Chapter 4: Testing and Configuration
connected to the network. If eth0 is disconnected from the network, eth1 also loses DNS server access. To
ensure that any DNS server you add is available in the event of a network or port failure, it is recommended
that you add it to both network-connected devices.
If you have chosen to perform setup via SSH, you will likely lose your network connection as you confirm the
change of IP address from the default setting.
7.
[Optional] Add iptables ACCEPT and DROP rules to manage network access to the appliance.
By default, the ProtectServer Network HSM allows access to all networks and hosts. The default policy for
the INPUT and OUTPUT chain is set to ACCEPT. The default policy for the FORWARD chain is set to
DROP, since the ProtectServer Network HSM is not used to forward packets, as in a router or proxy.
CAUTION!
If you are configuring iptables via SSH, a malformed rule can cause a lockout.
a.
To add an ACCEPT rule, specify a host or network:
psesh:>
network iptables addrule accept host -ip
<IP_address>
psesh:>
network iptables addrule accept network -net
<IP_address>
-mask
<netmask>
b.
To add a DROP rule, specify a host or network:
psesh:>
network iptables addrule drop host -ip
<IP_address>
psesh:>
network iptables addrule drop network -net
<IP_address>
-mask
<netmask>
c.
To see the current list of rules:
psesh:>
network iptables show
d.
To delete a rule, specify the rule's position on the list:
psesh:>
network iptables delrule -rulenum
<number>
A rule's number is based on its current list position, so executing
network iptables delrule -rulenum 1
multiple times will eventually delete the entire list.
e.
Save your iptables changes:
psesh:>
network iptables save
You must execute this command, or any changes will be lost on the next appliance reboot.
8.
After making any change to the network configuration, reboot the appliance:
psesh:>
sysconf appliance reboot
9.
View the new network settings:
psesh:>
network show
SSH Network Access
After you have completed the network configuration, you can access the ProtectServer Network HSM over the
network using the SSH protocol. You need an SSH client such as puTTY (available for free from
).
SafeNet ProtectToolkit 5.9 Installation and Configuration Guide
007-013682-007 Rev. A 08 January 2020 Copyright 2009-2020 Thales
26