HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3
Table Of Contents
- HP-UX IPFilter Version A.03.05.13 Administrator's Guide
- Legal Notices
- Table of Contents
- Preface: About This Document
- 1 Installing and Configuring HP-UX IPFilter
- Overview of HP-UX IPFilter Installation
- Step 1: Checking HP-UX IPFilter Installation Prerequisites
- Step 2: Loading HP-UX IPFilter Software
- Step 3: Determining the Rules for IPFilter
- Step 4: Adding Rules to the Rules Files
- Step 5: Loading IPFilter and NAT Rules
- Step 6: Verifying the Installation and Configuration
- Kernel Tunable Parameters
- Supported and Unsupported Interfaces
- Troubleshooting HP-UX IPFilter
- 2 HP-UX IPFilter on HP-UX 11i Version 3
- 3 Rules and Keywords
- IPFilter Configuration Files
- Basic Rules Processing
- IPFilter Keywords
- pass and block: Controlling IP Traffic
- in and out: Bidirectional Filtering
- quick: Optimizing IPFilter Rules Processing
- on: Filtering by Network Interfaces
- from and to: Filtering by IP Addresses and Subnets
- log: Tracking Packets on a System
- proto: Controlling Specific Protocols
- opt and ipopts: Filtering on IP Options
- icmp-type: Filtering ICMP Traffic by Type
- port: Filtering on TCP and UDP Ports
- keep state: Protecting TCP, UDP, and ICMP Sessions
- flags: Tight Filtering Based on TCP Header Flags
- keep frags: Letting Fragmented Packets Pass
- with frags: Dropping Fragmented Packets
- with short: Dropping Short Fragments
- return-rst: Responding to Blocked TCP Packets
- return-icmp: Responding to Blocked ICMP Packets
- dup-to: Drop-Safe Logging
- NAT Keywords
- 4 Dynamic Connection Allocation
- 5 Firewall Building Concepts
- Blocking Services by Port Number
- Using Keep State
- Using Keep State with UDP
- Using Keep State with ICMP
- Logging Techniques
- Improving Performance with Rule Groups
- Localhost Filtering
- Using the to
- Creating a Complete Filter by Interface
- Combining IP Address and Network Interface Filtering
- Using Bidirectional Filtering Capabilities
- Using port and proto to Create a Secure Filter
- 6 HP-UX IPFilter Utilities
- 7 HP-UX IPFilter and FTP
- 8 HP-UX IPFilter and RPC
- 9 HP-UX IPFilter and IPSec
- 10 HP-UX IPFilter and Serviceguard
- A HP-UX IPFilter Configuration Examples
- B HP-UX IPFilter Static Linking
- C Performance Guidelines
- Index
Installing and Configuring HP-UX IPFilter
Kernel Tunable Parameters
Chapter 116
Limits of fr_statemax
The tunable fr_statemax indicates the number of state entries that can
be created and exist at the same time. The ipfstat -s command gives
general state table statistics. When the number of states created reaches
fr_statemax, HP-UX IPFilter attempts to free up state entries and
increments the maximum counter. If HP-UX IPFilter fails to free up
state entries, no more state entries are created. The maximum counter is
incremented each time a state entry cannot be created because the state
table is full. If the state table is full, the connection is let through, but no
state entry is created. This is true even if DCA mode is enabled.
Limits of fr_limitmax
The tunable fr_limitmax has been deprecated and is no longer used to
control the number of limit entries that can be created on the system.
ipl_buffer_sz
The tunable ipl_buffer_sz can be used to modify the size of the HP-UX
IPFilter logging buffer for /dev/ipl.
The ipfstat –B command gives the size of the log buffer and buffer
space currently used. It also displays the log buffer high water mark,
which specifies the maximum value attained by the log buffer.
NOTE The ability to check the log buffer size and space used was previously
done using the ndd tunable cur_iplbuf_sz. This functionality has been
replaced by the ipfstat -B command.
For information on changing the ipl_buffer_sz variable, see
“Configuring Kernel Tunable Parameters” on page 17.
Tunable
Name
Default
Value
Minimum
Value
Maximum
Value
ipl_buffer_sz 8192 bytes 1024 bytes 163840 bytes