HP-UX IPFilter Version A.03.05.14 Administrator's Guide
Dynamic Connection Allocation
DCA Keywords
Chapter 348
For example:
pass in quick proto tcp from 192.168.5.0/24 to any port = 25
keep limit 4
The example rule limits the maximum concurrent connections to 4 from
any individual host in subnet 192.168.5.0/24 to port 25 of any host.
Limiting Connections by IP Address Range
Use the following rule to limit connections for each IP address within an
IP address range:
pass [return_rst] in quick proto tcp from
<ip_address_range>
to
<ip | ip_address_range | ip_subnet | any>
[port =
<port_num>
]
keep limit
<limit_num>
For example:
pass in quick proto tcp from 10.10.10.1-10.10.20.1 to any port
= 25 keep limit 15
The example rule allows 15 connections from each IP address within the
IP address range of 10.10.10.1-10.10.20.1.
Use the following rule to limit connections for all IP addresses within an
IP address range:
pass [return_rst] in quick proto tcp from
<ip_address_range>
to
<ip | ip_address_range | ip_subnet | any>
[port =
<port_num>
]
keep limit
<limit_num>
cumulative
For example:
pass in quick proto tcp from 10.10.10.1-10.10.20.1 to any port
= 25 keep limit 15 cumulative
The example rule allows 15 connections to all IP addresses within the IP
address range of 10.10.10.1-10.10.20.1. The IP addresses in the stated
range share the connection limit of 15. So, if there are five connections
from 10.10.10.1 and ten from 10.10.20.1, then no more connections are
allowed from any IP address within the stated range.
Limiting Cumulative Connections
Use the following rule to limit connections to a subnet range using a
shared cumulative limit for all addresses:
pass [return-rst] in quick proto tcp from
<ip_subnet>
to any
port =
<port_num>
keep limit
<limit_num>
cumulative