HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3
Table Of Contents
- HP-UX IPFilter Version A.03.05.13 Administrator's Guide
- Legal Notices
- Table of Contents
- Preface: About This Document
- 1 Installing and Configuring HP-UX IPFilter
- Overview of HP-UX IPFilter Installation
- Step 1: Checking HP-UX IPFilter Installation Prerequisites
- Step 2: Loading HP-UX IPFilter Software
- Step 3: Determining the Rules for IPFilter
- Step 4: Adding Rules to the Rules Files
- Step 5: Loading IPFilter and NAT Rules
- Step 6: Verifying the Installation and Configuration
- Kernel Tunable Parameters
- Supported and Unsupported Interfaces
- Troubleshooting HP-UX IPFilter
- 2 HP-UX IPFilter on HP-UX 11i Version 3
- 3 Rules and Keywords
- IPFilter Configuration Files
- Basic Rules Processing
- IPFilter Keywords
- pass and block: Controlling IP Traffic
- in and out: Bidirectional Filtering
- quick: Optimizing IPFilter Rules Processing
- on: Filtering by Network Interfaces
- from and to: Filtering by IP Addresses and Subnets
- log: Tracking Packets on a System
- proto: Controlling Specific Protocols
- opt and ipopts: Filtering on IP Options
- icmp-type: Filtering ICMP Traffic by Type
- port: Filtering on TCP and UDP Ports
- keep state: Protecting TCP, UDP, and ICMP Sessions
- flags: Tight Filtering Based on TCP Header Flags
- keep frags: Letting Fragmented Packets Pass
- with frags: Dropping Fragmented Packets
- with short: Dropping Short Fragments
- return-rst: Responding to Blocked TCP Packets
- return-icmp: Responding to Blocked ICMP Packets
- dup-to: Drop-Safe Logging
- NAT Keywords
- 4 Dynamic Connection Allocation
- 5 Firewall Building Concepts
- Blocking Services by Port Number
- Using Keep State
- Using Keep State with UDP
- Using Keep State with ICMP
- Logging Techniques
- Improving Performance with Rule Groups
- Localhost Filtering
- Using the to
- Creating a Complete Filter by Interface
- Combining IP Address and Network Interface Filtering
- Using Bidirectional Filtering Capabilities
- Using port and proto to Create a Secure Filter
- 6 HP-UX IPFilter Utilities
- 7 HP-UX IPFilter and FTP
- 8 HP-UX IPFilter and RPC
- 9 HP-UX IPFilter and IPSec
- 10 HP-UX IPFilter and Serviceguard
- A HP-UX IPFilter Configuration Examples
- B HP-UX IPFilter Static Linking
- C Performance Guidelines
- Index
Rules and Keywords
IPFilter Keywords
Chapter 3 37
NOTE If you do not specify any out rules, the implied default is pass out all.
If you do not specify any in rules, the implied default is pass in all.
quick: Optimizing IPFilter Rules Processing
HP-UX IPFilter behaves differently from other packet filters. Because it
processes the whole ruleset for each packet, there might be a
performance impact if your rules file is configured so that the most
applicable rules are in the first 10 of 100 rules.
You can use the quick keyword to control rule processing and reduce
performance impact on your IPFilter system. If IPFilter matches a
packet to a rule that contains quick, IPFilter immediately acts on that
rule without continuing to check the packet against the other rules in the
ruleset. For example, if you configure the following ruleset:
block in quick all
pass in all
IPFilter matches all packets to the first rule, block in quick all and
blocks the packet. Because quick is used, IPFilter does not consider the
other rule in the ruleset.
on: Filtering by Network Interfaces
You can use the on keyword to control traffic to and from your system
based on network interfaces.
Your system can have interfaces to more than one network. Every packet
the system receives comes in on a network interface; every packet the
system transmits goes out on a network interface.
For example, your machine has two interfaces, lan0 and lan1, and you
do not want packets coming in on the lan0 interface. You add the
following rules:
block in quick on lan0 all
pass in all
The on keyword means that network traffic is coming in on the named
interface, lan0. If a packet comes in on lan0, the first rule blocks it. If a
packet comes in on lan1, the first rule does not match. The second rule
matches and the packet is passed.