Home | History | Annotate | Line # | Download | only in npftest
      1 # $NetBSD: npftest.conf,v 1.18 2025/08/20 11:03:59 joe Exp $
      2 
      3 $ext_if = "npftest0"
      4 $int_if = "npftest1"
      5 
      6 set portmap.min_port 1024
      7 set portmap.max_port 65535
      8 
      9 #
     10 # RFC 5737
     11 #
     12 
     13 $pub_ip1 = 192.0.2.1
     14 $pub_ip2 = 192.0.2.2
     15 $pub_ip3 = 192.0.2.3
     16 
     17 $local_ip1 = 10.1.1.1
     18 $local_ip2 = 10.1.1.2
     19 $local_ip3 = 10.1.1.3
     20 $local_ip4 = 10.1.1.4
     21 $local_ip5 = 10.1.1.5
     22 
     23 $Kojo = 1001
     24 $wheel = 20
     25 
     26 $local_net = { 10.1.1.0/24 }
     27 $ports = { 8000, 9000 }
     28 
     29 #
     30 # RFC 7042
     31 #
     32 # 00:00:5E:00:53:00 - 00:00:5E:00:53:FF
     33 $mac1 = 00:00:5E:00:53:00
     34 $mac2 = 00:00:5E:00:53:01
     35 $mac3 = 00:00:5E:00:53:02
     36 $nested_mac4 = { 00:00:5E:00:53:03, 00:00:5E:00:53:04, 00:00:5E:00:53:05 }
     37 
     38 #
     39 # PR bin/59511
     40 # NPF doesn't extract some values from nested variables
     41 $home = { 192.168.100.5, 192.168.100.8 }
     42 $office = { 192.168.64.3, 192.168.64.9 }
     43 $blocklist = { $home, $office }
     44 
     45 map $ext_if static $local_ip3 <-> $pub_ip3
     46 map $ext_if dynamic $local_ip2 <-> $pub_ip2
     47 map $ext_if dynamic $local_net -> $pub_ip1
     48 map $ext_if dynamic $local_ip1 port 6000 <- $pub_ip1 port 8000
     49 
     50 $net6_inner = fd01:203:405::/48
     51 $net6_outer = 2001:db8:1::/48
     52 
     53 # Example of multiple addresses with a common 32-bit word, taken from
     54 # PR bin/55403: npfctl miscompiles IPv6 rules.
     55 $net6_pr55403 = { fe80::1, fe80::1000:0:0/95, fe80::2, fe80::2000:0:0/96, fe80::3, fe80::3000:0:0/97 }
     56 
     57 $net_a = 10.100.0.0/16
     58 $net_b = 10.255.0.0/16
     59 
     60 map $ext_if static algo npt66 $net6_inner <-> $net6_outer
     61 map $ext_if static algo netmap $net_a <-> $net_b
     62 map ruleset "map:some-daemon" on $ext_if
     63 
     64 group "ext" on $ext_if {
     65 	pass out final from $local_ip3
     66 	pass in final to $pub_ip3
     67 	pass in final from $local_ip4 port 8000-10000 user $Kojo group $wheel
     68 	block out final to 127.0.0.1 user > $Kojo group 1 >< $wheel
     69 
     70 	pass out final from $net6_inner
     71 	pass in final to $net6_outer
     72 
     73 	pass out final from $net_a
     74 	pass in final to $net_b
     75 
     76 	pass stateful out final proto tcp flags S/SA all
     77 	pass stateful out final from $local_net
     78 	pass stateful in final to any port $ports
     79 	pass stateful in final proto icmp all
     80 
     81 	block all
     82 }
     83 
     84 group "int" on $int_if {
     85 	ruleset "test-rules"
     86 	block in final from $local_ip3
     87 	pass stateful out final to $local_ip2
     88 	pass out final to $local_ip3
     89 	block final to $local_ip4
     90 
     91 	pass in final family inet6 proto udp from $net6_pr55403
     92 	pass in final family inet6 proto udp from ! $net6_pr55403 to $net6_pr55403
     93 
     94 	block in final from $blocklist to $local_ip5
     95 }
     96 
     97 group "ext2" on $int_if layer-2 {
     98 	ruleset "l2-ruleset" layer-2
     99 	pass ether in final from $mac1 to $mac2 type Ex86DD
    100 	block ether in final from $mac2
    101 	pass ether out final to $mac3 type Ex809B
    102 	pass ether in final from $nested_mac4
    103 }
    104 
    105 group default {
    106 	block all
    107 }
    108 
    109 group default layer-2 {
    110 	block ether all
    111 }
    112