HP-UX IPFilter v18.21 Administrator Guide HP-UX 11i v3 (761995-001, March 2014)

1 Overview
HP-UX IPFilter, product number B9901AA V18.21, is a TCP/IP packet filter suitable for use as a
system firewall. The version string is A.11.31.18.21 for HP-UX 11i v3.
HP-UX IPFilter functions as a firewall by examining and limiting packets allowed in and out of an
HP-UX system, which can be either an end node or an IP router. Although HP-UX IPFilter is a superset
of the functionality in the IPFilter 3.5 Alpha 5 open source version of the product (developed by
Darren Reed), HP does not support some of the perimeter firewall features in that release, such as
firewall stealth (fastroute). If you are using features that are not supported by HP, you can
request support from the open source IPFilter website:
http://caligula.anu.edu.au/~avalon
For a complete list of commands and utilities that are not supported by HP, see Section (page 12).
HP-UX IPFilter V18.21 is available from the HP Software Depot:
http://www.software.hp.com.
Benefits and features
HP-UX IPFilter provides the following key benefits:
• Protects an individual host on an intranet against internal attacks
• Protects an individual host on an intranet against external attacks that have breached perimeter
defenses
• Provides an alternative to the restricted configuration of Internet Services
• Protects a bastion host on the perimeter of a private network or in the demilitarized zone
(DMZ)
The following major features are included with HP-UX IPFilter for HP-UX 11i v3:
• Rate-based filtering
• Address pooling
• The ippool utility
• The ippool.conf file
• State aging
• Log tags
• NAT tags
• Sticky NAT sessions
• Connection health checking with l4check
• IPFilter Log Events analysis
• Rule groups
• Explicit permission or denial of a packet to pass through based on:
IP address or a range of IP addresses◦
◦ IP protocol (IP/TCP/UDP)
◦ IP fragments
◦ IP options
◦ IP security classes
Benefits and features 11