Firewall considerations

When using the probe in conjunction with a firewall, configure the firewall so that the probe can connect to the target system.

Two probe properties define the communication port it uses and the communications protocols it uses:

Port
Protocol

Configure the firewall to allow communication through the port defined in the Port property for all the protocols specified in the Protocol property.

Linux example

The following example configures a Linux firewall to enable communication using the TCP and UDP protocols through port 162 (the default value of the Port property):

Make a local copy of the file containing the firewall rules:
```
cp /etc/sysconfig/iptables /root/firewall_rules
```

Edit the local copy of the rules and add the following:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 162 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 162 -j ACCEPT

Load the firewall with the new rules:
```
iptables-restore < root/firewall_rules
```

List the rules to check they are correct:

iptables -L

ACCEPT tcp -- anywhere anywhere state  NEW tcp dpt:162
ACCEPT udp -- anywhere anywhere state NEW udp dpt:snmptrap

Test that the probe can receive traps with the new rules in force:
1. Start the probe allowing all protocols for the required port:
```
$OMNIHOME/probes/nco_p_mttrapd -protocol "ALL" -port 162 -messagelevel debug 
-messagelog stdout
```
2. From a remote host, enter the following command:
  telnet probe_ip_address port
  
  Where probe_ip_address is the IP address of the probe server and port is the number of the port specified in the Port property.
  If the firewall is correctly configured, the probe displays the following message:
```
Error: SNMP Message (priority=3): Received broken packet. Closing session.
```
  If no message appears, check the edits to the rules file, adjust as necessary, and repeat this step.
Implement the changes permanently:
1. Edit the file /etc/sysconfig/iptables.
2. Add the rules you implemented in the firewall_rules file.
3. Load the firewall with these new rules:
```
iptables-restore < /etc/sysconfig/iptables
```