HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3
Table Of Contents
- HP-UX IPFilter Version A.03.05.13 Administrator's Guide
- Legal Notices
- Table of Contents
- Preface: About This Document
- 1 Installing and Configuring HP-UX IPFilter
- Overview of HP-UX IPFilter Installation
- Step 1: Checking HP-UX IPFilter Installation Prerequisites
- Step 2: Loading HP-UX IPFilter Software
- Step 3: Determining the Rules for IPFilter
- Step 4: Adding Rules to the Rules Files
- Step 5: Loading IPFilter and NAT Rules
- Step 6: Verifying the Installation and Configuration
- Kernel Tunable Parameters
- Supported and Unsupported Interfaces
- Troubleshooting HP-UX IPFilter
- 2 HP-UX IPFilter on HP-UX 11i Version 3
- 3 Rules and Keywords
- IPFilter Configuration Files
- Basic Rules Processing
- IPFilter Keywords
- pass and block: Controlling IP Traffic
- in and out: Bidirectional Filtering
- quick: Optimizing IPFilter Rules Processing
- on: Filtering by Network Interfaces
- from and to: Filtering by IP Addresses and Subnets
- log: Tracking Packets on a System
- proto: Controlling Specific Protocols
- opt and ipopts: Filtering on IP Options
- icmp-type: Filtering ICMP Traffic by Type
- port: Filtering on TCP and UDP Ports
- keep state: Protecting TCP, UDP, and ICMP Sessions
- flags: Tight Filtering Based on TCP Header Flags
- keep frags: Letting Fragmented Packets Pass
- with frags: Dropping Fragmented Packets
- with short: Dropping Short Fragments
- return-rst: Responding to Blocked TCP Packets
- return-icmp: Responding to Blocked ICMP Packets
- dup-to: Drop-Safe Logging
- NAT Keywords
- 4 Dynamic Connection Allocation
- 5 Firewall Building Concepts
- Blocking Services by Port Number
- Using Keep State
- Using Keep State with UDP
- Using Keep State with ICMP
- Logging Techniques
- Improving Performance with Rule Groups
- Localhost Filtering
- Using the to
- Creating a Complete Filter by Interface
- Combining IP Address and Network Interface Filtering
- Using Bidirectional Filtering Capabilities
- Using port and proto to Create a Secure Filter
- 6 HP-UX IPFilter Utilities
- 7 HP-UX IPFilter and FTP
- 8 HP-UX IPFilter and RPC
- 9 HP-UX IPFilter and IPSec
- 10 HP-UX IPFilter and Serviceguard
- A HP-UX IPFilter Configuration Examples
- B HP-UX IPFilter Static Linking
- C Performance Guidelines
- Index
Firewall Building Concepts
Using port and proto to Create a Secure Filter
Chapter 5 87
Using port and proto to Create a Secure Filter
To configure IPFilter for effective security, use several techniques and
building blocks together.
For example, you can configure rules to allow rsh, rlogin, and telnet to
run only on your internal network. Your internal network subnet is
20.20.20.0/24. All three services use specific TCP ports (513, 514, and
23). Configure the following rules in the following order:
pass in quick on lan0 proto icmp from any to 20.20.20.0/24
icmp-type 0
pass in quick on lan0 proto icmp from any to 20.20.20.0/24
icmp-type 11
block in log quick on lan0 proto icmp from any to any
block in log quick on lan0 proto tcp from any to 20.20.20.0/24
port = 513
block in log quick on lan0 proto tcp from any to 20.20.20.0/24
port = 514
block in log quick on lan0 proto tcp from any to 20.20.20.0/24
port = 23
pass in all
Be sure the rules for the services are placed before the pass in all rule
to close them off to systems outside your network.
To block UDP instead of TCP, replace proto tcp with proto udp. The
rule for syslog would then be:
block in log quick on lan0 proto udp from any to 20.20.20.0/24
port = 514
Several services allow you to block by port number for security:
• syslog on UDP port 514
• portmap on TCP port 111 and UDP port 111
• lpd on TCP port 515
• NFS on TCP port 2049 and UDP port 2049
• X11 on TCP port 6000
To get a complete listing of ports being listed on, use netstat -a, or
check /etc/services.