HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3
Table Of Contents
- HP-UX IPFilter Version A.03.05.13 Administrator's Guide
- Legal Notices
- Table of Contents
- Preface: About This Document
- 1 Installing and Configuring HP-UX IPFilter
- Overview of HP-UX IPFilter Installation
- Step 1: Checking HP-UX IPFilter Installation Prerequisites
- Step 2: Loading HP-UX IPFilter Software
- Step 3: Determining the Rules for IPFilter
- Step 4: Adding Rules to the Rules Files
- Step 5: Loading IPFilter and NAT Rules
- Step 6: Verifying the Installation and Configuration
- Kernel Tunable Parameters
- Supported and Unsupported Interfaces
- Troubleshooting HP-UX IPFilter
- 2 HP-UX IPFilter on HP-UX 11i Version 3
- 3 Rules and Keywords
- IPFilter Configuration Files
- Basic Rules Processing
- IPFilter Keywords
- pass and block: Controlling IP Traffic
- in and out: Bidirectional Filtering
- quick: Optimizing IPFilter Rules Processing
- on: Filtering by Network Interfaces
- from and to: Filtering by IP Addresses and Subnets
- log: Tracking Packets on a System
- proto: Controlling Specific Protocols
- opt and ipopts: Filtering on IP Options
- icmp-type: Filtering ICMP Traffic by Type
- port: Filtering on TCP and UDP Ports
- keep state: Protecting TCP, UDP, and ICMP Sessions
- flags: Tight Filtering Based on TCP Header Flags
- keep frags: Letting Fragmented Packets Pass
- with frags: Dropping Fragmented Packets
- with short: Dropping Short Fragments
- return-rst: Responding to Blocked TCP Packets
- return-icmp: Responding to Blocked ICMP Packets
- dup-to: Drop-Safe Logging
- NAT Keywords
- 4 Dynamic Connection Allocation
- 5 Firewall Building Concepts
- Blocking Services by Port Number
- Using Keep State
- Using Keep State with UDP
- Using Keep State with ICMP
- Logging Techniques
- Improving Performance with Rule Groups
- Localhost Filtering
- Using the to
- Creating a Complete Filter by Interface
- Combining IP Address and Network Interface Filtering
- Using Bidirectional Filtering Capabilities
- Using port and proto to Create a Secure Filter
- 6 HP-UX IPFilter Utilities
- 7 HP-UX IPFilter and FTP
- 8 HP-UX IPFilter and RPC
- 9 HP-UX IPFilter and IPSec
- 10 HP-UX IPFilter and Serviceguard
- A HP-UX IPFilter Configuration Examples
- B HP-UX IPFilter Static Linking
- C Performance Guidelines
- Index
Installing and Configuring HP-UX IPFilter
Step 5: Loading IPFilter and NAT Rules
Chapter 110
Step 5: Loading IPFilter and NAT Rules
This section describes how to install rules in the HP-UX IPFilter and
NAT rules file to run on your system.
Loading IPFilter Rules
NOTE The following is a list of commands and file names, some of which are
very similar:
• ipfboot—The startup script for the ipf module.
• /etc/rc.config.d/ipfconf—The configuration file for the ipfboot
startup script.
• /etc/opt/ipf/ipf.conf—The default IPFilter rules file. Any rules
present in this file are automatically loaded at bootup by the
ipfboot startup script.
The configuration file, ipfconf, contains information that determines
how HP-UX IPFilter starts when the system is rebooted. When HP-UX
IPFilter is installed, the ipfconf file is put in the /etc/rc.config.d
directory. The HP-UX IPFilter ipfboot startup script reads ipfconf.
By default, HP-UX IPFilter starts on bootup and the rules from the
/etc/opt/ipf/ipf.conf file are processed. If you do not want the rules
to load on bootup, place your rules in an alternate location and then
manually load the rules using the ipf command.
• Add new rules to your rules file using the -f option of the ipf
command:
ipf -f <
rules file
>
NOTE When a rule has been loaded, it takes effect immediately. For
example, if you add a rule to block all traffic and load it using ipf -f
<
rules file
>, you will be blocked from X-Windows and networking
processes.