配置sqlnet.ora限制IP访问Oracle

tcp.validnode_checking = yes
tcp.invited_nodes = (hostname1, hostname2，ip1,ip2)
tcp.excluded_nodes = (10.103.11.17,hostname1,hostname2)

-->使用tnsping demo92，连接正常
C:\>tnsping demo92

TNS Ping Utility for 32-bit Windows: Version 11.2.0.1.0 - Production on 25-JUN-2011 18:55:39
Copyright (c) 1997, 2010, Oracle.  All rights reserved.
Used parameter files:
d:\app\Robinson\Oracle_client\product\11.2.0\client_1\network\admin\sqlnet.ora

Used TNSNAMES adapter to resolve the alias
Attempting to contact (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)(HOST = 10.103.11.20
9)(PORT = 1521))) (CONNECT_DATA = (SERVER = DEDICATED) (SERVICE_NAME = demo92)))
OK (0 msec)

-->查看配置文件
[oracle@test admin]$ more sqlnet.ora
# SQLNET.ORA Network Configuration File: /oracle/92/network/admin/sqlnet.ora
# Generated by Oracle configuration tools.

NAMES.DIRECTORY_PATH= (ONAMES, TNSNAMES, HOSTNAME)

#Added by Robinson
tcp.validnode_checking = yes
tcp.excluded_nodes = (10.103.11.17)

-->重新reload
[oracle@test admin]$ lsnrctl reload listener_demo92

LSNRCTL for Linux: Version 9.2.0.8.0 - Production on 26-JUN-2011 10:03:11

Copyright (c) 1991, 2006, Oracle Corporation.  All rights reserved.

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521)))
The command completed successfully

-->再次tnsping时，收到TNS-12547错误
C:\>tnsping demo92

TNS Ping Utility for 32-bit Windows: Version 11.2.0.1.0 - Production on 25-JUN-2011 19:01:21
Copyright (c) 1997, 2010, Oracle.  All rights reserved.
Used parameter files:
d:\app\Robinson\Oracle_client\product\11.2.0\client_1\network\admin\sqlnet.ora

Used TNSNAMES adapter to resolve the alias
Attempting to contact (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)(HOST = 10.103.11.20
9)(PORT = 1521))) (CONNECT_DATA = (SERVER = DEDICATED) (SERVICE_NAME = demo92)))
TNS-12547: TNS:lost contact

-->下面的演示中如果excluded_nodes与invited_nodes都存在，则invited_nodes优先，不再演示
[oracle@test admin]$ more sqlnet.ora
# SQLNET.ORA Network Configuration File: /oracle/92/network/admin/sqlnet.ora
# Generated by Oracle configuration tools.

NAMES.DIRECTORY_PATH= (ONAMES, TNSNAMES, HOSTNAME)

#Added by Robinson
tcp.validnode_checking = yes
tcp.excluded_nodes = (10.103.11.17)
tcp.invited_nodes = (10.103.11.17)

-->限制单用户从单IP登录，下面限制scott用户从客户端的登录
CREATE OR REPLACE TRIGGER disablelogin
AFTER logon ON scott.schema    -->注意使用方式为username.schema
DECLARE
ipaddr VARCHAR2(30);
BEGIN
SELECT sys_context('userenv', 'ip_address')
INTO   ipaddr
FROM   dual;
IF ipaddr = '10.103.11.17' THEN
raise_application_error('-20001',
'You can not login,Please contact administrator');
END IF;
END disablelogin;
/

-->限制IP段登录
CREATE OR REPLACE TRIGGER chk_ip_range
AFTER logon ON scott.schema
DECLARE
ipaddr VARCHAR2(30);
BEGIN
SELECT sys_context('userenv', 'ip_address')
INTO   ipaddr
FROM   dual;
IF ipaddr LIKE ('10.103.11.%') THEN
raise_application_error('-20001',
'You can not login,Please contact administrator');
END IF;
END chk_ip_range;
/