1 # $NetBSD: npftest.conf,v 1.18 2025/08/20 11:03:59 joe Exp $ 2 3 $ext_if = "npftest0" 4 $int_if = "npftest1" 5 6 set portmap.min_port 1024 7 set portmap.max_port 65535 8 9 # 10 # RFC 5737 11 # 12 13 $pub_ip1 = 192.0.2.1 14 $pub_ip2 = 192.0.2.2 15 $pub_ip3 = 192.0.2.3 16 17 $local_ip1 = 10.1.1.1 18 $local_ip2 = 10.1.1.2 19 $local_ip3 = 10.1.1.3 20 $local_ip4 = 10.1.1.4 21 $local_ip5 = 10.1.1.5 22 23 $Kojo = 1001 24 $wheel = 20 25 26 $local_net = { 10.1.1.0/24 } 27 $ports = { 8000, 9000 } 28 29 # 30 # RFC 7042 31 # 32 # 00:00:5E:00:53:00 - 00:00:5E:00:53:FF 33 $mac1 = 00:00:5E:00:53:00 34 $mac2 = 00:00:5E:00:53:01 35 $mac3 = 00:00:5E:00:53:02 36 $nested_mac4 = { 00:00:5E:00:53:03, 00:00:5E:00:53:04, 00:00:5E:00:53:05 } 37 38 # 39 # PR bin/59511 40 # NPF doesn't extract some values from nested variables 41 $home = { 192.168.100.5, 192.168.100.8 } 42 $office = { 192.168.64.3, 192.168.64.9 } 43 $blocklist = { $home, $office } 44 45 map $ext_if static $local_ip3 <-> $pub_ip3 46 map $ext_if dynamic $local_ip2 <-> $pub_ip2 47 map $ext_if dynamic $local_net -> $pub_ip1 48 map $ext_if dynamic $local_ip1 port 6000 <- $pub_ip1 port 8000 49 50 $net6_inner = fd01:203:405::/48 51 $net6_outer = 2001:db8:1::/48 52 53 # Example of multiple addresses with a common 32-bit word, taken from 54 # PR bin/55403: npfctl miscompiles IPv6 rules. 55 $net6_pr55403 = { fe80::1, fe80::1000:0:0/95, fe80::2, fe80::2000:0:0/96, fe80::3, fe80::3000:0:0/97 } 56 57 $net_a = 10.100.0.0/16 58 $net_b = 10.255.0.0/16 59 60 map $ext_if static algo npt66 $net6_inner <-> $net6_outer 61 map $ext_if static algo netmap $net_a <-> $net_b 62 map ruleset "map:some-daemon" on $ext_if 63 64 group "ext" on $ext_if { 65 pass out final from $local_ip3 66 pass in final to $pub_ip3 67 pass in final from $local_ip4 port 8000-10000 user $Kojo group $wheel 68 block out final to 127.0.0.1 user > $Kojo group 1 >< $wheel 69 70 pass out final from $net6_inner 71 pass in final to $net6_outer 72 73 pass out final from $net_a 74 pass in final to $net_b 75 76 pass stateful out final proto tcp flags S/SA all 77 pass stateful out final from $local_net 78 pass stateful in final to any port $ports 79 pass stateful in final proto icmp all 80 81 block all 82 } 83 84 group "int" on $int_if { 85 ruleset "test-rules" 86 block in final from $local_ip3 87 pass stateful out final to $local_ip2 88 pass out final to $local_ip3 89 block final to $local_ip4 90 91 pass in final family inet6 proto udp from $net6_pr55403 92 pass in final family inet6 proto udp from ! $net6_pr55403 to $net6_pr55403 93 94 block in final from $blocklist to $local_ip5 95 } 96 97 group "ext2" on $int_if layer-2 { 98 ruleset "l2-ruleset" layer-2 99 pass ether in final from $mac1 to $mac2 type Ex86DD 100 block ether in final from $mac2 101 pass ether out final to $mac3 type Ex809B 102 pass ether in final from $nested_mac4 103 } 104 105 group default { 106 block all 107 } 108 109 group default layer-2 { 110 block ether all 111 } 112