HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3
Table Of Contents
- HP-UX IPFilter Version A.03.05.13 Administrator's Guide
- Legal Notices
- Table of Contents
- Preface: About This Document
- 1 Installing and Configuring HP-UX IPFilter
- Overview of HP-UX IPFilter Installation
- Step 1: Checking HP-UX IPFilter Installation Prerequisites
- Step 2: Loading HP-UX IPFilter Software
- Step 3: Determining the Rules for IPFilter
- Step 4: Adding Rules to the Rules Files
- Step 5: Loading IPFilter and NAT Rules
- Step 6: Verifying the Installation and Configuration
- Kernel Tunable Parameters
- Supported and Unsupported Interfaces
- Troubleshooting HP-UX IPFilter
- 2 HP-UX IPFilter on HP-UX 11i Version 3
- 3 Rules and Keywords
- IPFilter Configuration Files
- Basic Rules Processing
- IPFilter Keywords
- pass and block: Controlling IP Traffic
- in and out: Bidirectional Filtering
- quick: Optimizing IPFilter Rules Processing
- on: Filtering by Network Interfaces
- from and to: Filtering by IP Addresses and Subnets
- log: Tracking Packets on a System
- proto: Controlling Specific Protocols
- opt and ipopts: Filtering on IP Options
- icmp-type: Filtering ICMP Traffic by Type
- port: Filtering on TCP and UDP Ports
- keep state: Protecting TCP, UDP, and ICMP Sessions
- flags: Tight Filtering Based on TCP Header Flags
- keep frags: Letting Fragmented Packets Pass
- with frags: Dropping Fragmented Packets
- with short: Dropping Short Fragments
- return-rst: Responding to Blocked TCP Packets
- return-icmp: Responding to Blocked ICMP Packets
- dup-to: Drop-Safe Logging
- NAT Keywords
- 4 Dynamic Connection Allocation
- 5 Firewall Building Concepts
- Blocking Services by Port Number
- Using Keep State
- Using Keep State with UDP
- Using Keep State with ICMP
- Logging Techniques
- Improving Performance with Rule Groups
- Localhost Filtering
- Using the to
- Creating a Complete Filter by Interface
- Combining IP Address and Network Interface Filtering
- Using Bidirectional Filtering Capabilities
- Using port and proto to Create a Secure Filter
- 6 HP-UX IPFilter Utilities
- 7 HP-UX IPFilter and FTP
- 8 HP-UX IPFilter and RPC
- 9 HP-UX IPFilter and IPSec
- 10 HP-UX IPFilter and Serviceguard
- A HP-UX IPFilter Configuration Examples
- B HP-UX IPFilter Static Linking
- C Performance Guidelines
- Index
Firewall Building Concepts
Using Keep State
Chapter 574
Using Keep State
The keep state keyword must be used with other IPFilter keywords
and filtering techniques so that IPFilter completely and correctly makes
an entry in the state table.
If you configure rules to both filter on TCP flags and keep state, you must
be sure you configure the rules correctly. In most cases, you should use
the keep state keyword on the first rule that interacts with a packet for
a connection. You might also need to add the keep state keyword to
subsequent rules in the ruleset.
The following rules do not filter on TCP flags, but use the keep state
keyword correctly:
block in all
pass in quick proto tcp from any to 20.20.20.20/32 port = 23
keep state
block out all
The following rules both filter on TCP flags and use the keep state
keyword:
block in all
pass in quick proto tcp from any to 20.20.20.20/32 port = 23
flags S keep state
pass out all keep state
Either of these sets of rules will result in a fully established state entry
for a connection to your server.
For more examples of correct uses of the keep state keyword, see
Appendix A, “HP-UX IPFilter Configuration Examples,” on page 145.
Protecting SSH Server Connections Using Keep State
The previous examples demonstrate keeping state on TCP, UDP, and
ICMP. The IPFilter system can make outgoing connections seamlessly,
and attackers cannot get back into the system. The ruleset specifies the
ports systems can access, and adds entries to the state table to monitor
each connection.