Home | History | Annotate | Line # | Download | only in npftest
npftest.conf revision 1.7.2.3 
      1 # $NetBSD: npftest.conf,v 1.7.2.3 2024/11/17 13:58:11 martin Exp $
      2 
      3 $ext_if = "npftest0"
      4 $int_if = "npftest1"
      5 
      6 set portmap.min_port 1024
      7 set portmap.max_port 65535
      8 
      9 #
     10 # RFC 5737
     11 #
     12 
     13 $pub_ip1 = 192.0.2.1
     14 $pub_ip2 = 192.0.2.2
     15 $pub_ip3 = 192.0.2.3
     16 
     17 $local_ip1 = 10.1.1.1
     18 $local_ip2 = 10.1.1.2
     19 $local_ip3 = 10.1.1.3
     20 $local_ip4 = 10.1.1.4
     21 
     22 $local_net = { 10.1.1.0/24 }
     23 $ports = { 8000, 9000 }
     24 
     25 map $ext_if static $local_ip3 <-> $pub_ip3
     26 map $ext_if dynamic $local_ip2 <-> $pub_ip2
     27 map $ext_if dynamic $local_net -> $pub_ip1
     28 map $ext_if dynamic $local_ip1 port 6000 <- $pub_ip1 port 8000
     29 
     30 $net6_inner = fd01:203:405::/48
     31 $net6_outer = 2001:db8:1::/48
     32 
     33 # Example of multiple addresses with a common 32-bit word, taken from
     34 # PR bin/55403: npfctl miscompiles IPv6 rules.
     35 $net6_pr55403 = { fe80::1, fe80::1000:0:0/95, fe80::2, fe80::2000:0:0/96, fe80::3, fe80::3000:0:0/97 }
     36 
     37 $net_a = 10.100.0.0/16
     38 $net_b = 10.255.0.0/16
     39 
     40 map $ext_if static algo npt66 $net6_inner <-> $net6_outer
     41 map $ext_if static algo netmap $net_a <-> $net_b
     42 map ruleset "map:some-daemon" on $ext_if
     43 
     44 group "ext" on $ext_if {
     45 	pass out final from $local_ip3
     46 	pass in final to $pub_ip3
     47 
     48 	pass out final from $net6_inner
     49 	pass in final to $net6_outer
     50 
     51 	pass out final from $net_a
     52 	pass in final to $net_b
     53 
     54 	pass stateful out final proto tcp flags S/SA all
     55 	pass stateful out final from $local_net
     56 	pass stateful in final to any port $ports
     57 	pass stateful in final proto icmp all
     58 
     59 	block all
     60 }
     61 
     62 group "int" on $int_if {
     63 	ruleset "test-rules"
     64 	pass stateful out final to $local_ip2
     65 	pass out final to $local_ip3
     66 	block final to $local_ip4
     67 
     68 	pass in final family inet6 proto udp from $net6_pr55403
     69 	pass in final family inet6 proto udp from ! $net6_pr55403 to $net6_pr55403
     70 }
     71 
     72 group default {
     73 	block all
     74 }
     75