Home | History | Annotate | Line # | Download | only in npftest
npftest.conf revision 1.6 
      1 # $NetBSD: npftest.conf,v 1.6 2019/01/19 21:19:32 rmind Exp $
      2 
      3 $ext_if = "npftest0"
      4 $int_if = "npftest1"
      5 
      6 #
      7 # RFC 5737
      8 #
      9 
     10 $pub_ip1 = 192.0.2.1
     11 $pub_ip2 = 192.0.2.2
     12 $pub_ip3 = 192.0.2.3
     13 
     14 $local_ip1 = 10.1.1.1
     15 $local_ip2 = 10.1.1.2
     16 $local_ip3 = 10.1.1.3
     17 $local_ip4 = 10.1.1.4
     18 
     19 $local_net = { 10.1.1.0/24 }
     20 $ports = { 8000, 9000 }
     21 
     22 map $ext_if static $local_ip3 <-> $pub_ip3
     23 map $ext_if dynamic $local_ip2 <-> $pub_ip2
     24 map $ext_if dynamic $local_net -> $pub_ip1
     25 map $ext_if dynamic $local_ip1 port 6000 <- $pub_ip1 port 8000
     26 
     27 $net6_inner = fd01:203:405::/48
     28 $net6_outer = 2001:db8:1::/48
     29 
     30 $net_a = 10.100.0.0/16
     31 $net_b = 10.255.0.0/16
     32 
     33 map $ext_if static algo npt66 $net6_inner <-> $net6_outer
     34 map $ext_if static algo netmap $net_a <-> $net_b
     35 
     36 group "ext" on $ext_if {
     37 	pass out final from $local_ip3
     38 	pass in final to $pub_ip3
     39 
     40 	pass out final from $net6_inner
     41 	pass in final to $net6_outer
     42 
     43 	pass out final from $net_a
     44 	pass in final to $net_b
     45 
     46 	pass stateful out final proto tcp flags S/SA all
     47 	pass stateful out final from $local_net
     48 	pass stateful in final to any port $ports
     49 	pass stateful in final proto icmp all
     50 	block all
     51 }
     52 
     53 group "int" on $int_if {
     54 	ruleset "test-rules"
     55 	pass stateful out final to $local_ip2
     56 	pass out final to $local_ip3
     57 	block final to $local_ip4
     58 }
     59 
     60 group default {
     61 	block all
     62 }
     63