HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3
Table Of Contents
- HP-UX IPFilter Version A.03.05.13 Administrator's Guide
- Legal Notices
- Table of Contents
- Preface: About This Document
- 1 Installing and Configuring HP-UX IPFilter
- Overview of HP-UX IPFilter Installation
- Step 1: Checking HP-UX IPFilter Installation Prerequisites
- Step 2: Loading HP-UX IPFilter Software
- Step 3: Determining the Rules for IPFilter
- Step 4: Adding Rules to the Rules Files
- Step 5: Loading IPFilter and NAT Rules
- Step 6: Verifying the Installation and Configuration
- Kernel Tunable Parameters
- Supported and Unsupported Interfaces
- Troubleshooting HP-UX IPFilter
- 2 HP-UX IPFilter on HP-UX 11i Version 3
- 3 Rules and Keywords
- IPFilter Configuration Files
- Basic Rules Processing
- IPFilter Keywords
- pass and block: Controlling IP Traffic
- in and out: Bidirectional Filtering
- quick: Optimizing IPFilter Rules Processing
- on: Filtering by Network Interfaces
- from and to: Filtering by IP Addresses and Subnets
- log: Tracking Packets on a System
- proto: Controlling Specific Protocols
- opt and ipopts: Filtering on IP Options
- icmp-type: Filtering ICMP Traffic by Type
- port: Filtering on TCP and UDP Ports
- keep state: Protecting TCP, UDP, and ICMP Sessions
- flags: Tight Filtering Based on TCP Header Flags
- keep frags: Letting Fragmented Packets Pass
- with frags: Dropping Fragmented Packets
- with short: Dropping Short Fragments
- return-rst: Responding to Blocked TCP Packets
- return-icmp: Responding to Blocked ICMP Packets
- dup-to: Drop-Safe Logging
- NAT Keywords
- 4 Dynamic Connection Allocation
- 5 Firewall Building Concepts
- Blocking Services by Port Number
- Using Keep State
- Using Keep State with UDP
- Using Keep State with ICMP
- Logging Techniques
- Improving Performance with Rule Groups
- Localhost Filtering
- Using the to
- Creating a Complete Filter by Interface
- Combining IP Address and Network Interface Filtering
- Using Bidirectional Filtering Capabilities
- Using port and proto to Create a Secure Filter
- 6 HP-UX IPFilter Utilities
- 7 HP-UX IPFilter and FTP
- 8 HP-UX IPFilter and RPC
- 9 HP-UX IPFilter and IPSec
- 10 HP-UX IPFilter and Serviceguard
- A HP-UX IPFilter Configuration Examples
- B HP-UX IPFilter Static Linking
- C Performance Guidelines
- Index

HP-UX IPFilter and FTP
FTP Basics
Chapter 7 113
FTP Basics
The File Transfer Protocol (FTP) is a user-level protocol for transferring
files between host computers.
An FTP session involves two separate connections:
• Control connection
1. The server listens for client connections on port 21.
2. The client opens a connection to the server port 21 on a client
port above 1023.
3. The client uses this connection to send commands to, and receive
replies from, the server.
This connection lasts through the FTP session.
• Data connection
The data connection is used for transferring data between the client
and server. A new data connection is opened for each FTP command.
The way the data connection is created depends on the type of FTP
session—active or passive.
In active FTP, the client actively opens a connection to the FTP server at
port 21. It uses a port number > 1023 as its port for the control
connection. The client then opens a new port (passive open) as its data
port and sends this port number across to the server using the PORT
command. The server then opens a data connection (active open) to the
data port specified in the PORT command of the client. The server uses
port 20 as its data connection port.
In passive FTP, the control connection is established the same as it is in
active FTP. In passive FTP, to establish a data connection the server
opens an arbitrary data port >1023. It uses the PASV command to send
the data port number to the client. The client connects to the port
specified by the PASV command and uses a different port >1023 as its
data port.