How to query HP-UX host firewall status
Because the database 1521 in HP-UX cannot be connected to telnet, determine whether port 1521 is caused by HP-UX firewall.
So how to install the firewall in HP-UX and query the firewall status
The use of host firewall can be very convenient for network access control, at the same time, it has a good defense role for many means.
The use of HPUX host firewall (IPF) will have a certain impact on system performance. When the network traffic is 50m), the utilization rate of CPU may reach 100.020%.
To ignore
Download from http://software.hp.com (depot software, installed using swinstall).
1. Operation of host firewall (IPF)
1. Install IPF
Download IPF:
Http://software.hp.com/portal/sw... OductNumber=B9901AA
Install IPF using swinstall:
Swinstall-s / root/B9901AA_A.03.05.11.01_HP-UX_B.11.11_32+64.depot
Then restart the host
2. Delete IPF
Backing up / etc/opt/ipf/ipf.conf files
Use swremove to delete the IPF:
Swremove B9901AA
Then restart the host
3. Deactivate IPF
Edit / etc/rc.config.d/ipfconf, change:
IPF_START=0
Then stop ipf:
/ sbin/init.d/ipfboot stop
4. Configure IPF (example)
Allow host 200.1.5.123 to access the host's telnet service, while forbidding other IP access to the host's telnet service:
Edit the file / etc/opt/ipf/ipf.conf and add on the first line:
Pass in quick proto tcp from 200.1.5.123 to any port = 23 flags S keep state
Block in quick proto tcp from any to any port = 23
Then execute the following command:
/ sbin/ipf-Fa
/ sbin/ipf-f / etc/opt/ipf/ipf.conf
Note: more IPF configuration options can be viewed using man ipf
5. View IPF status
/ sbin/ipfstat-ioh
This will show the rules currently loaded by ipf Firewall. If empty (empty, default), ipf Firewall will have no effect.
> netstat-na | grep LIST
Tcp 0 0 * .49155 *. * LISTEN
Tcp 0 0 * .4045 *. * LISTEN
Tcp 0 0 * .49508 *. * LISTEN
Tcp 0 0 * .8801 *. * LISTEN
Tcp 0 0 * .49287 *. * LISTEN
Tcp 0 0 * .49227 *. * LISTEN
Tcp 0 0 * .13 *. * LISTEN
Tcp 0 0 * .113 *. * LISTEN
Tcp 0 0 * .9 *. * LISTEN
Tcp 0 0 * .7 *. * LISTEN
Tcp 0 0 * .37 *. * LISTEN
> lsof-I
> lsof-I | grep LISTEN
