HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3
Table Of Contents
- HP-UX IPFilter Version A.03.05.13 Administrator's Guide
- Legal Notices
- Table of Contents
- Preface: About This Document
- 1 Installing and Configuring HP-UX IPFilter
- Overview of HP-UX IPFilter Installation
- Step 1: Checking HP-UX IPFilter Installation Prerequisites
- Step 2: Loading HP-UX IPFilter Software
- Step 3: Determining the Rules for IPFilter
- Step 4: Adding Rules to the Rules Files
- Step 5: Loading IPFilter and NAT Rules
- Step 6: Verifying the Installation and Configuration
- Kernel Tunable Parameters
- Supported and Unsupported Interfaces
- Troubleshooting HP-UX IPFilter
- 2 HP-UX IPFilter on HP-UX 11i Version 3
- 3 Rules and Keywords
- IPFilter Configuration Files
- Basic Rules Processing
- IPFilter Keywords
- pass and block: Controlling IP Traffic
- in and out: Bidirectional Filtering
- quick: Optimizing IPFilter Rules Processing
- on: Filtering by Network Interfaces
- from and to: Filtering by IP Addresses and Subnets
- log: Tracking Packets on a System
- proto: Controlling Specific Protocols
- opt and ipopts: Filtering on IP Options
- icmp-type: Filtering ICMP Traffic by Type
- port: Filtering on TCP and UDP Ports
- keep state: Protecting TCP, UDP, and ICMP Sessions
- flags: Tight Filtering Based on TCP Header Flags
- keep frags: Letting Fragmented Packets Pass
- with frags: Dropping Fragmented Packets
- with short: Dropping Short Fragments
- return-rst: Responding to Blocked TCP Packets
- return-icmp: Responding to Blocked ICMP Packets
- dup-to: Drop-Safe Logging
- NAT Keywords
- 4 Dynamic Connection Allocation
- 5 Firewall Building Concepts
- Blocking Services by Port Number
- Using Keep State
- Using Keep State with UDP
- Using Keep State with ICMP
- Logging Techniques
- Improving Performance with Rule Groups
- Localhost Filtering
- Using the to
- Creating a Complete Filter by Interface
- Combining IP Address and Network Interface Filtering
- Using Bidirectional Filtering Capabilities
- Using port and proto to Create a Secure Filter
- 6 HP-UX IPFilter Utilities
- 7 HP-UX IPFilter and FTP
- 8 HP-UX IPFilter and RPC
- 9 HP-UX IPFilter and IPSec
- 10 HP-UX IPFilter and Serviceguard
- A HP-UX IPFilter Configuration Examples
- B HP-UX IPFilter Static Linking
- C Performance Guidelines
- Index
Installing and Configuring HP-UX IPFilter
Step 4: Adding Rules to the Rules Files
Chapter 18
Step 4: Adding Rules to the Rules Files
To add your rules to the /etc/opt/ipf/ipf.conf file (or your chosen
rules file) and to the /etc/opt/ipf/ipnat.conf file, use a text editor
such as vi.
NOTE DCA rules are added along with IPFilter rules in the
/etc/opt/ipf/ipf.conf file or your selected rules file. DCA rules can
be used with or without IPFilter rules. If using the DCA feature, DCA
mode must be turned on. For more information, see “DCA Mode” on
page 69.
Adding IPFilter Rules
When IPFilter is installed, the default rules file, ipf.conf, is empty. You
must add rules to this file to create a firewall. Alternately, you can
change the configuration to read different rules files you specify.
Filtering rules added to /etc/opt/ipf/ipf.conf are loaded when the
system is booted. If you do not want the rules to load on bootup, place
your rules in an alternate location, such as /etc/ipf.conf. You can then
load these rules manually using the ipf command.
See the example rulesets in Appendix A, “HP-UX IPFilter Configuration
Examples,” on page 145 for assistance in putting your ruleset together.
You can find additional information on the ipf command in “The ipf
Utility” on page 91.
Adding NAT Rules
When IPFilter is installed, the default NAT rules file ipnat.conf is
empty. You must add rules to this file to enable NAT. Alternately, you can
change the configuration to read different NAT rules files you specify by
changing the default configuration file name or location in the
/etc/rc.config.d/ipfconf file.