HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3

Performance Guidelines
Rule Configuration
Appendix C184
Rule Configuration
To configure IPFilter rules for optimal system performance:
• Avoid using return-rst whenever possible.
From both security and performance perspectives, it is better for
IPFilter to block packets anonymous rather than returning a reset
packet with a known address.
• Avoid logging whenever possible.
Excessive logging can impact both storage and CPU performance on
the system. Determine the appropriate logging level for your
environment.
•Use the quick keyword whenever possible.
The quick keyword stops the rule search for a packet a rule matches.
Otherwise, IPFilter searches the entire ruleset, which can impact
performance if there are a large number of rules.
•Use keep state or keep limit rules whenever possible.
Each connection that matches the keep state or keep limit rule
searches through the rule set only once. The following packets for
that connection will match the existing state entry and not search
the rest of the ruleset.
•Use group rules whenever possible.
For more information, see “Improving Performance with Rule
Groups” on page 80.
In the following example, a connection from 15.13.104.72 must
search 102 rules before finding a match.
pass in quick proto tcp from 15.13.2.1 to any port = 23 keep
limit 1
pass in quick proto tcp from 15.13.2.2 to any port = 23 keep
limit 2
.
(15.13.2.3 to 15.13.2.99)
.
pass in quick proto tcp from 15.13.2.100 to any port = 23
keep limit 100
pass in quick proto tcp from 15.13.103.0/24 to any port = 23