HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3
Table Of Contents
- HP-UX IPFilter Version A.03.05.13 Administrator's Guide
- Legal Notices
- Table of Contents
- Preface: About This Document
- 1 Installing and Configuring HP-UX IPFilter
- Overview of HP-UX IPFilter Installation
- Step 1: Checking HP-UX IPFilter Installation Prerequisites
- Step 2: Loading HP-UX IPFilter Software
- Step 3: Determining the Rules for IPFilter
- Step 4: Adding Rules to the Rules Files
- Step 5: Loading IPFilter and NAT Rules
- Step 6: Verifying the Installation and Configuration
- Kernel Tunable Parameters
- Supported and Unsupported Interfaces
- Troubleshooting HP-UX IPFilter
- 2 HP-UX IPFilter on HP-UX 11i Version 3
- 3 Rules and Keywords
- IPFilter Configuration Files
- Basic Rules Processing
- IPFilter Keywords
- pass and block: Controlling IP Traffic
- in and out: Bidirectional Filtering
- quick: Optimizing IPFilter Rules Processing
- on: Filtering by Network Interfaces
- from and to: Filtering by IP Addresses and Subnets
- log: Tracking Packets on a System
- proto: Controlling Specific Protocols
- opt and ipopts: Filtering on IP Options
- icmp-type: Filtering ICMP Traffic by Type
- port: Filtering on TCP and UDP Ports
- keep state: Protecting TCP, UDP, and ICMP Sessions
- flags: Tight Filtering Based on TCP Header Flags
- keep frags: Letting Fragmented Packets Pass
- with frags: Dropping Fragmented Packets
- with short: Dropping Short Fragments
- return-rst: Responding to Blocked TCP Packets
- return-icmp: Responding to Blocked ICMP Packets
- dup-to: Drop-Safe Logging
- NAT Keywords
- 4 Dynamic Connection Allocation
- 5 Firewall Building Concepts
- Blocking Services by Port Number
- Using Keep State
- Using Keep State with UDP
- Using Keep State with ICMP
- Logging Techniques
- Improving Performance with Rule Groups
- Localhost Filtering
- Using the to
- Creating a Complete Filter by Interface
- Combining IP Address and Network Interface Filtering
- Using Bidirectional Filtering Capabilities
- Using port and proto to Create a Secure Filter
- 6 HP-UX IPFilter Utilities
- 7 HP-UX IPFilter and FTP
- 8 HP-UX IPFilter and RPC
- 9 HP-UX IPFilter and IPSec
- 10 HP-UX IPFilter and Serviceguard
- A HP-UX IPFilter Configuration Examples
- B HP-UX IPFilter Static Linking
- C Performance Guidelines
- Index
Rules and Keywords
IPFilter Keywords
Chapter 3 39
You can combine specific from
ip_address
and to
ip_address
keywords to restrict traffic based on both source and destination IP
addresses.
You can also filter traffic using both IP addresses and network interface
names. For example, you want data from lan0, but not from
192.168.0.0/16. Configure the following rules:
block in quick on lan0 from 192.168.0.0/16 to any
pass in all
With this ruleset, the on lan0 keyword means that a packet is blocked
only if it comes in on the lan0 interface. If a packet comes in on the lan0
interface from 192.168.0.0/16, it passes.
log: Tracking Packets on a System
You can use the logging capability of IPFilter to track incoming and
outgoing packets. Logging lets you determine if your IPFilter system is
being attacked, and gives you some information about attacks.
While it is unnecessary to log every passed packet and, in some cases,
every blocked packet, you can select to log specific blocked or passed
packets. For example, if you want to log blocked packets from a specific
address, such as 20.20.20.0/24, use the following rule:
block in log quick on lan0 from 20.20.20.0/24 to any
You can use the log keyword with any IPFilter rule. HP recommends
deciding which rules are the most important or the most likely to block
attacks on your system and logging only those rules.
NOTE The log keyword can be used with several advanced options to control
and enhance logging functionality and performance. See “Logging
Techniques” on page 78 for more information.