npftest.conf revision 1.16
1 # $NetBSD: npftest.conf,v 1.16 2025/07/10 11:44:12 joe Exp $ 2 3 $ext_if = "npftest0" 4 $int_if = "npftest1" 5 6 set portmap.min_port 1024 7 set portmap.max_port 65535 8 9 # 10 # RFC 5737 11 # 12 13 $pub_ip1 = 192.0.2.1 14 $pub_ip2 = 192.0.2.2 15 $pub_ip3 = 192.0.2.3 16 17 $local_ip1 = 10.1.1.1 18 $local_ip2 = 10.1.1.2 19 $local_ip3 = 10.1.1.3 20 $local_ip4 = 10.1.1.4 21 $Kojo = 1001 22 $wheel = 20 23 24 $local_net = { 10.1.1.0/24 } 25 $ports = { 8000, 9000 } 26 27 # 28 # RFC 7042 29 # 30 # 00:00:5E:00:53:00 - 00:00:5E:00:53:FF 31 $mac1 = 00:00:5E:00:53:00 32 $mac2 = 00:00:5E:00:53:01 33 $mac3 = 00:00:5E:00:53:02 34 $nested_mac4 = { 00:00:5E:00:53:03, 00:00:5E:00:53:04, 00:00:5E:00:53:05 } 35 36 map $ext_if static $local_ip3 <-> $pub_ip3 37 map $ext_if dynamic $local_ip2 <-> $pub_ip2 38 map $ext_if dynamic $local_net -> $pub_ip1 39 map $ext_if dynamic $local_ip1 port 6000 <- $pub_ip1 port 8000 40 41 $net6_inner = fd01:203:405::/48 42 $net6_outer = 2001:db8:1::/48 43 44 # Example of multiple addresses with a common 32-bit word, taken from 45 # PR bin/55403: npfctl miscompiles IPv6 rules. 46 $net6_pr55403 = { fe80::1, fe80::1000:0:0/95, fe80::2, fe80::2000:0:0/96, fe80::3, fe80::3000:0:0/97 } 47 48 $net_a = 10.100.0.0/16 49 $net_b = 10.255.0.0/16 50 51 map $ext_if static algo npt66 $net6_inner <-> $net6_outer 52 map $ext_if static algo netmap $net_a <-> $net_b 53 map ruleset "map:some-daemon" on $ext_if 54 55 group "ext" on $ext_if { 56 pass out final from $local_ip3 57 pass in final to $pub_ip3 58 pass in final from $local_ip4 port 8000-10000 user $Kojo group $wheel 59 block out final to 127.0.0.1 user > $Kojo group 1 >< $wheel 60 61 pass out final from $net6_inner 62 pass in final to $net6_outer 63 64 pass out final from $net_a 65 pass in final to $net_b 66 67 pass stateful out final proto tcp flags S/SA all 68 pass stateful out final from $local_net 69 pass stateful in final to any port $ports 70 pass stateful in final proto icmp all 71 72 block all 73 } 74 75 group "int" on $int_if { 76 ruleset "test-rules" 77 pass stateful out final to $local_ip2 78 pass out final to $local_ip3 79 block final to $local_ip4 80 81 pass in final family inet6 proto udp from $net6_pr55403 82 pass in final family inet6 proto udp from ! $net6_pr55403 to $net6_pr55403 83 } 84 85 group "ext2" on $int_if layer-2 { 86 ruleset "l2-ruleset" layer-2 87 pass ether in final from $mac1 to $mac2 type Ex86DD 88 block ether in final from $mac2 89 pass ether out final to $mac3 type Ex809B 90 pass ether in final from $nested_mac4 91 } 92 93 group default { 94 block all 95 } 96 97 group default layer-2 { 98 block ether all 99 } 100
Indexes created Sun Oct 12 20:09:57 GMT 2025