HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3
Table Of Contents
- HP-UX IPFilter Version A.03.05.13 Administrator's Guide
- Legal Notices
- Table of Contents
- Preface: About This Document
- 1 Installing and Configuring HP-UX IPFilter
- Overview of HP-UX IPFilter Installation
- Step 1: Checking HP-UX IPFilter Installation Prerequisites
- Step 2: Loading HP-UX IPFilter Software
- Step 3: Determining the Rules for IPFilter
- Step 4: Adding Rules to the Rules Files
- Step 5: Loading IPFilter and NAT Rules
- Step 6: Verifying the Installation and Configuration
- Kernel Tunable Parameters
- Supported and Unsupported Interfaces
- Troubleshooting HP-UX IPFilter
- 2 HP-UX IPFilter on HP-UX 11i Version 3
- 3 Rules and Keywords
- IPFilter Configuration Files
- Basic Rules Processing
- IPFilter Keywords
- pass and block: Controlling IP Traffic
- in and out: Bidirectional Filtering
- quick: Optimizing IPFilter Rules Processing
- on: Filtering by Network Interfaces
- from and to: Filtering by IP Addresses and Subnets
- log: Tracking Packets on a System
- proto: Controlling Specific Protocols
- opt and ipopts: Filtering on IP Options
- icmp-type: Filtering ICMP Traffic by Type
- port: Filtering on TCP and UDP Ports
- keep state: Protecting TCP, UDP, and ICMP Sessions
- flags: Tight Filtering Based on TCP Header Flags
- keep frags: Letting Fragmented Packets Pass
- with frags: Dropping Fragmented Packets
- with short: Dropping Short Fragments
- return-rst: Responding to Blocked TCP Packets
- return-icmp: Responding to Blocked ICMP Packets
- dup-to: Drop-Safe Logging
- NAT Keywords
- 4 Dynamic Connection Allocation
- 5 Firewall Building Concepts
- Blocking Services by Port Number
- Using Keep State
- Using Keep State with UDP
- Using Keep State with ICMP
- Logging Techniques
- Improving Performance with Rule Groups
- Localhost Filtering
- Using the to
- Creating a Complete Filter by Interface
- Combining IP Address and Network Interface Filtering
- Using Bidirectional Filtering Capabilities
- Using port and proto to Create a Secure Filter
- 6 HP-UX IPFilter Utilities
- 7 HP-UX IPFilter and FTP
- 8 HP-UX IPFilter and RPC
- 9 HP-UX IPFilter and IPSec
- 10 HP-UX IPFilter and Serviceguard
- A HP-UX IPFilter Configuration Examples
- B HP-UX IPFilter Static Linking
- C Performance Guidelines
- Index
Rules and Keywords
IPFilter Keywords
Chapter 346
NOTE To use the flags
<option>
keyword, you must know the correct
designations for the flags you want to use in your rules. See RFC793,
Transmission Control Protocol Specifications for a list of TCP flags.
keep frags: Letting Fragmented Packets Pass
You can configure IPFilter to track fragmented packets and to pass
expected packet fragments. The keep frags keyword lets you configure
IPFilter to pass fragmented packets while blocking packets that might
be forgeries or port scans trying to attack the system.
In the following example, four rules are configured to log forgeries and
allow fragments:
pass in quick on lan0 proto tcp from any to 20.20.20.1/32
port = 23 flags S keep state keep frags
pass out quick on lan0 proto tcp from any to any keep state
flags S keep frags
block in log quick all
block out log quick all
In this example, every valid packet is entered into the state table before
the blocking rules are processed. To further protect the system, log initial
SYN packets to detect SYN scans.
with frags: Dropping Fragmented Packets
If you do not want packet fragments to pass through the firewall, use the
with frags keyword. The with frags keyword drops all packet
fragments. For example:
block in all with frags
with short: Dropping Short Fragments
You can configure IPFilter to drop packet fragments that are too short for
comparison using the with short keyword. This is useful for security
purposes, as an attacker can use fragments to attempt to access the
system. For example:
block in proto tcp all with short