Isolating (disbale routing) for one network card

[Michael Hoppe]

Scenario HP9000 K570, HP-UX 10.20:

lan0 is configured for 19.174.16.51 mask 255.255.254.0
default gateway for 0.0.0.0 is 19.174.16.1 ( a router)
lan2 should be configured as 136.129.154.1 mask 255.255.255.0 and must be isolated (e.g. no route to anything alse than the server 19.174.16.51 itself should be possible from within the 136. net.)

Current netstat -rn:
19.174.16.51 127.0.0.1 UH 11422527142 lo0 4608
19.174.22.170 127.0.0.1 UH 0 0 lo0 4608
127.0.0.1 127.0.0.1 UH 617254734 lo0 4608
136.129.254.1 127.0.0.1 UH 0 8 lo0 4608
default 19.174.16.1 UG 4040881202 lan0 1500
19.174.16.0 19.174.16.51 U 6318336535 lan0 1500
19.174.22.0 19.174.22.170 U 0 0 lan1 1500
136.129.254.0 136.129.254.1 U 0 59397 lan2 1500


Is that possible ?

[Ron Kinner · Accepted solution]

I guess you just want to turn off ip_forwarding. Since you are running 10.20 you have to use nettune instead of ndd. I'm a little vague on how to make it stick after a reboot tho. Found this on the web:

Use nettune(1) command in your system boot sequence:

/usr/contrib/bin/nettune -s ip_forwarding 0


You may also want to look at:

http://downloads.securityfocus.com/library/bastion.html

for other ideas.

Ron

[Michael Hoppe]

Thank's Ron,

that works.


Regards, Michael