HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3
Table Of Contents
- HP-UX IPFilter Version A.03.05.13 Administrator's Guide
- Legal Notices
- Table of Contents
- Preface: About This Document
- 1 Installing and Configuring HP-UX IPFilter
- Overview of HP-UX IPFilter Installation
- Step 1: Checking HP-UX IPFilter Installation Prerequisites
- Step 2: Loading HP-UX IPFilter Software
- Step 3: Determining the Rules for IPFilter
- Step 4: Adding Rules to the Rules Files
- Step 5: Loading IPFilter and NAT Rules
- Step 6: Verifying the Installation and Configuration
- Kernel Tunable Parameters
- Supported and Unsupported Interfaces
- Troubleshooting HP-UX IPFilter
- 2 HP-UX IPFilter on HP-UX 11i Version 3
- 3 Rules and Keywords
- IPFilter Configuration Files
- Basic Rules Processing
- IPFilter Keywords
- pass and block: Controlling IP Traffic
- in and out: Bidirectional Filtering
- quick: Optimizing IPFilter Rules Processing
- on: Filtering by Network Interfaces
- from and to: Filtering by IP Addresses and Subnets
- log: Tracking Packets on a System
- proto: Controlling Specific Protocols
- opt and ipopts: Filtering on IP Options
- icmp-type: Filtering ICMP Traffic by Type
- port: Filtering on TCP and UDP Ports
- keep state: Protecting TCP, UDP, and ICMP Sessions
- flags: Tight Filtering Based on TCP Header Flags
- keep frags: Letting Fragmented Packets Pass
- with frags: Dropping Fragmented Packets
- with short: Dropping Short Fragments
- return-rst: Responding to Blocked TCP Packets
- return-icmp: Responding to Blocked ICMP Packets
- dup-to: Drop-Safe Logging
- NAT Keywords
- 4 Dynamic Connection Allocation
- 5 Firewall Building Concepts
- Blocking Services by Port Number
- Using Keep State
- Using Keep State with UDP
- Using Keep State with ICMP
- Logging Techniques
- Improving Performance with Rule Groups
- Localhost Filtering
- Using the to
- Creating a Complete Filter by Interface
- Combining IP Address and Network Interface Filtering
- Using Bidirectional Filtering Capabilities
- Using port and proto to Create a Secure Filter
- 6 HP-UX IPFilter Utilities
- 7 HP-UX IPFilter and FTP
- 8 HP-UX IPFilter and RPC
- 9 HP-UX IPFilter and IPSec
- 10 HP-UX IPFilter and Serviceguard
- A HP-UX IPFilter Configuration Examples
- B HP-UX IPFilter Static Linking
- C Performance Guidelines
- Index
HP-UX IPFilter and RPC
Configuration Files
Chapter 8 123
Configuration Files
Rules Files
This section gives details on the two rules files that contain the IPFilter
rules. The two rules files are:
• The IPFilter rules file specified in $IPF_CONF in
/etc/rc.config.d/ipfconf
• The IPFilter RPC rules file specified in $RPC_RULES_FILE specified
in /etc/rc.config.d/rpc_ipfconf
NOTE See the following section for a description of
/etc/rc.config.d/rpc_ipfconf. A sample file is also provided.
To incorporate the dynamic ports used by the NFS processes, the
administrator should decide the position from which RPC rule should be
configured by setting RPC_RULE_POSITION to the desired value. For
example:
RPC_RULE_POSITION=5
The RPC rules will then be added from the 5th position onwards. If there
are 10 RPC rules, they will be inserted at positions 5 to 14. The position
must be chosen carefully. If there are only two rules present, then
RPC_RULE_POSITION must be 1,2 or 3 [RPC_RULE_POSITION =
<current
# of rules>
]. The Original rules file specified in
/etc/rc.config.d/ipfconf containing other rules is not modified.
By default, all RPC rules are configured as the first rules, for example,
RPC_RULE_POSITION=1. The RPC rules are well defined in terms of IP
addresses and ports and will have unique matches and, since they are
quick rules, they should be at top.
RPC Rules Configuration File
This file specifies details based on which IPFilter RPC rules will be
generated. /etc/opt/ipf/rpc.ipf/rpc_ipfconf.sample is provided as
an example.