HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3
Table Of Contents
- HP-UX IPFilter Version A.03.05.13 Administrator's Guide
- Legal Notices
- Table of Contents
- Preface: About This Document
- 1 Installing and Configuring HP-UX IPFilter
- Overview of HP-UX IPFilter Installation
- Step 1: Checking HP-UX IPFilter Installation Prerequisites
- Step 2: Loading HP-UX IPFilter Software
- Step 3: Determining the Rules for IPFilter
- Step 4: Adding Rules to the Rules Files
- Step 5: Loading IPFilter and NAT Rules
- Step 6: Verifying the Installation and Configuration
- Kernel Tunable Parameters
- Supported and Unsupported Interfaces
- Troubleshooting HP-UX IPFilter
- 2 HP-UX IPFilter on HP-UX 11i Version 3
- 3 Rules and Keywords
- IPFilter Configuration Files
- Basic Rules Processing
- IPFilter Keywords
- pass and block: Controlling IP Traffic
- in and out: Bidirectional Filtering
- quick: Optimizing IPFilter Rules Processing
- on: Filtering by Network Interfaces
- from and to: Filtering by IP Addresses and Subnets
- log: Tracking Packets on a System
- proto: Controlling Specific Protocols
- opt and ipopts: Filtering on IP Options
- icmp-type: Filtering ICMP Traffic by Type
- port: Filtering on TCP and UDP Ports
- keep state: Protecting TCP, UDP, and ICMP Sessions
- flags: Tight Filtering Based on TCP Header Flags
- keep frags: Letting Fragmented Packets Pass
- with frags: Dropping Fragmented Packets
- with short: Dropping Short Fragments
- return-rst: Responding to Blocked TCP Packets
- return-icmp: Responding to Blocked ICMP Packets
- dup-to: Drop-Safe Logging
- NAT Keywords
- 4 Dynamic Connection Allocation
- 5 Firewall Building Concepts
- Blocking Services by Port Number
- Using Keep State
- Using Keep State with UDP
- Using Keep State with ICMP
- Logging Techniques
- Improving Performance with Rule Groups
- Localhost Filtering
- Using the to
- Creating a Complete Filter by Interface
- Combining IP Address and Network Interface Filtering
- Using Bidirectional Filtering Capabilities
- Using port and proto to Create a Secure Filter
- 6 HP-UX IPFilter Utilities
- 7 HP-UX IPFilter and FTP
- 8 HP-UX IPFilter and RPC
- 9 HP-UX IPFilter and IPSec
- 10 HP-UX IPFilter and Serviceguard
- A HP-UX IPFilter Configuration Examples
- B HP-UX IPFilter Static Linking
- C Performance Guidelines
- Index
191
A
active rules list
, 11
adding keep limit rules, 67
B
bidirectional filtering
in keyword
, 36
out keyword, 36
bidirectional filtering with IPSec, 130
bimap keyword, 50
block keyword, 36
blocked traffic
IPSec
correcting
, 131
C
checklist
installation and configuration
, 3
commands
unsupported, 110
configuration
checklist
, 3
rules file, 34
rules processing, 35
verifying, 13
configuration examples, 147
configuring
file conventions, 10, 34
configuring kernel tunables, 17
D
DCA
keywords
, 57
logging command, 103
overview, 55
processing commands, 92
remote failover, 143
rule modifications, 65
setting mode, 69, 92
syntax, 62
DCA keywords
keep limit
, 57
log limit, 59
log limit freq, 61
DCA_START configuration option, 69
debugging
ipfstat utility
, 96
Denial of Service attack defense, 40
disabling, 27
drop-safe logging
to keyword, 83
dup-to keyword, 48
Dynamic Connection Allocation
See DCA
dynamic linking
, 177
E
enabling
, 27
examples
configuration
basic
, 147, 150
TCP, 169
extracting keep limit rules, 68
F
filtering
bidirectional
, 36
by interface, 37
by IP address, 38
by subnet, 38
by TCP header flags, 45
ICMP packets, 41
IP address and interface, 38
localhost, 82
on IP options, 40
package IP address, 138
port number, 43
filtering on flags
confusing with keeping state, 74
firewall
basic configuration, 26, 33
flags keyword, 45
fr_limitmax, 16
fr_statemax, 15
fr_tcpidletimeout, 14
from keyword, 38
FTP
active FTP
client
, 117
server, 115
how it works, 113
passive FTP
client
, 118
server, 115
WU-FTPD, 114