topic Re: Ipfilter ipf.conf file in Operating System - HP-UX

Ipfilter ipf.conf file

Erick T. Mitchell — Mon, 31 Jan 2005 15:51:38 GMT

Ipfilter Experts,
Using ipfilter what's the correct syntax in the ipf.conf file to allow a range of subnets access to different ip addresses...
>>>>>>>>>>>>>>>>>>>>>>>>>>>.
pass in from 111.111.111.1 to any
pass in from 222.222.222.1 to 333.333.333.3
The goal here is to have half of the subnets entering my server to view webserver A and the other range view webserver B

Re: Ipfilter ipf.conf file

Biswajit Tripathy — Mon, 31 Jan 2005 16:15:57 GMT

If I understand the question correctly, try these rules:

---------
pass in quick proto tcp from 111.111.111.0/24 to SERVER_A_IP port = 80 keep state
pass in quick proto tcp from 222.222.222.1-333.333.333.3 to SERVER_B_IP port = 80 keep state
block in quick proto tcp from any to any port = 80
-------------

The first rule wil allow all addresses in 111.111.111.0/24
subnet to server A and second rule will allow all addresses
in range 222.222.222.1 to 333.333.333.3 to server B.
Every other source IP will be blocked.

- Biswajit

Re: Ipfilter ipf.conf file

Biswajit Tripathy — Mon, 31 Jan 2005 17:09:40 GMT

Erick,

it would be nice to know if that solution worked or not.
If not what was wrong or did I misunderstand the
question completely.

- Biswajit

Re: Ipfilter ipf.conf file

Erick T. Mitchell — Mon, 31 Jan 2005 17:23:53 GMT

Sure Biswajit,
I will be testing this during my maintenace window tonight and I will update you.
Erick

Re: Ipfilter ipf.conf file

TwoProc — Mon, 31 Jan 2005 19:16:56 GMT

A side-note - Erick, is this a distribution of IPfilter for HPUX?

Re: Ipfilter ipf.conf file

Biswajit Tripathy — Mon, 31 Jan 2005 19:39:18 GMT

John:
> A side-note - Erick, is this a distribution of IPfilter for HPUX?

I would guess so. The IP range solution (with a '-'
between two IP addresses) is supported only in HP's
IPFilter and not supported in the public domain
version.

- Biswajit

Re: Ipfilter ipf.conf file

TwoProc — Tue, 01 Feb 2005 08:38:53 GMT

Biswalt - I was losing a little bit - I've been interested in getting IP tables working - and had been looking to see if it was ported/working on HPUX. When I saw your post re: IPfilter , I got the names confused and was hoping I had finally found someone who was implementing IPtables...