HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3
Table Of Contents
- HP-UX IPFilter Version A.03.05.13 Administrator's Guide
- Legal Notices
- Table of Contents
- Preface: About This Document
- 1 Installing and Configuring HP-UX IPFilter
- Overview of HP-UX IPFilter Installation
- Step 1: Checking HP-UX IPFilter Installation Prerequisites
- Step 2: Loading HP-UX IPFilter Software
- Step 3: Determining the Rules for IPFilter
- Step 4: Adding Rules to the Rules Files
- Step 5: Loading IPFilter and NAT Rules
- Step 6: Verifying the Installation and Configuration
- Kernel Tunable Parameters
- Supported and Unsupported Interfaces
- Troubleshooting HP-UX IPFilter
- 2 HP-UX IPFilter on HP-UX 11i Version 3
- 3 Rules and Keywords
- IPFilter Configuration Files
- Basic Rules Processing
- IPFilter Keywords
- pass and block: Controlling IP Traffic
- in and out: Bidirectional Filtering
- quick: Optimizing IPFilter Rules Processing
- on: Filtering by Network Interfaces
- from and to: Filtering by IP Addresses and Subnets
- log: Tracking Packets on a System
- proto: Controlling Specific Protocols
- opt and ipopts: Filtering on IP Options
- icmp-type: Filtering ICMP Traffic by Type
- port: Filtering on TCP and UDP Ports
- keep state: Protecting TCP, UDP, and ICMP Sessions
- flags: Tight Filtering Based on TCP Header Flags
- keep frags: Letting Fragmented Packets Pass
- with frags: Dropping Fragmented Packets
- with short: Dropping Short Fragments
- return-rst: Responding to Blocked TCP Packets
- return-icmp: Responding to Blocked ICMP Packets
- dup-to: Drop-Safe Logging
- NAT Keywords
- 4 Dynamic Connection Allocation
- 5 Firewall Building Concepts
- Blocking Services by Port Number
- Using Keep State
- Using Keep State with UDP
- Using Keep State with ICMP
- Logging Techniques
- Improving Performance with Rule Groups
- Localhost Filtering
- Using the to
- Creating a Complete Filter by Interface
- Combining IP Address and Network Interface Filtering
- Using Bidirectional Filtering Capabilities
- Using port and proto to Create a Secure Filter
- 6 HP-UX IPFilter Utilities
- 7 HP-UX IPFilter and FTP
- 8 HP-UX IPFilter and RPC
- 9 HP-UX IPFilter and IPSec
- 10 HP-UX IPFilter and Serviceguard
- A HP-UX IPFilter Configuration Examples
- B HP-UX IPFilter Static Linking
- C Performance Guidelines
- Index
Rules and Keywords
NAT Keywords
Chapter 3 49
NAT Keywords
The following section describes keywords specific to NAT functionality.
NOTE The maximum number of concurrent connections NAT can support is
16,383.
map and portmap: Basic NAT
Use the map keyword to create basic IPFilter NAT rules.
If you do not know the IP address of the target systems, configure the
following rule:
map lan0 192.168.1.0/24 -> 0/32
IPFilter NAT automatically detects the IP address of the outgoing
interface and translates 0/32 to the IP address of that interface.
Outgoing traffic addresses are translated to the outgoing interface IP
address.
If you do know the IP address of the outgoing interface, configure the
following rule:
map lan0 192.168.1.0/24 -> 20.20.20.1/32
IPFilter NAT translates the source IP addresses of the outgoing packets
to 20.20.20.1.
You can use the portmap keyword to force a translated IP packet onto a
specific port on the target system. This is useful if there is another
firewall the packet must pass through or if many systems are trying to
use the same source port.
To force TCP and UDP packets onto a specific port range, configure the
following rule:
map lan0 192.168.1.0/24 -> 0/32 portmap tcp/udp 20000:30000
All translated TCP and UDP packets are forced through ports 20000
through 30000.