topic Re: ipfilter and ipftest problem in Operating System - HP-UX

ipfilter and ipftest problem

Andreas Tsamis — Wed, 08 Feb 2012 12:20:10 GMT

Hello,

I have a 11.31 HPUX installed on itanium. I'm setting up ipfilters and tried to test some rules

# IPFilter              A.11.31.17.05 HP IPFilter 3.5alpha5
IPFilter.IPF-HP       A.11.31.17.05 HP IPFilter 3.5alpha5
IPFilter.PFIL-HP      A.11.31.17.05 HP IPFilter PFIL Interface

I have a rule that allows udp's in out in a range of ports.

grep 192.168. /tmp/ipf_temp.conf

pass in quick proto udp from 192.168.1.0/24 to 192.168.1.0/24 port = 5300 keep state
pass out quick proto udp from 192.168.1.0/24 port = 5300 to 192.168.1.0/24 keep state
pass in quick proto udp from 192.168.1.0/24 to 192.168.1.0/24 port 137 >< 138 keep state
#pass in quick proto udp from 192.168.1.0/24 to 192.168.1.0/24 port = 138 keep state
pass out quick proto udp from 192.168.1.0/24 port 137 >< 138 to 192.168.1.0/24 keep state

ipftest shows this rule as blocked

ipftest -r /tmp/ipf_temp.conf
opening rule file "/tmp/ipf_temp.conf"
in udp 192.168.1.1,138 192.168.1.255,138
input: in udp 192.168.1.1,138 192.168.1.255,138
block ip 28(20) 17 192.168.1.1,138 > 192.168.1.255,138
--------------
in udp 192.168.1.1,138 192.168.1.25,137
input: in udp 192.168.1.1,138 192.168.1.25,137
block ip 28(20) 17 192.168.1.1,138 > 192.168.1.25,137

If i remove the >< and replace it by port = 137 or port = 138 it allows it to pass

Is there anything wrong with my test input or the ipf.conf rules

Thanks

Andreas

Re: ipfilter and ipftest problem

Matti_Kurkela — Thu, 09 Feb 2012 16:17:59 GMT

pass in quick proto udp from 192.168.1.0/24 to 192.168.1.0/24 port 137 >< 138 keep state

This would allow the UDP traffic if the port number is greater than 137 but less than 138. Since the port numbers must be integers (i.e. port 137.5 cannot exist), there are no ports that could sastisfy this condition.

Re: ipfilter and ipftest problem

Andreas Tsamis — Wed, 15 Feb 2012 09:01:54 GMT

Thanks.

Logical :) i thought that the values 137 and 138 were included. So if i want to include the two values whats the syntax? Except the now obvious 136><139 ?

Re: ipfilter and ipftest problem

Matti_Kurkela — Wed, 15 Feb 2012 20:02:32 GMT

http://coombs.anu.edu.au/~avalon/examples.html#ports

There does not seem to be a way to specify a port range in inclusive fashion, so as far as I understand, 136><139 is the only way.

Re: ipfilter and ipftest problem

Andreas Tsamis — Tue, 21 Feb 2012 05:56:12 GMT

Thanks for your help :)