Steps to Configure Weblogic Connection Filters

Connection Filters allow you to deny access of UNWANTED Connections at the network level. Connection Filters can be used to protect server resources on individual servers, server clusters, or an entire internal network or Intranet. Connection filters are particularly useful when using the Administration port. Depending on your network firewall configuration, you may be able to use a connection filter to further restrict administration access. A typical use might be to restrict access to the Administration port to only the servers and machines in the domain.

WebLogic Server is having a built-in with a default connection filter called weblogic.security.net.ConnectionFilterImpl. This default connection filter accepts all incoming connections except the one's defined in your Administration Console as a Connection filter rule. You can write your own custom connection filter by implementing the classes in the weblogic.security.net package. This post will demonstrate the Steps to Configure Weblogic Connection Filters. 

Steps to Configure Weblogic Connection Filters

1. If you have not already done so, in the Change Center of the Administration Console, click "Lock & Edit"

2. In the left pane, click on the domain name.

3. In the right pane, Select Security > Filter tab.

4. Click the Connection Logger Enabled attribute to enable the logging of accepted connections.

5. Specify the Connection Filter to be used with the domain.

I am making use of the default connection filter "weblogic.security.net.ConnectionFilterImpl"

6. Specify the Connection Filter Rules. Make sure that you use the syntax below while writing the rules.

Syntax:

target localAddress localPort action protocols 
where
-- target             specifies the client hosts that can connect to Weblogic Server instance.
-- localAddress  defines the host address of the Weblogic Server instance to which any client 
can connect. If you specify an asterisk (*), the match returns all local IP addresses.
-- localPort        defines the port on which the WebLogic Server instance is listening to which 
any client can connect. If you specify an asterisk (*), the match returns all available ports on 
the server.
-- action            specifies the action to perform. This value must be only allow or deny.
-- protocols       the list of protocol names to match. The following protocols may be specified: 
http, https, t3, t3s, giop, giops, dcom, ftp, ldap. If no protocol is defined, all protocols will match a rule.

7. Click Save and in the Change Center of the Administration Console, click "Activate Changes".

 

Once saved an entry is made in the Config.xml for these settings as below:

config.xml

       <connection-filter>weblogic.security.net.ConnectionFilterImpl</connection-filter>
        <connection-filter-rule>10.1.xx.xx 10.1.xx.xx 7001 deny http</connection-filter-rule>
        <connection-logger-enabled>true</connection-logger-enabled>

8. Restart the all the Weblogic Server instance for changes to take effect.

9.  Testing the Connection Filter rules.

Try to access the Weblogic server instance with the port from the target server mentioned in the rule.

Rejected Connection

####<May 24, 2011 1:34:50 PM MDT> <Notice> <Socket> <NAND-S77> <AdminServer> <ExecuteThread: '2' for queue: 'weblogic.socket.Muxer'> <<WLS Kernel>> <> <> <1306265690809> <BEA-000445> <Connection rejected, filter blocked Socket[addr=10.1.xx.xx,port=48316,localport=7001], weblogic.security.net.FilterException: [Security:090220]rule 1>

Try to access the Weblogic server instance with the port from the target server which is not mentioned in the rule.

Accepted Connection

####<May 24, 2011 1:34:23 PM MDT> <Info> <Socket> <NAND-S77> <AdminServer> <ExecuteThread: '2' for queue: 'weblogic.socket.Muxer'> <<WLS Kernel>> <> <> <1306265663662> <BEA-000431> <Accepted Connection: Filtering is set to: "true" Remote Address: "/0:0:0:0:0:0:0:1" Remote Port: "51655" Local Address: "0.0.0.0/0.0.0.0" Local Port: "7001" Protocol: "http">

That's it. 

Please do leave your valuable comments.

Further reading on Connection Filter rules.
http://download.oracle.com/docs/cd/E13222_01/wls/docs81/security/con_filtr.html#1029299