HP-UX IPFilter Version 15.01 Administrator's Guide

# through to host 10.1.1.2 if they are destined for port 6667.

pass in proto tcp from 10.2.2.2/24 to 10.1.1.2/32 port = 6667

# allow in UDP packets which are NOT from port 53 and are

# destined for localhost

pass in proto udp from 10.2.2.2 port != 53 to localhost

# block any packet trying to get to X terminal ports, X:0 to

# X:9

block in proto tcp from any to any port 5999 >< 6010

# allow any connections to be made,except to BSD

# print/r-services this will also protect syslog.

block in proto tcp/udp all

pass in proto tcp/udp from any to any port 512 <> 515

# allow any connections to be made, except to BSD

# print/r-services

# this will also protect syslog.

pass in proto tcp/udp all

block in proto tcp/udp from any to any port 511 >< 516

example.12

# get rid of all short IP fragments (too small for valid

# comparison)

block in proto tcp all with short

# drop and log any IP packets with options set in them.

block in log all with ipopts

# log packets with BOTH ssrr and lsrr set

# drop any source routing options

block in quick all with opt lsrr

block in quick all with opt ssrr

example.13

# log all short TCP packets to lan3, with 10.3.3.3 as the

# intended destination for the packet.

block in on lan0 to lan3:10.3.3.3 proto tcp all with short

# log all connection attempts for TCP

pass in on lan0 dup-to lan1:10.3.3.3 proto tcp all flags S/SA

# route all UDP packets through transparently.

pass in on lan0 proto udp all

# route all ICMP packets to network 10 out through lan1, to

130 HP-UX IPFilter Configuration Examples