DOCSLIB.ORG

HP-UX Ipfilter Version A.03.05.13 Administrator's Guide

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
HP-UX Ipfilter Version A.03.05.13 Administrator's Guide HP-UX IPFilter Version A.03.05.13 Administrator’s Guide HP-UX 11i v3 January 2007 HP Networking Manufacturing Part Number : 5991-7705 E0107 United States © Copyright 2001-2007 Hewlett-Packard Development Company, L.P. Legal Notices The information in this document is subject to change without notice. Hewlett-Packard makes no warranty of any kind with regard to this manual, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Hewlett-Packard shall not be held liable for errors contained herein or direct, indirect, special, incidental, or consequential damages in connection with the furnishing, performance, or use of this material. Warranty A copy of the specific warranty terms applicable to your Hewlett-Packard product and replacement parts can be obtained from your local Sales and Service Office. U.S. Government License Proprietary computer software. Valid license from HP required for possession, use, or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s standard commercial license. Copyright Notice © Copyright 2001–2007 Hewlett-Packard Development Company, L.P. All rights reserved. Reproduction, adaptation, or translation of this document without prior written permission is prohibited, except as allowed under the copyright laws. Trademark Notices UNIX® is a registered trademark of The Open Group. ii Contents Preface: About This Document 1. Installing and Configuring HP-UX IPFilter Overview of HP-UX IPFilter Installation . 3 Installation and Configuration Checklist . 3 Step 1: Checking HP-UX IPFilter Installation Prerequisites . 4 Step 2: Loading HP-UX IPFilter Software . 5 Step 3: Determining the Rules for IPFilter . 7 Step 4: Adding Rules to the Rules Files . 8 Adding IPFilter Rules. 8 Adding NAT Rules . 8 Step 5: Loading IPFilter and NAT Rules . 10 Loading IPFilter Rules . 10 Removing IPFilter Rules . 11 Loading NAT Rules. 12 Step 6: Verifying the Installation and Configuration . 13 Kernel Tunable Parameters . 14 fr_tcpidletimeout. 14 fr_statemax . 15 ipl_buffer_sz . 16 ipl_suppress. 17 ipl_logall . 17 Configuring Kernel Tunable Parameters . 17 Supported and Unsupported Interfaces . 19 Troubleshooting HP-UX IPFilter . 22 2. HP-UX IPFilter on HP-UX 11i Version 3 HP-UX IPFilter Options . 27 Enable or Disable HP-UX IPFilter . 27 Install HP-UX IPFilter . 28 Remove HP-UX IPFilter. 29 3. Rules and Keywords IPFilter Configuration Files . 34 IPFilter Rules . 34 IPFilter Configuration File . 34 Basic Rules Processing . 35 iii Contents IPFilter Keywords . 36 pass and block: Controlling IP Traffic . 36 in and out: Bidirectional Filtering . 36 quick: Optimizing IPFilter Rules Processing . 37 on: Filtering by Network Interfaces. 37 from and to: Filtering by IP Addresses and Subnets . 38 log: Tracking Packets on a System . 39 proto: Controlling Specific Protocols . 40 opt and ipopts: Filtering on IP Options . 40 icmp-type: Filtering ICMP Traffic by Type . 41 port: Filtering on TCP and UDP Ports . 43 keep state: Protecting TCP, UDP, and ICMP Sessions . 44 flags: Tight Filtering Based on TCP Header Flags. 45 keep frags: Letting Fragmented Packets Pass . 46 with frags: Dropping Fragmented Packets . 46 with short: Dropping Short Fragments . 46 return-rst: Responding to Blocked TCP Packets. 47 return-icmp: Responding to Blocked ICMP Packets . 47 dup-to: Drop-Safe Logging . 48 NAT Keywords . 49 map and portmap: Basic NAT . 49 bimap: Bidirectional Mapping . 50 rdr: Redirecting Packets . 50 map-block: Mapping to a Block of Addresses . 51 4. Dynamic Connection Allocation DCA with HP-UX IPFilter. 55 Overview: DCA Functionality . 55 Using DCA. 56 DCA Keywords . 57 keep limit: Limiting Connections. 57 log limit: Logging Exceeded Connections . 59 log limit freq: Log Frequency . 61 DCA Rule Syntax . 62 DCA Rule Conditions . 63 keep limit Rules and Rule Hits . 64 iv Contents DCA Rule Modifications . 65 Updating keep limit Rules . 66 Adding New keep limit Rules. 67 Integrating keep limit Rules . 68 Extracting an Individual Rule from a Subnet Rule . 68 DCA Mode . 69 5. Firewall Building Concepts Blocking Services by Port Number . ..
Load more

Recommended publications
  • Active-Active Firewall Cluster Support in Openbsd
    Active-Active Firewall Cluster Support in OpenBSD David Gwynne School of Information Technology and Electrical Engineering, University of Queensland Submitted for the degree of Bachelor of Information Technology COMP4000 Special Topics Industry Project February 2009 to leese, who puts up with this stuff ii Acknowledgements I would like to thank Peter Sutton for allowing me the opportunity to do this work as part of my studies at the University of Queensland. A huge thanks must go to Ryan McBride for answering all my questions about pf and pfsync in general, and for the many hours working with me on this problem and helping me test and debug the code. Thanks also go to Theo de Raadt, Claudio Jeker, Henning Brauer, and everyone else at the OpenBSD network hackathons who helped me through this. iii Abstract The OpenBSD UNIX-like operating system has developed several technologies that make it useful in the role of an IP router and packet filtering firewall. These technologies include support for several standard routing protocols such as BGP and OSPF, a high performance stateful IP packet filter called pf, shared IP address and fail-over support with CARP (Common Address Redundancy Protocol), and a protocol called pfsync for synchronisation of the firewalls state with firewalls over a network link. These technologies together allow the deployment of two or more computers to provide redundant and highly available routers on a network. However, when performing stateful filtering of the TCP protocol with pf, the routers must be configured in an active-passive configuration due to the current semantics of pfsync.
    [Show full text]
  • Pf3e Index.Pdf
    INDEX Note: Pages numbers followed by f, n, priority-based queues, 136–145 or t indicate figures, notes, and tables, match rule for queue assignment, respectively. 137–138 overview, 134–135 Symbols performance improvement, 136–137 # (hash mark), 13, 15 queuing for servers in DMZ, ! (logical NOT) operator, 42 142–144 setting up, 135–136 A on FreeBSD, 135–136 on NetBSD, 136 Acar, Can Erkin, 173 on OpenBSD, 135 ACK (acknowledgment) packets transitioning to priority and class-based bandwidth allocation, queuing system, 131–133 139–140 anchors, 35–36 HFSC algorithm, 124, 126, 142 authpf program, 61, 63 priority queues, 132, 137–138 listing current contents of, 92 two-priority configuration, loading rules into, 92 120–121, 120n1 manipulating contents, 92 adaptive.end value, 188 relayd daemon, 74 adaptive firewalls, 97–99 restructuring rule set with, 91–94 adaptive.start value, 188 tagging to help policy routing, 93 advbase parameter, 153–154 ancontrol command, 46n1 advskew parameter, 153–154, 158–159 antispoof tool, 27, 193–195, 194f aggressive value, 192 ARP balancing, 151, 157–158 ALTQ (alternate queuing) framework, atomic rule set load, 21 9, 133–145, 133n2 authpf program, 59–63, 60 basic concepts, 134 basic authenticating gateways, class-based bandwidth allocation, 60–62 139–140 public networks, 62–63 overview, 135 queue definition, 139–140 tying queues into rule set, 140 B handling unwanted traffic, 144–145 bandwidth operating system-based queue actual available, 142–143 assignments, 145 class-based allocation of, 139–140 overloading to
    [Show full text]
  • Freebsd and Netbsd on Small X86 Based Systems
    FreeBSD and NetBSD on Small x86 Based Systems Dr. Adrian Steinmann <[email protected]> Asia BSD Conference in Tokyo, Japan March 17th, 2011 1 Introduction Who am I? • Ph.D. in Mathematical Physics (long time ago) • Webgroup Consulting AG (now) • IT Consulting Open Source, Security, Perl • FreeBSD since version 1.0 (1993) • NetBSD since version 3.0 (2005) • Traveling, Sculpting, Go AsiaBSDCon Tutorial March 17, 2011 in Tokyo, Japan “Installing and Running FreeBSD and NetBSD on Small x86 Based Systems” Dr. Adrian Steinmann <[email protected]> 2 Focus on Installing and Running FreeBSD and NetBSD on Compact Flash Systems (1) Overview of suitable SW for small x86 based systems with compact flash (CF) (2) Live CD / USB dists to try out and bootstrap onto a CF (3) Overview of HW for small x86 systems (4) Installation strategies: what needs special attention when doing installations to CF (5) Building your own custom Install/Maintenance RAMdisk AsiaBSDCon Tutorial March 17, 2011 in Tokyo, Japan “Installing and Running FreeBSD and NetBSD on Small x86 Based Systems” Dr. Adrian Steinmann <[email protected]> 3 FreeBSD for Small HW Many choices! – Too many? • PicoBSD / TinyBSD • miniBSD & m0n0wall • pfSense • FreeBSD livefs, memstick • NanoBSD • STYX. Others: druidbsd, Beastiebox, Cauldron Project, ... AsiaBSDCon Tutorial March 17, 2011 in Tokyo, Japan “Installing and Running FreeBSD and NetBSD on Small x86 Based Systems” Dr. Adrian Steinmann <[email protected]> 4 PicoBSD & miniBSD • PicoBSD (1998): Initial import into src/release/picobsd/ by Andrzej Bialecki <[email protected]
    [Show full text]
  • IP Filter - TCP/IP Firewall/NAT Software
    IP Filter - TCP/IP Firewall/NAT Software IP Filter Current version: 5.1.0 Next release status Patches for last release What's new ? Click here! Mailing list ? Send mail to [email protected] with "subscribe ipfilter" in the body of the mail. What is it ? IPFilter is a software package that can be used to provide network address translation (NAT) or firewall services. To use, it can either be used as a loadable kernel module or incorporated into your UNIX kernel; use as a loadable kernel module where possible is highly recommended. Scripts are provided to install and patch system files, as required. To see an overview of how IP Filter fits into the overall picture of TCP/IP with your kernel and the order in which the various phases of packet processing is done, click here. The IPFilter FAQ by Phil Dibowitz! It comes as a part of the following operating systems: FreeBSD-current (post 2.2) NetBSD-current (post 1.2) xMach Solaris 10 Open Solaris http://coombs.anu.edu.au/~avalon/ip-filter.html (1 of 7)19.2.2011 •. 14:01:49 IP Filter - TCP/IP Firewall/NAT Software It has been tested and run on: Solaris/Solaris-x86 2.3 - 9 SunOS 4.1.4 - 4.1.4 NetBSD 1.0 - 1.4 FreeBSD 2.0.0 - 2.2.8 BSD/OS-1.1 - 4 IRIX 6.2, 6.5 OpenBSD 2.0 - 3.5 Linux(*) 2.4 - 2.6 HP-UX 11.00 Tru64 5.1a AIX 5.3 ML05 QNX 6 Port * - It has been tested and shown to work on RedHat 9.0, SuSE 9.1 and will, in general work with 2.4 and 2.6 kernels.
    [Show full text]
  • Takashi Okumura : Ph.D. Dissertation, 2006 Univ. of Pittsburgh
    VIRTUALIZATION OF NETWORK I/O ON MODERN OPERATING SYSTEMS by Takashi Okumura B.A., Keio University, Japan, 1996 M.A., Keio University, Japan, 1998 M.S., University of Pittsburgh, 2000 M.D., Asahikawa Medical College, 2007 Submitted to the Graduate Faculty of the Arts and Science in partial fulfillment of the requirements for the degree of Doctor of Philosophy University of Pittsburgh 2007 UNIVERSITY OF PITTSBURGH DEPARTMENT OF COMPUETR SCIENCE This dissertation was presented by Takashi Okumura It was defended on August 24th, 2006 and approved by Dr. Daniel Moss´e Dr. Ahmed Amer Dr. Bruce R. Childers Dr. Hideyuki Tokuda, Keio University Dissertation Director: Dr. Daniel Moss´e ii Copyright c by Takashi Okumura 2007 iii VIRTUALIZATION OF NETWORK I/O ON MODERN OPERATING SYSTEMS Takashi Okumura, Ph.D University of Pittsburgh, 2007 Network I/O of modern operating systems is incomplete. In this network age, users and their applications are still unable to control their own traffic, even on their local host. Network I/O is a shared resource of a host machine, and traditionally, to address problems with a shared resource, system research has virtualized the resource. Therefore, it is reasonable to ask if the virtualization can provide solutions to problems in network I/O of modern operating systems, in the same way as the other components of computer systems, such as memory and CPU. With the aim of establishing the virtualization of network I/O as a design principle of operating systems, this dissertation first presents a virtualization model, hierarchical virtual- ization of network interface. Systematic evaluation illustrates that the virtualization model possesses desirable properties for virtualization of network I/O, namely flexible control gran- ularity, resource protection, partitioning of resource consumption, proper access control and generality as a control model.
    [Show full text]
  • Ethical Hacking and Countermeasures Version 6
    Ethical Hacking and Countermeasures Version 6 Modu le LX Firewall Technologies News Source: http://www.internetnews.com/ Copyright © by EC-Council EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Module Objective This modu le will fam iliar ize you wihith: • Firewalls • Hardware Firewalls • Software Firewalls • Mac OS X Firewall • LINUX Firewall • Windows Firewall Copyright © by EC-Council EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Module Flow Firewalls Mac OS X Firewall Hardware Firewalls LINUX Firewall Software Firewalls Windows Firewall Copyright © by EC-Council EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Firewalls: Introduction A firewall is a program or hardware device that protects the resources of a private netw ork from users of other networks It is responsible for the traffic to be allowed to pass, block, or refuse Firewall also works with the proxy server It helps in the protection of the private network from the users of the different network Copyright © by EC-Council EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Hardware Firewalls Copyright © by EC-Council EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Hardware Firewall Har dware Firewa lls are place d in the perime ter of the networ k It employs a technique of packet filtering It reads the header of a packet to find out the source and destination address The information is then compared with the set of predefined and/orand/ or user created rules that determine whether the packet is forwarded or dropped Copyright © by EC-Council EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Netgear Firewall Features: • ItInterne t shar ing broa dbddband router and 4-port switch • 2x the speed and 4x times the coverage of a Wireless-G router • Configurable for private networks and public hotspots • Double Firewall protection from external hackers attacks • Touchless WiFi Security makes it easy to secure your network Copyright © by EC-Council EC-Council All Rights Reserved.
    [Show full text]
  • Architecture for Programmable Network Infrastructure
    Architecture for programmable network infrastructure Tom Barbette Université de Liège Faculté des Sciences Appliquées Département d’Electricité, Electronique et Informatique Doctoral Dissertation presented in fulfilment of the requirements for the degree of Docteur en Sciences (Informatiques) May 2018 ii Summary Software networking promises a more flexible network infrastructure, poised to leverage the computational power available in datacenters. Virtual Net- work Functions (VNF) can now run on commodity hardware in datacenters instead of using specialized equipment disposed along the network path. VNFs applications like stateful firewalls, carrier-grade NAT or deep packet inspection that are found “in-the-middle”, and therefore often categorized as middleboxes, are now software functions that can be migrated to reduce costs, consolidate the processing or scale easily. But if not carefully implemented, VNFs won’t achieve high-speed and will barely sustain rates of even small networks and therefore fail to fulfil their promise. As of today, out-of-the-box solutions are far from efficient and cannot handle high rates, especially when combined in a single host, as multiple case studies will show in this thesis. We start by reviewing the current obstacles to high-speed software net- working. We leverage current commodity hardware to achieve what seemed impossible to do in software not long ago and made software solutions be- lieved unworthy and untrusted by network operators. Our work paves the way for building a proper software framework for a programmable network infrastructure that can be used to quickly implement network functions. We built FastClick, a faster version of the Click Modular Router, that allows fast packet processing thanks to a careful integration of fast I/O frame- works and a deep study of interactions of their features.
    [Show full text]
  • Olivier Cochard-Labbé [email protected] Agenda
    BSD Router Project Olivier Cochard-Labbé [email protected] Agenda 1. Why BSD Router Project ? 2. Targets & Philosophy 3. Features 4. Build framework 5. Lab scripts 6. Missing features 7. Problems 8. Internal usage @Orange Business Services 9. Questions ? Why BSD Router Project ? ● Network appliances are expensive and "only" 100% software solution ● Huge changes is coming with the Software Defined Networking concept (Openflow, ForCES) ● Ethernet interfaces are becoming the de-facto standard ● Current servers have lot's of power: They should have lot's more better performance in forwarding speed… and netmap is proving it! ● After FreeNAS, I would to return back to my youthful romance: Networking devices for hairy peoples (without WebGUI) Targets & Philosophy ● Medium sized Ethernet router ○ datacenter, ISP ● Not for home: Use m0n0wall or pfSense ● Only an Ethernet router ● No WebGUI ○ It's a FreeBSD ○ Massive deployment: pre-provisioning, configuration management Features ● Pre-packaged NanoBSD images ○ Quagga, Bird, mpd5, pimdd, mrouted, fprobe, etc… ● Multi-archictecture ○ amd64,i386,i386_xenpv, sparc64 (limited) ● Helper scripts: ○ cat BSDRP-1.2-upgrade.img.xz | ssh root@router "xzcat | upgrade" ○ show ifstat|mbuf|mroute|route|proc|tech-support|… ○ config diff|save|put|get|factory|… ● Small sized: 256Mb flash device ○ But removing man pages is a good idea ? Build framework Lab scripts ● Multi-OS scripts available for qemu/Virtualbox ./BSDRP-lab-vbox.sh -n 4 -l 2 -i BSDRP_1.2_full_amd64_serial.img Features testing labs Missing features
    [Show full text]
  • Sality: Story of a Peer- To-Peer Viral Network Nicolas Falliere Principal Software Engineer
    Security Response Sality: Story of a Peer- to-Peer Viral Network Nicolas Falliere Principal Software Engineer Version 1.0 (July 2011) Executive Summary W32.Sality is a file infector that spreads by infecting executable files and Contents by replicating itself across network shares. Infected hosts join a peer- Executive Summary ........................................... 1 to-peer network used to propagate malware on the compromised com- Timeline .............................................................. 1 puter. Typically, those additional programs will be used to relay spam, Architecture ....................................................... 3 proxy communications, steal private information, infect Web servers Going peer-to-peer ............................................. 7 or achieve distributed computing tasks, such as password cracking. Review of the V3 network ................................ 11 Review of the V4 network ................................ 14 The combination of file infection mechanism and the fully de- Metrics and Estimations .................................. 15 centralized peer-to-peer network, along with other anti-secu- Conclusion........................................................ 18 rity measures, make Sality one of the most effective and re- Annex A ........................................................... 19 silient malware in today’s threat landscape. Estimations show Annex B ........................................................... 20 that hundreds of thousands of machines are infected by Sality.
    [Show full text]
  • Ipfw & IP Filter
    ipfw& IP Filter Yung-Zen Lai ([email protected]) 2004/10 Agenda n Network and Firewall Basics n ipfw – FreeBSD IP Firewall and Traffic Shaper q Firewall q Traffic Shaper n IP Filter – TCP/IP Firewall/NAT Software q Firewall q Network Address Translation Network Basics – OSI 7 Layer Network Basics – TCP, UDP Host A Host B n TCP q Transmission Control SYN Protocol q Connection-Oriented SYN + ACK q Three-Way handshake ACK n UDP q User Datagram Protocol q Connectionless Firewall Basics n filter packets based on their components q IP q TCP q UDP q ICMP q Other Protocol n to perform an action on packets that match the filter. q Pass q Reject q Discard q Log ipfw – Firewall n ipfw q options IPFIREWALL in KERNCONF q first match q add/delete q list/show q flush q zero/resetlog q set disable/enable q set move/swap/show ipfwFirewall rules n ipfwadd / delete [ number ] q < allow | reject | deny | reset | unreach> q < all | icmp| tcp| udp> n from q < src-net/host > < src-port > n to q < dst-net/host > < dst-port > n [ < via interface > / < options > ] ipfwFirewall rules (cont.) n Allow packets that match rule q allow | accept | pass | permit q ipfwadd allow all from me to any q ipfwadd allow all from smtp.tp.edu.twto me n Discard packets that match this rule. q reject | deny | drop q ipfwadd deny all from any to 224.0.0.0/8 n Send some notice back q reset(TCP), unreach<code>(ICMP) q ipfwadd reset tcpfrom any to any 23 ipfwFirewall rules – Rule Actions n < allow | accept | pass | permit > n < check-state > n < count > n < divert > port n < fwd | forward > ipaddr[, port] n < reject > n < reset > n < skipto> number n < tee > port n < unreach> code ipfwFirewall rules – Rule Body n ipfrom { x or not y or z } to any n [proto from srcto dst] [options] n srcand dst: {addr| { addror ..
    [Show full text]
  • Firewall Builder User's Guide
    Firewall Builder User’s Guide Firewall Builder User’s Guide $Id: UsersGuide3.xml 252 2009-09-12 21:05:00Z vadim $ Edition Copyright © 2003,2009 NetCitadel, LLC The information in this manual is subject to change without notice and should not be construed as a commitment by NetCitadel LLC. NetCitadel LLC assumes no responsibility or liability for any errors or inaccuracies that may appear in this manual. Table of Contents 1. Introduction............................................................................................................................................1 1.1. Introducing Firewall Builder.......................................................................................................1 1.2. Overview of Firewall Builder Features.......................................................................................1 2. Installing Firewall Builder....................................................................................................................3 2.1. RPM-based distributions (Red Hat, Fedora, OpenSUSE and others).........................................3 2.2. Ubuntu Installation......................................................................................................................3 2.3. Installing FreeBSD and OpenBSD Ports....................................................................................4 2.4. Windows Installation...................................................................................................................4 2.5. Mac OS X Installation.................................................................................................................4
    [Show full text]
  • Openbsd Routing with PF
    OpenBSD Routing With PF OpenBSD Routing With PF 1 / 2 Hi misc@, I was wondering about the behavior of OpenBSD in this case (not a production case at this time). 2 WAN interfaces (Ethernet / IPv4 DHCP) , linked to .... An OpenBSD system doing NAT will have at least two network adapters, one to the ... Since NAT is almost always used on routers and network gateways, it will ... Packet Filter (from here on referred to as PF) is OpenBSD's system for filtering TCP/IP ... q destination address in route-to, reply-to, and dup-to filter rule options.. I run OpenBSD routers in production. When getting the lay of the land to set these up I came across OP's link as well as ... PF is a BSD licensed stateful packet filter, a central piece of software for firewalling. It is comparable to netfilter (iptables), ipfw, and ipfilter. PF was developed for OpenBSD, but has been ported to many other ... free open source FreeBSD based firewall/router; OPNSense free open source FreeBSD based firewall/router ... OpenBSD Routing With PF >>> http://picfs.com/1fcy6g Since FreeBSD 5.3, a ported ve.. The OpenBSD PF Guide: Macros shows a macro named ext_if. Using that ... echo lnklclrt = \ " ff02::2 \ " \ #link-local "All Routers Addresses" RFC 4291 S 2.7.1 p.. Setting up a home gateway with OpenBSD + other goodies ... a spare box with two or more NICs, you can turn it into a powerful OpenBSD router. ... /etc/pf.conf.. Mark's OpenBSD Router Guide. Turning a PC Engines ALIX.2D3 into an OpenBSD 4.8 home router.
    [Show full text]