HP-UX IPFilter Version 15.01 Administrator's Guide
block in on lan0 proto icmp from any to 10.1.3.0/24
block in on lan0 proto icmp from any to 10.1.1.0/24
block in on lan0 proto icmp from any to 10.1.2.0/24
firewall
#Configuring IP Filter for firewall usage.
=========================================
Step 1 - Block out "bad" IP packets.
------------------------------------
Run the perl script "mkfilters". This will generate a list of blocking rules which:
a) blocks all packets which might belong to an IP Spoofing attack;
b) blocks all packets with IP options;
c) blocks all packets which have a length which is too short for any legal packet;
Step 2 - Convert Network Security Policy to filter rules.
---------------------------------------------------------
Draw up a list of which services you want to allow users to use
on the Internet (e.g. WWW, ftp, etc). Draw up a separate list
for what you want each host that is part of your firewall to be
allowed to do, including communication with internal hosts.
Step 3 - Create TCP "keep state" rules.
---------------------------------------
For each service that uses TCP, create a rule as follows:
pass in on <int-a> proto tcp from <int-net> to any port <ext-service> flags S/SA keep state
where
* "int-a" is the internal interface of the firewall. That is,
it is the closest to your internal network in terms of network
hops.
* "int-net" is the internal network IP# subnet address range.
This might be something like 10.1.0.0/16, or 128.33.1.0/24
* "ext-service" is the service to which you wish to connect or
if it doesn’t have a proper name, a number can be used. The
translation of "ext-service" as a name to a number is
controlled with the /etc/services file.
server
#
# For a network server, which has two interfaces, 128.1.40.1
#(lan0) and 128.1.2.1 (lan1), we want to block all IP spoofing
# attacks. lan1 is connected to the majority of the network,
# while lan0 is connected to a leaf subnet.
# We’re not concerned about filtering individual services
#
#
pass in quick on lan0 from 128.1.40.0/24 to any
block in log quick on lan0 from any to any
block in log quick on lan1 from 128.1.1.0/24 to any
pass in quick on lan1 from any to any
tcpstate
#
# Only allow TCP packets in/out of lan0 if there is an outgoing
# connection setup somewhere, waiting for it.
#
pass out quick on lan0 proto tcp from any to any flags S/SAFR keep state
block out on lan0 proto tcp all
block in on lan0 proto tcp all
#
# allow nameserver queries and replies to pass through, but no # other UDP
#
132 HP-UX IPFilter Configuration Examples