HP-UX IPFilter Version 15.01 Administrator's Guide
Improving Performance with Rule Groups
Rule groups allow you to write your ruleset in a tree structure, instead of as a linear list, so if an
incoming packet is unrelated to a set of rules, those rules will never be processed. This reduces
IPFilter processing time on each packet and improves IPFilter system performance.
The following is a simple rule group example:
block out quick on lan1 all head 10
pass out quick proto tcp from any to 20.20.20.64/26 port = 80 flags S keep state group 10
block out on lan2 all
In this example, if a packet is not going to be transmitted using lan1, the head of rule group
10 does not match; IPFilter does not process any of the rules in group 10. Rules processing
continues at the root level (group 0). If a packet is going to be transmitted using lan1, the quick
keyword stops further processing at the group 0 level. IPFilter then evaluates all rules in group
10 against the packet.
Rule groups can be used to break up a complex firewall ruleset. For example, there are three
interfaces in the firewall with interfaces lan0, lan1, and lan2.
• lan0 is connected to external network 20.20.20.0/26.
• lan1 is connected to DMZ network 20.20.20.64/26.
• lan2 is connected to protected network 20.20.20.128/25.
A complete ruleset for this situation would be complex and significantly slow user connections
to the network. To prevent this, a ruleset is created with rule groups:
block in quick on lan0 all head 1
block in quick on lan0 from 192.168.0.0/16 to any group 1
block in quick on lan0 from 172.16.0.0/12 to any group 1
block in quick on lan0 from 10.0.0.0/8 to any group 1
block in quick on lan0 from 127.0.0.0/8 to any group 1
block in log quick on lan0 from 20.20.20.0/24 to any group 1
block in log quick on lan0 from any to 20.20.20.0/32 group 1
block in log quick on lan0 from any to 20.20.20.63/32 group 1
block in log quick on lan0 from any to 20.20.20.64/32 group 1
block in log quick on lan0 from any to 20.20.20.127/32 group 1
block in log quick on lan0 from any to 20.20.20.128/32 group 1
block in log quick on lan0 from any to 20.20.20.255/32 group 1
pass in on lan0 all group 1
pass out on lan0 all
block out quick on lan1 all head 10
pass out quick on lan1 proto tcp from any to 20.20.20.64/26 port = 80 flags S keep state group 10
pass out quick on lan1 proto tcp from any to 20.20.20.64/26 port = 21 flags S keep state group 10
pass out quick on lan1 proto tcp from any to 20.20.20.64/26 port = 20 flags S keep state group 10
pass out quick on lan1 proto tcp from any to 20.20.20.65/32 port = 53 flags S keep state group 10
pass out quick on lan1 proto udp from any to 20.20.20.65/32 port = 53 keep state group 10
pass out quick on lan1 proto tcp from any to 20.20.20.66/32 port = 53 flags S keep state group 10
pass out quick on lan1 proto udp from any to 20.20.20.66/32 port = 53 keep state group 10
For a host on the lan2 network, IPFilter bypasses all the rules in group 10 when a packet is
not destined for hosts on that network.
Multi-level grouping is also supported, allowing IPFilter rules to be arranged in hierarchical,
nested groups. By using the head and group keywords in a rule, multi-level grouping allows
the user to fine tune a range to improve performance. The following is an example of a multi-level
rule grouping:
pass in proto tcp from 1.0.0.0-9.0.0.0 to any port = 23 keep state head 1
pass in proto tcp from 2.0.0.0-8.0.0.0 to any port = 23 keep state head 2 group 1
pass in proto tcp from 3.0.0.0-7.0.0.0 to any port = 23 keep state head 3 group 2
pass in proto tcp from 4.0.0.0-6.0.0.0 to any port = 23 keep state head 4 group 3
pass in proto tcp from 5.0.0.0-5.5.0.0 to any port = 23 keep state group 4
You can group your rules by protocol, system, netblock, or other logical criteria that help system
performance. The maximum number of nested group levels you can configure is 128. For more
information, see Appendix E (page 143).
Improving Performance with Rule Groups 37