HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3
Table Of Contents
- HP-UX IPFilter Version A.03.05.13 Administrator's Guide
- Legal Notices
- Table of Contents
- Preface: About This Document
- 1 Installing and Configuring HP-UX IPFilter
- Overview of HP-UX IPFilter Installation
- Step 1: Checking HP-UX IPFilter Installation Prerequisites
- Step 2: Loading HP-UX IPFilter Software
- Step 3: Determining the Rules for IPFilter
- Step 4: Adding Rules to the Rules Files
- Step 5: Loading IPFilter and NAT Rules
- Step 6: Verifying the Installation and Configuration
- Kernel Tunable Parameters
- Supported and Unsupported Interfaces
- Troubleshooting HP-UX IPFilter
- 2 HP-UX IPFilter on HP-UX 11i Version 3
- 3 Rules and Keywords
- IPFilter Configuration Files
- Basic Rules Processing
- IPFilter Keywords
- pass and block: Controlling IP Traffic
- in and out: Bidirectional Filtering
- quick: Optimizing IPFilter Rules Processing
- on: Filtering by Network Interfaces
- from and to: Filtering by IP Addresses and Subnets
- log: Tracking Packets on a System
- proto: Controlling Specific Protocols
- opt and ipopts: Filtering on IP Options
- icmp-type: Filtering ICMP Traffic by Type
- port: Filtering on TCP and UDP Ports
- keep state: Protecting TCP, UDP, and ICMP Sessions
- flags: Tight Filtering Based on TCP Header Flags
- keep frags: Letting Fragmented Packets Pass
- with frags: Dropping Fragmented Packets
- with short: Dropping Short Fragments
- return-rst: Responding to Blocked TCP Packets
- return-icmp: Responding to Blocked ICMP Packets
- dup-to: Drop-Safe Logging
- NAT Keywords
- 4 Dynamic Connection Allocation
- 5 Firewall Building Concepts
- Blocking Services by Port Number
- Using Keep State
- Using Keep State with UDP
- Using Keep State with ICMP
- Logging Techniques
- Improving Performance with Rule Groups
- Localhost Filtering
- Using the to
- Creating a Complete Filter by Interface
- Combining IP Address and Network Interface Filtering
- Using Bidirectional Filtering Capabilities
- Using port and proto to Create a Secure Filter
- 6 HP-UX IPFilter Utilities
- 7 HP-UX IPFilter and FTP
- 8 HP-UX IPFilter and RPC
- 9 HP-UX IPFilter and IPSec
- 10 HP-UX IPFilter and Serviceguard
- A HP-UX IPFilter Configuration Examples
- B HP-UX IPFilter Static Linking
- C Performance Guidelines
- Index
Dynamic Connection Allocation
DCA Keywords
Chapter 4 57
DCA Keywords
The following section describes keywords specific to DCA. For additional
information about DCA rule syntax and rule conditions, see “DCA Rule
Syntax” on page 62 and “DCA Rule Conditions” on page 63.
keep limit: Limiting Connections
Use the keep limit keyword to limit the number of connections made to
an IPFilter system at a given time. Connections can be limited by IP
address, subnet, cumulative limit of connections, and a default
individual limit.
When setting the limit of connections, be aware that the number of
connections stated is for each service on the destination IP address. For
example, if the keep limit is set to 5, then five connections are allowed
for telnet, five for http, and so on.
Limiting Connections by IP Address
Use the following rule to limit connections by IP address:
pass [return-rst] in quick proto tcp from
<ip addr>
to any port
=
<port_num>
keep limit
<limit_num>
For example:
pass return-rst in quick proto tcp from 192.34.23.1 to any port
= 25 keep limit 5
The example rule limits the maximum concurrent connections to 5 from
host 192.34.23.1 to SMTP port 25 of any host. Because the [return-rst]
option is specified, a TCP reset will be sent to the initiating TCP
connection at IP address 192.34.23.1 when the connection request is
blocked.
Limiting Connections by Subnet
Use the following rule to limit connections by subnet:
pass [return_rst] in quick proto tcp from
<ip_subnet>
to any
port =
<port_num>
keep limit
<limit_num>