HP-UX IPFilter Version A.03.05.14 Administrator's Guide

Rules and Keywords

IPFilter Keywords

Chapter 236

NOTE To use the flags

keyword, you must know the correct

designations for the flags you want to use in your rules. See RFC793,

Transmission Control Protocol Specifications for a list of TCP flags.

keep frags: Letting Fragmented Packets Pass

You can configure IPFilter to track fragmented packets and to pass

expected packet fragments. The keep frags keyword lets you configure

IPFilter to pass fragmented packets while blocking packets that might

be forgeries or port scans trying to attack the system.

In the following example, four rules are configured to log forgeries and

allow fragments:

pass in quick on lan0 proto tcp from any to 20.20.20.1/32

port = 23 flags S keep state keep frags

pass out quick on lan0 proto tcp from any to any keep state

flags S keep frags

block in log quick all

block out log quick all

In this example, every valid packet is entered into the state table before

the blocking rules are processed. To further protect the system, log initial

SYN packets to detect SYN scans.

with frags: Dropping Fragmented Packets

If you do not want packet fragments to pass through the firewall, use the

with frags keyword. The with frags keyword drops all packet

fragments. For example:

block in all with frags

with short: Dropping Short Fragments

You can configure IPFilter to drop packet fragments that are too short for

comparison using the with short keyword. This is useful for security

purposes, as an attacker can use fragments to attempt to access the

system. For example:

block in proto tcp all with short