xref: /src/usr.sbin/npf/npftest/npftest.conf

# $NetBSD: npftest.conf,v 1.18 2025/08/20 11:03:59 joe Exp $

$ext_if = "npftest0"
$int_if = "npftest1"

set portmap.min_port 1024
set portmap.max_port 65535

#
# RFC 5737
#

$pub_ip1 = 192.0.2.1
$pub_ip2 = 192.0.2.2
$pub_ip3 = 192.0.2.3

$local_ip1 = 10.1.1.1
$local_ip2 = 10.1.1.2
$local_ip3 = 10.1.1.3
$local_ip4 = 10.1.1.4
$local_ip5 = 10.1.1.5

$Kojo = 1001
$wheel = 20

$local_net = { 10.1.1.0/24 }
$ports = { 8000, 9000 }

#
# RFC 7042
#
# 00:00:5E:00:53:00 - 00:00:5E:00:53:FF
$mac1 = 00:00:5E:00:53:00
$mac2 = 00:00:5E:00:53:01
$mac3 = 00:00:5E:00:53:02
$nested_mac4 = { 00:00:5E:00:53:03, 00:00:5E:00:53:04, 00:00:5E:00:53:05 }

#
# PR bin/59511
# NPF doesn't extract some values from nested variables
$home = { 192.168.100.5, 192.168.100.8 }
$office = { 192.168.64.3, 192.168.64.9 }
$blocklist = { $home, $office }

map $ext_if static $local_ip3 <-> $pub_ip3
map $ext_if dynamic $local_ip2 <-> $pub_ip2
map $ext_if dynamic $local_net -> $pub_ip1
map $ext_if dynamic $local_ip1 port 6000 <- $pub_ip1 port 8000

$net6_inner = fd01:203:405::/48
$net6_outer = 2001:db8:1::/48

# Example of multiple addresses with a common 32-bit word, taken from
# PR bin/55403: npfctl miscompiles IPv6 rules.
$net6_pr55403 = { fe80::1, fe80::1000:0:0/95, fe80::2, fe80::2000:0:0/96, fe80::3, fe80::3000:0:0/97 }

$net_a = 10.100.0.0/16
$net_b = 10.255.0.0/16

map $ext_if static algo npt66 $net6_inner <-> $net6_outer
map $ext_if static algo netmap $net_a <-> $net_b
map ruleset "map:some-daemon" on $ext_if

group "ext" on $ext_if {
	pass out final from $local_ip3
	pass in final to $pub_ip3
	pass in final from $local_ip4 port 8000-10000 user $Kojo group $wheel
	block out final to 127.0.0.1 user > $Kojo group 1 >< $wheel

	pass out final from $net6_inner
	pass in final to $net6_outer

	pass out final from $net_a
	pass in final to $net_b

	pass stateful out final proto tcp flags S/SA all
	pass stateful out final from $local_net
	pass stateful in final to any port $ports
	pass stateful in final proto icmp all

	block all
}

group "int" on $int_if {
	ruleset "test-rules"
	block in final from $local_ip3
	pass stateful out final to $local_ip2
	pass out final to $local_ip3
	block final to $local_ip4

	pass in final family inet6 proto udp from $net6_pr55403
	pass in final family inet6 proto udp from ! $net6_pr55403 to $net6_pr55403

	block in final from $blocklist to $local_ip5
}

group "ext2" on $int_if layer-2 {
	ruleset "l2-ruleset" layer-2
	pass ether in final from $mac1 to $mac2 type Ex86DD
	block ether in final from $mac2
	pass ether out final to $mac3 type Ex809B
	pass ether in final from $nested_mac4
}

group default {
	block all
}

group default layer-2 {
	block ether all
}