Home | History | Annotate | Line # | Download | only in npftest 
      1 # $NetBSD: npftestl3.conf,v 1.1 2025/07/20 12:51:36 joe Exp $
      2 
      3 $ext_if = "npftest0"
      4 $int_if = "npftest1"
      5 
      6 set portmap.min_port 1024
      7 set portmap.max_port 65535
      8 
      9 #
     10 # RFC 5737
     11 #
     12 
     13 $pub_ip1 = 192.0.2.1
     14 $pub_ip2 = 192.0.2.2
     15 $pub_ip3 = 192.0.2.3
     16 
     17 $local_ip1 = 10.1.1.1
     18 $local_ip2 = 10.1.1.2
     19 $local_ip3 = 10.1.1.3
     20 $local_ip4 = 10.1.1.4
     21 $Kojo = 1001
     22 $wheel = 20
     23 
     24 $local_net = { 10.1.1.0/24 }
     25 $ports = { 8000, 9000 }
     26 
     27 map $ext_if static $local_ip3 <-> $pub_ip3
     28 map $ext_if dynamic $local_ip2 <-> $pub_ip2
     29 map $ext_if dynamic $local_net -> $pub_ip1
     30 map $ext_if dynamic $local_ip1 port 6000 <- $pub_ip1 port 8000
     31 
     32 $net6_inner = fd01:203:405::/48
     33 $net6_outer = 2001:db8:1::/48
     34 
     35 # Example of multiple addresses with a common 32-bit word, taken from
     36 # PR bin/55403: npfctl miscompiles IPv6 rules.
     37 $net6_pr55403 = { fe80::1, fe80::1000:0:0/95, fe80::2, fe80::2000:0:0/96, fe80::3, fe80::3000:0:0/97 }
     38 
     39 $net_a = 10.100.0.0/16
     40 $net_b = 10.255.0.0/16
     41 
     42 map $ext_if static algo npt66 $net6_inner <-> $net6_outer
     43 map $ext_if static algo netmap $net_a <-> $net_b
     44 map ruleset "map:some-daemon" on $ext_if
     45 
     46 group "ext" on $ext_if {
     47 	pass out final from $local_ip3
     48 	pass in final to $pub_ip3
     49 	pass in final from $local_ip4 user $Kojo group $wheel
     50 	block out final to 127.0.0.1 user > $Kojo group 1 >< $wheel
     51 
     52 	pass out final from $net6_inner
     53 	pass in final to $net6_outer
     54 
     55 	pass out final from $net_a
     56 	pass in final to $net_b
     57 
     58 	pass stateful out final proto tcp flags S/SA all
     59 	pass stateful out final from $local_net
     60 	pass stateful in final to any port $ports
     61 	pass stateful in final proto icmp all
     62 
     63 	block all
     64 }
     65 
     66 group "int" on $int_if {
     67 	ruleset "test-rules"
     68 	pass stateful out final to $local_ip2
     69 	pass out final to $local_ip3
     70 	block final to $local_ip4
     71 
     72 	pass in final family inet6 proto udp from $net6_pr55403
     73 	pass in final family inet6 proto udp from ! $net6_pr55403 to $net6_pr55403
     74 }
     75 
     76 group default {
     77 	block all
     78 }
     79