Home | History | Annotate | Line # | Download | only in npftest
npftest.conf revision 1.7.2.2 
      1 # $NetBSD: npftest.conf,v 1.7.2.2 2020/06/20 15:46:48 martin Exp $
      2 
      3 $ext_if = "npftest0"
      4 $int_if = "npftest1"
      5 
      6 set portmap.min_port 1024
      7 set portmap.max_port 65535
      8 
      9 #
     10 # RFC 5737
     11 #
     12 
     13 $pub_ip1 = 192.0.2.1
     14 $pub_ip2 = 192.0.2.2
     15 $pub_ip3 = 192.0.2.3
     16 
     17 $local_ip1 = 10.1.1.1
     18 $local_ip2 = 10.1.1.2
     19 $local_ip3 = 10.1.1.3
     20 $local_ip4 = 10.1.1.4
     21 
     22 $local_net = { 10.1.1.0/24 }
     23 $ports = { 8000, 9000 }
     24 
     25 map $ext_if static $local_ip3 <-> $pub_ip3
     26 map $ext_if dynamic $local_ip2 <-> $pub_ip2
     27 map $ext_if dynamic $local_net -> $pub_ip1
     28 map $ext_if dynamic $local_ip1 port 6000 <- $pub_ip1 port 8000
     29 
     30 $net6_inner = fd01:203:405::/48
     31 $net6_outer = 2001:db8:1::/48
     32 
     33 $net_a = 10.100.0.0/16
     34 $net_b = 10.255.0.0/16
     35 
     36 map $ext_if static algo npt66 $net6_inner <-> $net6_outer
     37 map $ext_if static algo netmap $net_a <-> $net_b
     38 map ruleset "map:some-daemon" on $ext_if
     39 
     40 group "ext" on $ext_if {
     41 	pass out final from $local_ip3
     42 	pass in final to $pub_ip3
     43 
     44 	pass out final from $net6_inner
     45 	pass in final to $net6_outer
     46 
     47 	pass out final from $net_a
     48 	pass in final to $net_b
     49 
     50 	pass stateful out final proto tcp flags S/SA all
     51 	pass stateful out final from $local_net
     52 	pass stateful in final to any port $ports
     53 	pass stateful in final proto icmp all
     54 	block all
     55 }
     56 
     57 group "int" on $int_if {
     58 	ruleset "test-rules"
     59 	pass stateful out final to $local_ip2
     60 	pass out final to $local_ip3
     61 	block final to $local_ip4
     62 }
     63 
     64 group default {
     65 	block all
     66 }
     67