HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3
Table Of Contents
- HP-UX IPFilter Version A.03.05.13 Administrator's Guide
- Legal Notices
- Table of Contents
- Preface: About This Document
- 1 Installing and Configuring HP-UX IPFilter
- Overview of HP-UX IPFilter Installation
- Step 1: Checking HP-UX IPFilter Installation Prerequisites
- Step 2: Loading HP-UX IPFilter Software
- Step 3: Determining the Rules for IPFilter
- Step 4: Adding Rules to the Rules Files
- Step 5: Loading IPFilter and NAT Rules
- Step 6: Verifying the Installation and Configuration
- Kernel Tunable Parameters
- Supported and Unsupported Interfaces
- Troubleshooting HP-UX IPFilter
- 2 HP-UX IPFilter on HP-UX 11i Version 3
- 3 Rules and Keywords
- IPFilter Configuration Files
- Basic Rules Processing
- IPFilter Keywords
- pass and block: Controlling IP Traffic
- in and out: Bidirectional Filtering
- quick: Optimizing IPFilter Rules Processing
- on: Filtering by Network Interfaces
- from and to: Filtering by IP Addresses and Subnets
- log: Tracking Packets on a System
- proto: Controlling Specific Protocols
- opt and ipopts: Filtering on IP Options
- icmp-type: Filtering ICMP Traffic by Type
- port: Filtering on TCP and UDP Ports
- keep state: Protecting TCP, UDP, and ICMP Sessions
- flags: Tight Filtering Based on TCP Header Flags
- keep frags: Letting Fragmented Packets Pass
- with frags: Dropping Fragmented Packets
- with short: Dropping Short Fragments
- return-rst: Responding to Blocked TCP Packets
- return-icmp: Responding to Blocked ICMP Packets
- dup-to: Drop-Safe Logging
- NAT Keywords
- 4 Dynamic Connection Allocation
- 5 Firewall Building Concepts
- Blocking Services by Port Number
- Using Keep State
- Using Keep State with UDP
- Using Keep State with ICMP
- Logging Techniques
- Improving Performance with Rule Groups
- Localhost Filtering
- Using the to
- Creating a Complete Filter by Interface
- Combining IP Address and Network Interface Filtering
- Using Bidirectional Filtering Capabilities
- Using port and proto to Create a Secure Filter
- 6 HP-UX IPFilter Utilities
- 7 HP-UX IPFilter and FTP
- 8 HP-UX IPFilter and RPC
- 9 HP-UX IPFilter and IPSec
- 10 HP-UX IPFilter and Serviceguard
- A HP-UX IPFilter Configuration Examples
- B HP-UX IPFilter Static Linking
- C Performance Guidelines
- Index
Rules and Keywords
IPFilter Keywords
Chapter 338
from and to: Filtering by IP Addresses and Subnets
IPFilter can pass or block packets based on both source and destination
IP addresses. It can also filter on subnets.
To configure IPFilter to pass or block packets based on their source IP
address, use the from
ip_address
keyword. For example:
block in quick from 192.168.0.0 to any
For traffic coming from any address within a subnet, you can use from
with the following subnet address syntax:
block in quick from 192.168.0.0/16 to any
For traffic coming from any address within a range of addresses, you can
use from with the following address range syntax:
block in quick from 192.168.32.2-192.168.32.100 to any
To configure IPFilter to pass or block packets based on their destination
IP address, use the to
ip_address
keyword. For example:
block in quick from any to 192.168.0.0
For packets originating in or destined for a subnet, you can use either to
or from with any of the following subnet address syntaxes:
• A standard dot-notation address mask, for example:
pass in from 192.168.1.1 to any
• A single hexadecimal number with a leading 0x, for example:
pass in proto tcp from 0xc0a80101 to any
or use the integer format, for example:
pass in from 3232235777 to any
NOTE 0xc0a80101 and 3233325777 are the hexadecimal and integer
representations of 192.168.1.1, respectively.
• A Classless Inter-Domain Routing (CIDR) notation, such as:
pass in from 192.168.1.1/24 to any