IPFilter not filtering after first start

GregMBC — Tue, 19 Dec 2023 09:32:21 GMT

I'm trying to get an 11.31 system going with IPFilter but even though the system says it's up and working, it's not filtering anything.

I set up 2 other systems and one was fine with starting the first time with no reboot, but the other one required a reboot to start the first time.

#> ipf -V
ipf: HP IP Filter: v3.5alpha5 (A.11.31.15.01) (376)
Kernel: HP IP Filter: v3.5alpha5 (A.11.31.15.01)
Running: yes
Log Flags: 0 = none set
Default: pass all, Logging: available
Active list: 0

#> kcmodule| grep ipf
ipf loaded explicit auto-loadable, unloadable

#> ipfstat
dropped packets: in 0 out 0
non-data packets: in 0 out 0
no-data packets: in 0 out 0
non-ip packets: in 0 out 0
bad packets: in 0 out 0
copied messages: in 0 out 0
IPv6 packets: in 0 out 0
input packets: blocked 0 passed 0 nomatch 0 counted 0 short 0
output packets: blocked 0 passed 0 nomatch 0 counted 0 short 0
input packets logged: blocked 0 passed 0
output packets logged: blocked 0 passed 0
packets logged: input 0 output 0
log failures: input 0 output 0
fragment state(in): kept 0 lost 0
fragment state(out): kept 0 lost 0
packet state(in): kept 0 lost 0
packet state(out): kept 0 lost 0
TCP connections: in 0 out 0
ICMP replies: 0 TCP RSTs sent: 0
Invalid source(in): 0
Result cache hits(in): 0 (out): 0
IN Pullups succeeded: 0 failed: 0
OUT Pullups succeeded: 0 failed: 0
Fastroute successes: 0 failures: 0
TCP cksum fails(in): 0 (out): 0
Packet log flags set: (0)
none

#> ipfstat -io
empty list for ipfilter(out)
pass in quick on lan0 from 192.168.160.37/32 to any
pass in quick on lan3 from 192.168.160.37/32 to any
pass in quick on lan0 from 192.168.160.59/32 to any
pass in quick on lan3 from 192.168.160.59/32 to any
pass in quick on lan0 from 192.168.2.70/32 to any
pass in quick on lan3 from 192.168.2.70/32 to any
pass in quick on lan0 from 192.168.2.81/32 to any
pass in quick on lan3 from 192.168.2.81/32 to any
pass in quick on lan0 from 192.168.2.140/32 to any
pass in quick on lan3 from 192.168.2.140/32 to any
pass in quick on lan0 from 192.168.160.228/32 to any
pass in quick on lan3 from 192.168.160.228/32 to any
pass in quick on lan0 from 192.168.160.98/32 to any
pass in quick on lan0 from 192.168.160.22/32 to any
pass in quick on lan3 from 192.168.160.98/32 to any
pass in quick on lan3 from 192.168.160.22/32 to any
pass in quick on lan0 proto tcp from any to 192.168.160.0/24 port = 1099
pass in quick on lan3 proto tcp from any to 192.168.160.0/24 port = 1099
pass in quick on lan0 proto tcp from any to 192.168.160.0/24 port = 22
pass in quick on lan3 proto tcp from any to 192.168.160.0/24 port = 22
pass in quick on lan0 proto tcp from any to 192.168.160.0/24 port > 49151
pass in quick on lan3 proto tcp from any to 192.168.160.0/24 port > 49151
block in log from any to any

Is there a way to prod IPFilter into actually filtering without requiring a reboot? (the system hasn't been rebooted in a very long time and the last one that we rebooted after an extended time had several CLI changes made that weren't in boot files)

Re: IPFilter not filtering after first start

georgek_1 — Fri, 15 Dec 2023 16:06:14 GMT

Hello GregMBC

You may try disable and enable ipfilter and see if that helps you .
/opt/ipf/bin/ipfilter -d
/opt/ipf/bin/ipfilter -e

Also noticed "Active list: 0", seems the rules are not applied till .
#> ipf -V
ipf: HP IP Filter: v3.5alpha5 (A.11.31.15.01) (376)
Kernel: HP IP Filter: v3.5alpha5 (A.11.31.15.01)
Running: yes
Log Flags: 0 = none set
Default: pass all, Logging: available
Active list: 0 ===>

You may refer the Admin guide (URL given below) and see how to load the filter rules .
Refer Section Configuring and loading IPv4 filter rules for more information .
https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=emr_na-c04083959

I work for HPE/ I am an HPE Employee (HPE Community)

Re: IPFilter not filtering after first start

GregMBC — Mon, 18 Dec 2023 13:38:26 GMT

---

You may try disable and enable ipfilter and see if that helps you .
/opt/ipf/bin/ipfilter -d
/opt/ipf/bin/ipfilter -e

---

This did it, the system started logging and filters with a stop/start of the filter system itself.

Thanks!

Re: IPFilter not filtering after first start

Sunitha_Mod — Tue, 19 Dec 2023 05:31:04 GMT

Hello @GregMBC,

Perfect!

We are extremely glad to know the problem has been resolved and we appreciate you for keeping us posted.

topic IPFilter not filtering after first start in Operating System - HP-UX

IPFilter not filtering after first start

Re: IPFilter not filtering after first start

Re: IPFilter not filtering after first start

Re: IPFilter not filtering after first start