npftestl3.conf revision 1.1.4.2
1 1.1.4.2 perseant # $NetBSD: npftestl3.conf,v 1.1.4.2 2025/08/02 05:58:53 perseant Exp $ 2 1.1.4.2 perseant 3 1.1.4.2 perseant $ext_if = "npftest0" 4 1.1.4.2 perseant $int_if = "npftest1" 5 1.1.4.2 perseant 6 1.1.4.2 perseant set portmap.min_port 1024 7 1.1.4.2 perseant set portmap.max_port 65535 8 1.1.4.2 perseant 9 1.1.4.2 perseant # 10 1.1.4.2 perseant # RFC 5737 11 1.1.4.2 perseant # 12 1.1.4.2 perseant 13 1.1.4.2 perseant $pub_ip1 = 192.0.2.1 14 1.1.4.2 perseant $pub_ip2 = 192.0.2.2 15 1.1.4.2 perseant $pub_ip3 = 192.0.2.3 16 1.1.4.2 perseant 17 1.1.4.2 perseant $local_ip1 = 10.1.1.1 18 1.1.4.2 perseant $local_ip2 = 10.1.1.2 19 1.1.4.2 perseant $local_ip3 = 10.1.1.3 20 1.1.4.2 perseant $local_ip4 = 10.1.1.4 21 1.1.4.2 perseant $Kojo = 1001 22 1.1.4.2 perseant $wheel = 20 23 1.1.4.2 perseant 24 1.1.4.2 perseant $local_net = { 10.1.1.0/24 } 25 1.1.4.2 perseant $ports = { 8000, 9000 } 26 1.1.4.2 perseant 27 1.1.4.2 perseant map $ext_if static $local_ip3 <-> $pub_ip3 28 1.1.4.2 perseant map $ext_if dynamic $local_ip2 <-> $pub_ip2 29 1.1.4.2 perseant map $ext_if dynamic $local_net -> $pub_ip1 30 1.1.4.2 perseant map $ext_if dynamic $local_ip1 port 6000 <- $pub_ip1 port 8000 31 1.1.4.2 perseant 32 1.1.4.2 perseant $net6_inner = fd01:203:405::/48 33 1.1.4.2 perseant $net6_outer = 2001:db8:1::/48 34 1.1.4.2 perseant 35 1.1.4.2 perseant # Example of multiple addresses with a common 32-bit word, taken from 36 1.1.4.2 perseant # PR bin/55403: npfctl miscompiles IPv6 rules. 37 1.1.4.2 perseant $net6_pr55403 = { fe80::1, fe80::1000:0:0/95, fe80::2, fe80::2000:0:0/96, fe80::3, fe80::3000:0:0/97 } 38 1.1.4.2 perseant 39 1.1.4.2 perseant $net_a = 10.100.0.0/16 40 1.1.4.2 perseant $net_b = 10.255.0.0/16 41 1.1.4.2 perseant 42 1.1.4.2 perseant map $ext_if static algo npt66 $net6_inner <-> $net6_outer 43 1.1.4.2 perseant map $ext_if static algo netmap $net_a <-> $net_b 44 1.1.4.2 perseant map ruleset "map:some-daemon" on $ext_if 45 1.1.4.2 perseant 46 1.1.4.2 perseant group "ext" on $ext_if { 47 1.1.4.2 perseant pass out final from $local_ip3 48 1.1.4.2 perseant pass in final to $pub_ip3 49 1.1.4.2 perseant pass in final from $local_ip4 user $Kojo group $wheel 50 1.1.4.2 perseant block out final to 127.0.0.1 user > $Kojo group 1 >< $wheel 51 1.1.4.2 perseant 52 1.1.4.2 perseant pass out final from $net6_inner 53 1.1.4.2 perseant pass in final to $net6_outer 54 1.1.4.2 perseant 55 1.1.4.2 perseant pass out final from $net_a 56 1.1.4.2 perseant pass in final to $net_b 57 1.1.4.2 perseant 58 1.1.4.2 perseant pass stateful out final proto tcp flags S/SA all 59 1.1.4.2 perseant pass stateful out final from $local_net 60 1.1.4.2 perseant pass stateful in final to any port $ports 61 1.1.4.2 perseant pass stateful in final proto icmp all 62 1.1.4.2 perseant 63 1.1.4.2 perseant block all 64 1.1.4.2 perseant } 65 1.1.4.2 perseant 66 1.1.4.2 perseant group "int" on $int_if { 67 1.1.4.2 perseant ruleset "test-rules" 68 1.1.4.2 perseant pass stateful out final to $local_ip2 69 1.1.4.2 perseant pass out final to $local_ip3 70 1.1.4.2 perseant block final to $local_ip4 71 1.1.4.2 perseant 72 1.1.4.2 perseant pass in final family inet6 proto udp from $net6_pr55403 73 1.1.4.2 perseant pass in final family inet6 proto udp from ! $net6_pr55403 to $net6_pr55403 74 1.1.4.2 perseant } 75 1.1.4.2 perseant 76 1.1.4.2 perseant group default { 77 1.1.4.2 perseant block all 78 1.1.4.2 perseant } 79
Indexes created Sat Nov 01 21:09:44 GMT 2025