmprivate dst 166.8.0.0/14
acl FTP_ports port 21 20 1025-65535
acl SSL_ports port 443 8443
acl Safe_ports port 80 http
acl Safe_ports port 21 ftp
acl Safe_ports port 443 https
acl Safe_ports port 22
acl Safe_ports port 8443
acl Safe_ports port 70 gopher
acl Safe_ports port 210 wais
acl Safe_ports port 1025-65535 unregistered ports
acl Safe_ports port 280 http-mgmt
acl Safe_ports port 488 gss-http
acl Safe_ports port 591 filemaker
acl Safe_ports port 777 multiling http
acl CONNECT method CONNECT


 Recommended minimum Access Permission configuration:

 Deny requests to certain unsafe ports
http_access deny !Safe_ports

 Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

 Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager

 We strongly recommend the following be uncommented to protect innocent
 web applications running on the proxy server who think the only
 one who can access services on "localhost" is a local user
http_access deny to_localhost

 INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
 Example rule allowing access from your local networks.
* [Opening ports in a corporate allowlist](https://cloud.ibm.com/docs/openshift?topic=openshift-firewallcorporate)



* [Running ibmcloud, ibmcloud oc, and ibmcloud cr commands from behind an allowlist](https://cloud.ibm.com/docs/openshift?topic=openshift-firewallfirewall_bx)
* [Running oc commands from behind an allowlist](https://cloud.ibm.com/docs/openshift?topic=openshift-firewallfirewall_kubectl)
* [Running calicoctl commands from behind an allowlist](https://cloud.ibm.com/docs/openshift?topic=openshift-firewallfirewall_calicoctl)



* [Opening ports in gateway appliance allowlists](https://cloud.ibm.com/docs/openshift?topic=openshift-firewallvyatta_firewall)



* [Opening required ports in a public allowlist](https://cloud.ibm.com/docs/openshift?topic=openshift-firewallfirewall_outbound)
* [Opening required ports in a private allowlist](https://cloud.ibm.com/docs/openshift?topic=openshift-firewallfirewall_private)
* [Opening ports in a public or private allowlist for inbound traffic](https://cloud.ibm.com/docs/openshift?topic=openshift-firewallfirewall_inbound)



* [Allowing the cluster to access resources through Calico network policies](https://cloud.ibm.com/docs/openshift?topic=openshift-firewallfirewall_calico_egress)
* [Allowing traffic from your cluster in other services' allowlists or in on-premises allowlists](https://cloud.ibm.com/docs/openshift?topic=openshift-firewallfirewall_workers)
--context-attributes endpointType=private
: Set the context attribute endpointType=private without associating a network zone allows all private traffic to the cluster.

--context-attributes endpointType=public,networkZoneId=all-client-ip
: Set the context attribute endpointType=public and associate the networkZoneId=allow-client-ip that you created earlier to allow only the resources in the allow-client-ip zone to access the cluster over the public network.
2. Verify the rule was created.

ibmcloud cbr rules







 Step 3: Testing your context-based restrictions 

To test your context-based restrictions setup, you can try calling the cluster APIs for your cluster, for example by listing pods, over the public network from an IP address other than the individual IP address that you allowlisted in your network zone. With this setup, all private connectivity is allowed, while only the individual IP address in your network zone can connect to the cluster APIs over the public network.





 Additional scenarios 

Now that you've created a simple CBR network zone and rule, review the following more advanced examples to further control access to your Red Hat OpenShift on IBM Cloud resources.



 Allowing different IPs to access the public and private service endpoints 

In this scenario, you allow different IP addresses or CIDRs to access the public and private service endpoints of your Red Hat OpenShift on IBM Cloud clusters by creating separate network zones for each IP address. Then, you create a rule that allows each network zone to access the public or private service endpoints.



1. Create a network zone for a public IP address or CIDR and another for a private IP address or CIDR that you want to allow to access your Red Hat OpenShift on IBM Cloud clusters.

Example commands to create separate network zones called public-IP-zone and private-IP-zone. In this example, each zone contains multiple IP addresses or CIDRs, separated by a comma, that you want to allow to access your clusters.

ibmcloud cbr zone-create --addresses 1.2.3.4,12.12.12.0/24 --description "Allowed Public IP Addresses Zone" --name "public-ip-zone"
Logical NOT not ( http.host eq "www.example.com" and ip.src in 93.184.216.0/24 ) 1 
 and && Logical AND http.host eq "www.example.com" and ip.src in 93.184.216.0/24 2 
 xor ^^ Logical XOR http.host eq "www.example.com" xor ip.src in 93.184.216.0/24 3 
 or || Logical OR http.host eq "www.example.com" or ip.src in 93.184.216.0/24 4 



To alter the order of precedence, you can group expressions with parentheses. Using no parentheses, expressions are implicitly grouped based on standard precedence:

ssl and http.request.uri.path eq /login or http.request.uri.path eq /oauth

Applying explicit grouping:

(ssl and http.request.uri.path eq /login) or http.request.uri.path eq /oauth

Giving precedence to or with parentheses:

ssl and (http.request.uri.path eq /login or http.request.uri.path eq /oauth)

Note that while not is used for grouping, it can be used to negate a single comparison. For example, not ip.src eq 93.184.216.0 is equivalent to not (ip.src eq 93.184.216.0).

Finally, you can also negate grouped expressions:

not (http.request.method eq "POST" and http.request.uri.path eq "/login")



 Deviations from Wireshark display filters 

Firewall rules expressions are inspired by Wireshark display filters. However, the implementation deviates in the following ways:



* For CIDR IP equality tests, Wireshark allows ranges in the format ip.src == 1.2.3.0/24, while CIS only supports equality tests using a single IP address.
ibmcloud cbr zone-create --name example-zone-1 --description "Example zone 1" --service-ref service_name=containers-kubernetes

The following example creates a network zone to allow a single public IP address to access. You can also use this example in conjunction with the [one IP example rule](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr&interface=clione-ip). For more information about this scenario, see [Setting up context-based restrictions](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr-tutorial).

ibmcloud cbr zone-create --addresses 129.41.86.7 --description "Allow only client IP" --name allow-client-ip







 Creating network zones from the console 



1. Determine the resources that you want add to your allowlist.
2. Follow the steps to [create context-based restrictions in the console](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create). Add the Kubernetes service to your network zones to allow Red Hat OpenShift on IBM Cloud to access services and resources in your account.









 Creating rules 

Define rules to protect access to resources in your account. The contexts that you define in your rules determine how the resources in your network zones (allowlists) can interact with the resources defined in the rule.

Review the [limitations](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr&interface=clicbr-limitations) before you create rules.



 Creating rules by using the API 

Review the following example requests to create rules. For more information about the v1/rules API, see the [API docs](https://cloud.ibm.com/apidocs/context-based-restrictionscreate-rule).

After you create a rule, it might take up to 10 minutes to before you can update that rule due to IAM TTL response caching.
ibmcloud cbr zone-create --name example-zone-1 --description "Example zone 1" --service-ref service_name=containers-kubernetes

The following example creates a network zone to allow a single public IP address to access. You can also use this example in conjunction with the [one IP example rule](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr&interface=uione-ip). For more information about this scenario, see [Setting up context-based restrictions](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr-tutorial).

ibmcloud cbr zone-create --addresses 129.41.86.7 --description "Allow only client IP" --name allow-client-ip







 Creating network zones from the console 



1. Determine the resources that you want add to your allowlist.
2. Follow the steps to [create context-based restrictions in the console](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create). Add the Kubernetes service to your network zones to allow Red Hat OpenShift on IBM Cloud to access services and resources in your account.









 Creating rules 

Define rules to protect access to resources in your account. The contexts that you define in your rules determine how the resources in your network zones (allowlists) can interact with the resources defined in the rule.

Review the [limitations](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr&interface=uicbr-limitations) before you create rules.



 Creating rules by using the API 

Review the following example requests to create rules. For more information about the v1/rules API, see the [API docs](https://cloud.ibm.com/apidocs/context-based-restrictionscreate-rule).

After you create a rule, it might take up to 10 minutes to before you can update that rule due to IAM TTL response caching.
* [Controlling traffic between pods](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesisolate_services)
* [Logging denied traffic](https://cloud.ibm.com/docs/containers?topic=containers-network_policieslog_denied)



[Opening required ports and IP addresses in your allowlist](https://cloud.ibm.com/docs/containers?topic=containers-firewallfirewall)



* [Opening ports in a corporate allowlist](https://cloud.ibm.com/docs/containers?topic=containers-firewallcorporate)



* [Running ibmcloud, ibmcloud ks, and ibmcloud cr commands from behind an allowlist](https://cloud.ibm.com/docs/containers?topic=containers-firewallfirewall_bx)
* [Running kubectl commands from behind an allowlist](https://cloud.ibm.com/docs/containers?topic=containers-firewallfirewall_kubectl)
* [Running calicoctl commands from behind an allowlist](https://cloud.ibm.com/docs/containers?topic=containers-firewallfirewall_calicoctl)



* [Opening ports in gateway appliance allowlists](https://cloud.ibm.com/docs/containers?topic=containers-firewallvyatta_firewall)



* [Opening required ports in a public allowlist](https://cloud.ibm.com/docs/containers?topic=containers-firewallfirewall_outbound)
* [Opening required ports in a private allowlist](https://cloud.ibm.com/docs/containers?topic=containers-firewallfirewall_private)
* [Opening ports in a public or private allowlist for inbound traffic](https://cloud.ibm.com/docs/containers?topic=containers-firewallfirewall_inbound)
Example context-based restrictions scenarios 

With context-based restrictions, account owners and administrators can define and enforce access restrictions for IBM Cloud® resources, based on the context of access requests. Access to Red Hat OpenShift on IBM Cloud resources can be controlled with context-based restrictions and identity and access management policies. For more information, see [Protecting Red Hat OpenShift on IBM Cloud resources with context-based restrictions](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr).

Applications running on Red Hat OpenShift on IBM Cloud clusters, for example web servers exposed by a Kubernetes LoadBalancer, are not restricted by CBR rules.



 Understanding the scenario 

In this example scenario, you use context-based restrictions to restrict traffic to your cluster by allowing only an individual IP address to connect to the cluster APIs over the public network while still allowing all private traffic.

In the following steps, you start by creating a network zone, or allowlist, that includes a single IP address. Then, you create a context-based restrictions rule for your cluster that allows all private network access and allowlists the network zone that contains the individual IP address. When you create the rule, you associate it with the network zone that contains the individual IP address.





 Prerequisites 

Before beginning this tutorial, make sure you have created or installed the following resources and tools.



* An IBM Cloud account. For more information, see [Creating an account](https://cloud.ibm.com/docs/account?topic=account-account-getting-started).
* The CLI tools including the IBM Cloud CLI, the Containers service CLI plug-in, and the CBR plug-in. For more information, see [Getting started with the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).
* A Red Hat OpenShift on IBM Cloud cluster. For more information, see [Creating clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-clusters).
set resources group address-group ibmprivate address 10.3.200.0/24
* Define the address ranges for the IBM Cloud 'Service Network (on backend/private network)' for DAL10, WDC04, and your target data center. The example here is DAL10, WDC04 (two addresses), and LON06.

set resources group address-group ibmprivate address 10.200.80.0/20
set resources group address-group ibmprivate address 10.3.160.0/20
set resources group address-group ibmprivate address 10.201.0.0/20

set resources group address-group ibmprivate address 10.201.64.0/20
commit



3. Create the APP zone for the user VLAN and subnet and the INSIDE zone for the IBM Cloud private network. Assign the previously created firewalls. Zone definition uses the VRA network interface names to identify the zone associated with each VLAN. The command to create the APP zone requires that you specify the VLAN ID of the VLAN associated with the VRA created earlier. This is highlighted as <VLAN ID>.

set security zone-policy zone INSIDE description "IBM Internal network"
set security zone-policy zone INSIDE default-action drop
set security zone-policy zone INSIDE interface dp0bond0
set security zone-policy zone INSIDE to APP firewall INSIDE-TO-APP

set security zone-policy zone APP description "Application network"
set security zone-policy zone APP default-action drop

set security zone-policy zone APP interface dp0bond0.<VLAN ID>
set security zone-policy zone APP to INSIDE firewall APP-TO-INSIDE
4. Commit the configuration. Then, from your workstation, verify using ping that the firewall is now denying traffic via the VRA to the VSI:

commit

ping <VSI Private IP Address>
5. Define firewall access rules for UDP, TCP and ICMP.

set security firewall name INSIDE-TO-APP rule 200 protocol icmp
set security firewall name INSIDE-TO-APP rule 200 icmp type 8
* Follow the instructions from [Azure IP address ranges notifications](https://docs.microsoft.com/en-us/powershell/module/az.network/get-aznetworkservicetag?view=azps-7.5.0).

> $serviceTags = Get-AzNetworkServiceTag -Location eastus2
> $serviceTags.Values | Where-Object { $_.Name -like "Storage" -and $_.Properties.Region -eq "eastus2" }

Name : Storage.EastUS2
System Service : AzureStorage
Region : eastus2
Address Prefixes : {13.68.120.64/28, 13.77.112.16/28, 13.77.112.32/28, 13.77.112.112/28…}
Change Number : 6

Name : Storage.EastUS2Stage
System Service : AzureStorage
Region : eastus2
Address Prefixes : 137.116.2.64/27
Change Number : 1
* Add the CIDR ranges to your allow lists.

Rule 1: CIDR-1 (allow)
Rule 2: 13.68.120.64/28 (allow)
Rule 3: 13.77.112.16/28 (allow)
Rule 4: 13.77.112.32/28 (allow)
Rule 5: 13.77.112.112/28 (allow)
Rule 6: 137.116.2.64/27 (allow)
Rule 2: 0.0.0.0/0 (deny)



2. If you want to use or connect from any other Azure service, add to the allow rule the CIDR range that is associated with those respective service endpoints.
To retrieve the CIDR range for various Azure services:



* Follow the instructions from [here](https://docs.microsoft.com/en-us/powershell/module/az.network/get-aznetworkservicetag?view=azps-7.5.0).
* Add the CIDR ranges as an allow rule as needed.
Allow TCP IP or CIDR CIDR Block value from Bastion host subnet (for example, 10.5.70.0/24) Any IP address IP address of F5 management interface (for example, 10.5.30.4) 443 
 Deny ALL Any Any Any 









 F5 external interface 

Restrict incoming traffic on port 443 to CIS global load balancers allowlisted IP addresses. The allowlisted IP addresses might periodically change and should be updated.



 Security group 

Security group inbound rules



F5 external interface: Security group inbound rules
This table shows the security group rules that are needed for the F5 external interface.

 Protocol Source type Source Port 

 TCP [CIS global load balancers allowlisted IP addresses](https://cloud.ibm.com/docs/cis?topic=cis-cis-allowlisted-ip-addresses) Ports 443-443 
 TCP Any Ports 4443-4443 







 Access control list 

ACL inbound rules

ACL outbound rules



F5 external interface: access control list inbound rules
This table shows the inbound access control list rules that are needed for the F5 external interface.

 Allow or Deny Protocol Source type Source Value Source Port Destination type Destination Value Destination Port 

 Allow TCP Any Any IP address IP address of F5 external interface (for example, 10.5.40.5) 443 
 Allow TCP Any Any IP address IP address of F5 external interface (for example, 10.5.40.5) 4443 
 Deny ALL Any Any Any 









 F5 workload interface 



 Security group 

Security group outbound rules



F5 workload interface: Security group outbound rules
This table shows the security group rules that are needed for the F5 workload interface.

 Protocol Destination type Destination Port 

 TCP CIDR block CIDR block of the subnet your workload or application is located (for example, 10.40.0.0/18) Ports 443-443 
 TCP CIDR block CIDR block of the subnet your workload or application is located (for example, 10.50.0.0/18) Ports 443-443
Allow TCP IP or CIDR CIDR Block value from Bastion subnet (for example, 10.5.70.0/24) 3080-3080 IP or CIDR IP address of F5 bastion interface (for example, 10.5.60.5) Any 
 Deny ALL Any Any Any 











 Next steps 



* [Set up a full tunnel client-to-site VPN with BIG-IP](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-f5-tutorial)
* [Enable a WAF with BIG-IP](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-waf-tutorial)
To find a list of available service refs, run the ibmcloud cbr service-ref-targets[command](https://cloud.ibm.com/docs/account?topic=account-cbr-plugincbr-cli-service-ref-targets-command). The service_name for SCC is compliance.

Example command to add the compliance service to a network zone.

ibmcloud cbr zone-create --name example-zone-1 --description "Example zone 1" --service-ref service_name=compliance

Example command to add a single IP address to a network zone.

ibmcloud cbr zone-create --addresses 129.41.86.7 --description "Allow only client IP" --name allow-client-ip







 Creating rules 

Define rules to protect access to resources in your account. The contexts that you define in your rules determine how the resources in your network zones (allowlists) can interact with the resources that are defined in the rule.

Review the [limitations](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-cbr&interface=uicbr-limitations) before you create rules.



 Creating rules in the console 

Complete the following steps to create rules for Security and Compliance Center.



1. Review the network zones that you created for your account.
2. Follow the steps to [create rules in the console](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create&interface=uicontext-restrictions-create-rules).







 Creating rules by using the API 

Review the following example to learn how to create rules for Security and Compliance Center by using the API. For more information, see the [API docs](https://cloud.ibm.com/apidocs/context-based-restrictionscreate-rule).

This payload creates a rule that targets the Security and Compliance Center service and allows only private endpoints from the specified network zone to access the service.

{
"description": "Example rule 1",
"resources": [
{
"attributes":
{
set system acm operational-ruleset rule 9993 action 'allow'
set system acm operational-ruleset rule 9993 command '/reset/'
set system acm operational-ruleset rule 9993 group 'vyattaop'
set system acm operational-ruleset rule 9994 action 'allow'
set system acm operational-ruleset rule 9994 command '/release/'
set system acm operational-ruleset rule 9994 group 'vyattaop'
set system acm operational-ruleset rule 9995 action 'allow'
set system acm operational-ruleset rule 9995 command '/renew/'
set system acm operational-ruleset rule 9995 group 'vyattaop'
set system acm operational-ruleset rule 9996 action 'allow'
set system acm operational-ruleset rule 9996 command '/telnet/'
set system acm operational-ruleset rule 9996 group 'vyattaop'
set system acm operational-ruleset rule 9997 action 'allow'
set system acm operational-ruleset rule 9997 command '/traceroute/'
set system acm operational-ruleset rule 9997 group 'vyattaop'
set system acm operational-ruleset rule 9998 action 'allow'
set system acm operational-ruleset rule 9998 command '/update/'
set system acm operational-ruleset rule 9998 group 'vyattaop'
set system acm operational-ruleset rule 9999 action 'deny'
set system acm operational-ruleset rule 9999 command ''
set system acm operational-ruleset rule 9999 group 'vyattaop'
set system acm ruleset rule 9999 action 'allow'
set system acm ruleset rule 9999 group 'vyattacfg'
set system acm ruleset rule 9999 operation ''
set system acm ruleset rule 9999 path ''
Show more
* NETCONF is enabled.



* Set system services netconf ssh port 830
* Set firewall filter PROTECT-IN term NETCONF from destination-address <vSRX_private_ip>/32
* Set firewall filter PROTECT-IN term NETCONF from protocol TCP
* Set firewall filter PROTECT-IN term NETCONF from destination-port 830
* Set firewall filter PROTECT-IN term NETCONF then accept



* The security zones are configured as follows.



* IBM_CLOUD_PRIVATE on reth0 (untrusted network)
* IBM_CLOUD_PUBLIC on reth1 (untrusted network)
* IRE_PRIVATE on reth2 (trusted network)
* IRE_PUBLIC on reth3 (trusted network)



* Address book entries in an address book, called CYBER, for the Veeam proxies and the Veeam Linux hardened repository.



* Set security address-book CYBER address PROXY_1 <proxy_1_ip>/32
* Set security address-book CYBER address PROXY_2 <proxy_2_ip>/32
* Set security address-book CYBER address LHBR_1 <lhbr_ip>/32
* Set security address-book CYBER address-set CYBER_PROD address PROXY_1
* Set security address-book CYBER address-set CYBER_PROD address PROXY_2
* Set security address-book CYBER address-set CYBER_IRE address LHBR_1
* Set security address-book CYBER attach zone IBM_CLOUD_PRIVATE
* Set security address-book CYBER attach zone IRE_PRIVATE



* A custom application that defines the TCP ports 2500 - 3300, which is the default range of ports that are used as data transmission channels by Veeam.



* Set applications - application VEEAM_DATA protocol TCP
* Set applications - application VEEAM_DATA destination-port 2500-3300



* A security policy is defined that denies traffic from the Veeam proxies to the Veeam Linux Hardened repositories.



* Set security policies from zone IBM_CLOUD_PRIVATE to zone IRE_PRIVATE policy AIRGAP match source-address CYBER_PROD