IPFilter -- did not meet my request

[stephen peng]

Guys,

For IPFilter, I am a freshman.

I edited /etc/opt/ipf/ipf.conf like the following:

pass in all

block out all

pass out from any to 192.168.0.1-192.168.0.9

What I intended was to restirct this box the ability to access 192.168.0.1 - 192.168.0.10 only, and all other boxes could visit this box. But after I enabling IPFilter, all other boxes could not access this box, including ping & telnet.

What lead to the problem?

regards

Stephen

[Steven Schweda]

> For IPFilter, I am a freshman.

   I've never used it, so I know nothing, but ...

   My quick Web search for documentation found more broken links than
good ones, but I did find this:

https://www.freebsd.org/cgi/man.cgi?query=ipf&sektion=5&manpath=freebsd-release-ports

        [...]
            Address matching (basic)
            [...]
            Some examples of this are:

            pass in from 10.1.0.0/24 to any
            block out from any to 10.1.1.1

            It is not possible to specify a range of addresses that does not
            have a boundary that can be defined by a standard subnet mask.
        [...]

> pass out from any to 192.168.0.1-192.168.0.9

   That ipf(5) "man" page makes me wonder if "192.168.0.1-192.168.0.9"
is legal.  And, without a legal "pass out" rule, I'd expect your
"block out all" rule to block everything outbound.

   This sort of thing is always a problem when you have a
non-interactive program which uses a user-edited configuration file.  If
there's an error in the configuration file, how can you learn about it?
I have no idea where such error messages might go on an HP-UX system
(because: What do I know?) but I'd start by looking in the usual system
log files, and then trying to find something in the local IPFILTER
documentation.  Or, you could run the experiment, and try things like:

      pass out from any to 192.168.0.1
      pass out from any to 192.168.0.2/31   # .2 - .3
      pass out from any to 192.168.0.4/30   # .4 - .7
      pass out from any to 192.168.0.8/31   # .8 - .9

Or, as a simpler approximation:

      pass out from any to 192.168.0.0/28   # .0 - .15

   Or, you could find some IPFILTER documentation which says that you
really can specify an address range that way.  (It looks bad to me, but
what do I know?)