HP-UX IPFilter Version A.03.05.13 Administrator’s Guide HP-UX 11i v3 January 2007 HP Networking Manufacturing Part Number : 5991-7705 E0107 United States © Copyright 2001-2007 Hewlett-Packard Development Company, L.P. Legal Notices The information in this document is subject to change without notice. Hewlett-Packard makes no warranty of any kind with regard to this manual, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Hewlett-Packard shall not be held liable for errors contained herein or direct, indirect, special, incidental, or consequential damages in connection with the furnishing, performance, or use of this material. Warranty A copy of the specific warranty terms applicable to your Hewlett-Packard product and replacement parts can be obtained from your local Sales and Service Office. U.S. Government License Proprietary computer software. Valid license from HP required for possession, use, or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s standard commercial license. Copyright Notice © Copyright 2001–2007 Hewlett-Packard Development Company, L.P. All rights reserved. Reproduction, adaptation, or translation of this document without prior written permission is prohibited, except as allowed under the copyright laws. Trademark Notices UNIX® is a registered trademark of The Open Group. ii Contents Preface: About This Document 1. Installing and Configuring HP-UX IPFilter Overview of HP-UX IPFilter Installation . 3 Installation and Configuration Checklist . 3 Step 1: Checking HP-UX IPFilter Installation Prerequisites . 4 Step 2: Loading HP-UX IPFilter Software . 5 Step 3: Determining the Rules for IPFilter . 7 Step 4: Adding Rules to the Rules Files . 8 Adding IPFilter Rules. 8 Adding NAT Rules . 8 Step 5: Loading IPFilter and NAT Rules . 10 Loading IPFilter Rules . 10 Removing IPFilter Rules . 11 Loading NAT Rules. 12 Step 6: Verifying the Installation and Configuration . 13 Kernel Tunable Parameters . 14 fr_tcpidletimeout. 14 fr_statemax . 15 ipl_buffer_sz . 16 ipl_suppress. 17 ipl_logall . 17 Configuring Kernel Tunable Parameters . 17 Supported and Unsupported Interfaces . 19 Troubleshooting HP-UX IPFilter . 22 2. HP-UX IPFilter on HP-UX 11i Version 3 HP-UX IPFilter Options . 27 Enable or Disable HP-UX IPFilter . 27 Install HP-UX IPFilter . 28 Remove HP-UX IPFilter. 29 3. Rules and Keywords IPFilter Configuration Files . 34 IPFilter Rules . 34 IPFilter Configuration File . 34 Basic Rules Processing . 35 iii Contents IPFilter Keywords . 36 pass and block: Controlling IP Traffic . 36 in and out: Bidirectional Filtering . 36 quick: Optimizing IPFilter Rules Processing . 37 on: Filtering by Network Interfaces. 37 from and to: Filtering by IP Addresses and Subnets . 38 log: Tracking Packets on a System . 39 proto: Controlling Specific Protocols . 40 opt and ipopts: Filtering on IP Options . 40 icmp-type: Filtering ICMP Traffic by Type . 41 port: Filtering on TCP and UDP Ports . 43 keep state: Protecting TCP, UDP, and ICMP Sessions . 44 flags: Tight Filtering Based on TCP Header Flags. 45 keep frags: Letting Fragmented Packets Pass . 46 with frags: Dropping Fragmented Packets . 46 with short: Dropping Short Fragments . 46 return-rst: Responding to Blocked TCP Packets. 47 return-icmp: Responding to Blocked ICMP Packets . 47 dup-to: Drop-Safe Logging . 48 NAT Keywords . 49 map and portmap: Basic NAT . 49 bimap: Bidirectional Mapping . 50 rdr: Redirecting Packets . 50 map-block: Mapping to a Block of Addresses . 51 4. Dynamic Connection Allocation DCA with HP-UX IPFilter. 55 Overview: DCA Functionality . 55 Using DCA. 56 DCA Keywords . 57 keep limit: Limiting Connections. 57 log limit: Logging Exceeded Connections . 59 log limit freq: Log Frequency . 61 DCA Rule Syntax . 62 DCA Rule Conditions . 63 keep limit Rules and Rule Hits . 64 iv Contents DCA Rule Modifications . 65 Updating keep limit Rules . 66 Adding New keep limit Rules. 67 Integrating keep limit Rules . 68 Extracting an Individual Rule from a Subnet Rule . 68 DCA Mode . 69 5. Firewall Building Concepts Blocking Services by Port Number . ..