Home | History | Annotate | Line # | Download | only in npftest
npftest.conf revision 1.7 
      1 # $NetBSD: npftest.conf,v 1.7 2019/07/23 00:52:02 rmind Exp $
      2 
      3 $ext_if = "npftest0"
      4 $int_if = "npftest1"
      5 
      6 #
      7 # RFC 5737
      8 #
      9 
     10 $pub_ip1 = 192.0.2.1
     11 $pub_ip2 = 192.0.2.2
     12 $pub_ip3 = 192.0.2.3
     13 
     14 $local_ip1 = 10.1.1.1
     15 $local_ip2 = 10.1.1.2
     16 $local_ip3 = 10.1.1.3
     17 $local_ip4 = 10.1.1.4
     18 
     19 $local_net = { 10.1.1.0/24 }
     20 $ports = { 8000, 9000 }
     21 
     22 map $ext_if static $local_ip3 <-> $pub_ip3
     23 map $ext_if dynamic $local_ip2 <-> $pub_ip2
     24 map $ext_if dynamic $local_net -> $pub_ip1
     25 map $ext_if dynamic $local_ip1 port 6000 <- $pub_ip1 port 8000
     26 
     27 $net6_inner = fd01:203:405::/48
     28 $net6_outer = 2001:db8:1::/48
     29 
     30 $net_a = 10.100.0.0/16
     31 $net_b = 10.255.0.0/16
     32 
     33 map $ext_if static algo npt66 $net6_inner <-> $net6_outer
     34 map $ext_if static algo netmap $net_a <-> $net_b
     35 map ruleset "dynamic-nat" on $ext_if
     36 
     37 group "ext" on $ext_if {
     38 	pass out final from $local_ip3
     39 	pass in final to $pub_ip3
     40 
     41 	pass out final from $net6_inner
     42 	pass in final to $net6_outer
     43 
     44 	pass out final from $net_a
     45 	pass in final to $net_b
     46 
     47 	pass stateful out final proto tcp flags S/SA all
     48 	pass stateful out final from $local_net
     49 	pass stateful in final to any port $ports
     50 	pass stateful in final proto icmp all
     51 	block all
     52 }
     53 
     54 group "int" on $int_if {
     55 	ruleset "test-rules"
     56 	pass stateful out final to $local_ip2
     57 	pass out final to $local_ip3
     58 	block final to $local_ip4
     59 }
     60 
     61 group default {
     62 	block all
     63 }
     64