HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3
Table Of Contents
- HP-UX IPFilter Version A.03.05.13 Administrator's Guide
- Legal Notices
- Table of Contents
- Preface: About This Document
- 1 Installing and Configuring HP-UX IPFilter
- Overview of HP-UX IPFilter Installation
- Step 1: Checking HP-UX IPFilter Installation Prerequisites
- Step 2: Loading HP-UX IPFilter Software
- Step 3: Determining the Rules for IPFilter
- Step 4: Adding Rules to the Rules Files
- Step 5: Loading IPFilter and NAT Rules
- Step 6: Verifying the Installation and Configuration
- Kernel Tunable Parameters
- Supported and Unsupported Interfaces
- Troubleshooting HP-UX IPFilter
- 2 HP-UX IPFilter on HP-UX 11i Version 3
- 3 Rules and Keywords
- IPFilter Configuration Files
- Basic Rules Processing
- IPFilter Keywords
- pass and block: Controlling IP Traffic
- in and out: Bidirectional Filtering
- quick: Optimizing IPFilter Rules Processing
- on: Filtering by Network Interfaces
- from and to: Filtering by IP Addresses and Subnets
- log: Tracking Packets on a System
- proto: Controlling Specific Protocols
- opt and ipopts: Filtering on IP Options
- icmp-type: Filtering ICMP Traffic by Type
- port: Filtering on TCP and UDP Ports
- keep state: Protecting TCP, UDP, and ICMP Sessions
- flags: Tight Filtering Based on TCP Header Flags
- keep frags: Letting Fragmented Packets Pass
- with frags: Dropping Fragmented Packets
- with short: Dropping Short Fragments
- return-rst: Responding to Blocked TCP Packets
- return-icmp: Responding to Blocked ICMP Packets
- dup-to: Drop-Safe Logging
- NAT Keywords
- 4 Dynamic Connection Allocation
- 5 Firewall Building Concepts
- Blocking Services by Port Number
- Using Keep State
- Using Keep State with UDP
- Using Keep State with ICMP
- Logging Techniques
- Improving Performance with Rule Groups
- Localhost Filtering
- Using the to
- Creating a Complete Filter by Interface
- Combining IP Address and Network Interface Filtering
- Using Bidirectional Filtering Capabilities
- Using port and proto to Create a Secure Filter
- 6 HP-UX IPFilter Utilities
- 7 HP-UX IPFilter and FTP
- 8 HP-UX IPFilter and RPC
- 9 HP-UX IPFilter and IPSec
- 10 HP-UX IPFilter and Serviceguard
- A HP-UX IPFilter Configuration Examples
- B HP-UX IPFilter Static Linking
- C Performance Guidelines
- Index
Dynamic Connection Allocation
DCA with HP-UX IPFilter
Chapter 4 55
DCA with HP-UX IPFilter
An HP-UX IPFilter system can act as a secure intermediary, tracking all
incoming TCP connections to a system or network. DCA lets you limit
incoming TCP connections passing through an IPFilter system. DCA
uses stateful packet inspection to limit the number of incoming TCP
connections to a system.
To use DCA functionality, be sure DCA mode is enabled. For more
information, see “DCA Mode” on page 69. DCA functionality does not
work if DCA mode is not enabled.
Overview: DCA Functionality
DCA provides a set of flexible rules for controlling incoming TCP
connections. You allocate a number of TCP connections to a system using
a limit value. The limit value is the number of concurrent TCP
connections that can be established by any given source.
You can configure DCA rules to limit the number of connections from:
• A specific IP address.
• Each IP address in an IP subnet or IP address range.
• An IP subnet or IP address range where all the IP addresses in the
subnet share the cumulative limit.
• Unknown IP addresses, where each unknown IP address has a
connection limit.
When the configured limit is reached, any additional connections to the
HP-UX IPFilter system are dropped. You can configure HP-UX IPFilter
to send a TCP reset when it drops these connection. See “return-rst:
Responding to Blocked TCP Packets” on page 47 for more information.
A set of commands helps collect data about the connections that are
being controlled. This data includes the source and destination IP
address, allocated number of connections, number of active connections,
and number of times the allocated quota of connections was exceeded.
These new commands can be found in:
• “The ipf Utility” on page 91.
— ipf -Q
<interface name>