Home | History | Annotate | Line # | Download | only in npftest
npftest.conf revision 1.1.6.3 
      1 # $NetBSD: npftest.conf,v 1.1.6.3 2014/05/22 11:43:07 yamt Exp $
      2 
      3 $ext_if = "npftest0"
      4 $int_if = "npftest1"
      5 
      6 #
      7 # RFC 5737
      8 #
      9 
     10 $pub_ip1 = 192.0.2.1
     11 $pub_ip2 = 192.0.2.2
     12 $pub_ip3 = 192.0.2.3
     13 
     14 $local_ip1 = 10.1.1.1
     15 $local_ip2 = 10.1.1.2
     16 $local_ip3 = 10.1.1.3
     17 $local_ip4 = 10.1.1.4
     18 
     19 $local_net = { 10.1.1.0/24 }
     20 $ports = { 8000, 9000 }
     21 
     22 $net6_inner = fd01:203:405::/48
     23 $net6_outer = 2001:db8:1::/48
     24 
     25 map $ext_if static $local_ip3 <-> $pub_ip3
     26 map $ext_if dynamic $local_ip2 <-> $pub_ip2
     27 map $ext_if dynamic $local_net -> $pub_ip1
     28 map $ext_if dynamic $local_ip1 port 6000 <- $pub_ip1 port 8000
     29 
     30 map $ext_if static algo npt66 $net6_inner <-> $net6_outer
     31 
     32 group "ext" on $ext_if {
     33 	pass out final from $local_ip3
     34 	pass in final to $pub_ip3
     35 
     36 	pass out final from $net6_inner
     37 	pass in final to $net6_outer
     38 
     39 	pass stateful out final proto tcp flags S/SA all
     40 	pass stateful out final from $local_net
     41 	pass stateful in final to any port $ports
     42 	pass stateful in final proto icmp all
     43 	block all
     44 }
     45 
     46 group "int" on $int_if {
     47 	ruleset "test-rules"
     48 	pass stateful out final to $local_ip2
     49 	pass out final to $local_ip3
     50 	block final to $local_ip4
     51 }
     52 
     53 group default {
     54 	block all
     55 }
     56