xref: /src/usr.sbin/npf/npftest/npftest.conf

# $NetBSD: npftest.conf,v 1.1.4.1 2013/02/25 00:30:47 tls Exp $

$ext_if = "npftest0"
$int_if = "npftest1"

#
# RFC 5737
#

$pub_ip1 = 192.0.2.1
$pub_ip2 = 192.0.2.2

$local_ip1 = 10.1.1.1
$local_ip2 = 10.1.1.2
$local_ip3 = 10.1.1.3
$local_ip4 = 10.1.1.4

$local_net = { 10.1.1.0/24 }
$ports = { 8000, 9000 }

map $ext_if dynamic $local_ip2 <-> $pub_ip2
map $ext_if dynamic $local_net -> $pub_ip1
map $ext_if dynamic $local_ip1 port 6000 <- $pub_ip1 port 8000

group (interface $ext_if) {
	pass stateful out final proto tcp flags S/SA all
	pass stateful out final from $local_net
	pass stateful in final to any port $ports
	pass stateful in final proto icmp all
	block all
}

group (interface $int_if) {
	ruleset (name "test-rules", dynamic)
	pass stateful out final to $local_ip2
	pass out final to $local_ip3
	block final to $local_ip4
}

group (default) {
	block all
}