ppp.Filter.4 (2010 09)
p
ppp.Filter(4) ppp.Filter(4)
NAME
ppp.Filter - PPP packet filter specification file format
DESCRIPTION
The file
/etc/ppp/Filter
describes how on-demand PPP links are to be managed. By default, any
type of packet causes the link (if down) to be brought up (connected to its remote end); any packet is
allowed to traverse the link; and any packet is sufficient to reset the idle timer, expiration of which would
cause the link to be shut down. This combination is not always appropriate behavior, so the filter file
allows individual control based on the packet type and its source or destination. These selection criteria
may be specified for any of the three phases of operation: bringing up the link, passing packets on the
link, and shutting down the link due to inactivity. Packet logging detail may also be selected using the
same criteria.
Format
Comments begin with a
# and extend to the end of the line; blank lines, or lines beginning with a
#, are
ignored. Upper/lower case distinctions are ignored in hostname specifications, but are significant else-
where. Fields are separated by horizontal or vertical white space (blanks or tabs or newlines).
If a line begins with a hostname or IPv4/IPv6 address or the special words
default or
default6 for
IPv6, that line is considered to be the beginning of a new set of filtering specifications. The filtering
specifications will be applied to any packet crossing the point-to-point link connecting this host to the
peer named by that initial hostname or IPv4/IPv6 address. The hostname or IPv4/IPv6 address in the
first column of the filter file refers to the peer (system or router or terminal server) at the remote end of
the point-to-point (PPP or SLIP) link. The hostname or IPv4/IPv6 address in the first column of the filter
file, and associated with the link peer, is unrelated to the source or destination IPv4/IPv6 address of any
packet crossing the link. If the link peer’s address doesn’t match any name or address specified in the
first column of filter file, the filter specification following the special word
default for IPv4 packets and
default6 for IPv6 packets will be used.
If a newline is followed by white space, that line is a continuation of the filtering specification already in
progress.
There are four keywords to describe the actions taken by
pppd in response to a particular packet:
bringup Describes those packets that will cause a call to be placed and a connection initiated.
Packets of this sort also must qualify to "pass" across the link, either by being explicitly
mentioned or by inclusion in a larger class in the pass section.
pass Describes those packets that will be allowed to traverse the link on an already-
established connection. Only packets which would be passed can cause the link to be
brought up. Any packet that is not passed is optionally logged, then discarded.
keepup Describes packets that will reset the idle timer, thereby keeping the line connected.
log Describes packets whose headers or contents are to be noted in the log file.
After each action keyword comes stanzas, separated by white space, describing packets that fit the cri-
teria for that action. Each stanza is processed in the order shown in the file, and contain restrictions or
permissions on the packets encountered. As soon as a pattern or a condition is found that matches the
packet in question,
pppd takes the indicated action and ignores the rest of the listed stanzas (i.e.,
inclusive or with shortcut evaluation).
Stanzas may contain IP protocol numbers, optionally hyphen-separated ranges of TCP or UDP port
numbers along with the
/tcp or /udp qualifier, numbers representing ICMP/ICMPv6 message types or
codes (which can be found in <netinet/ip_icmp.h> and <netinet/icmp6.h>
) along with the
/icmp or /icmp6 for ICMPv6 qualifier, service names corresponding to entries in /etc/services
,or
names or IP addresses of hosts or networks, or the special keyword
all, which is the default for all
actions except log, where the default is !all. (Usually, it is unnecessary to use all; as a convenience,
pppd automatically adds a !all at the end of a stanza list if the last stanza isnot negated, and add an
all at the end of a stanza list if the last stanza is negated. For example, in the typical case of log this
sensibly results in only those packets matching the stanzas shown being logged, and no others. In the
typical case of pass, this results in certain listed packets being restricted, but allowing the passage of all
others.)
For IPv4 packets filtering if a network is specified, either by name or by address, then the corresponding
network mask must also be specified if it is of a different size than the default for that class of network.
The network mask and additional
and conditions within a stanza are separated by slashes (/), and may
HP-UX 11i Version 3: September 2010 − 1 − Hewlett-Packard Company 1