1.\" $NetBSD: npfctl.8,v 1.20 2017/12/10 22:04:41 rmind Exp $ 2.\" 3.\" Copyright (c) 2009-2014 The NetBSD Foundation, Inc. 4.\" All rights reserved. 5.\" 6.\" This material is based upon work partially supported by The 7.\" NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 8.\" 9.\" Redistribution and use in source and binary forms, with or without 10.\" modification, are permitted provided that the following conditions 11.\" are met: 12.\" 1. Redistributions of source code must retain the above copyright 13.\" notice, this list of conditions and the following disclaimer. 14.\" 2. Redistributions in binary form must reproduce the above copyright 15.\" notice, this list of conditions and the following disclaimer in the 16.\" documentation and/or other materials provided with the distribution. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 19.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 20.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 21.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 22.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 28.\" POSSIBILITY OF SUCH DAMAGE. 29.\" 30.Dd December 10, 2017 31.Dt NPFCTL 8 32.Os 33.Sh NAME 34.Nm npfctl 35.Nd control NPF packet filter 36.Sh SYNOPSIS 37.Nm npfctl 38.Ar command 39.Op Ar arguments 40.\" ----- 41.Sh DESCRIPTION 42The 43.Nm 44command can be used to control the NPF packet filter. 45For a description of NPF's configuration file, see 46.Xr npf.conf 5 . 47.Pp 48The first argument, 49.Ar command , 50specifies the action to take. 51Valid commands are: 52.Bl -tag -width reload -offset 3n 53.It Ic start 54Enable packet inspection using the currently loaded configuration, if any. 55Note that this command does not load or reload the configuration, 56or affect existing connections. 57.It Ic stop 58Disable packet inspection. 59This command does not change the currently loaded configuration, 60or affect existing connections. 61.It Ic reload Op Ar path 62Load or reload configuration from file. 63The configuration file at 64.Pa /etc/npf.conf 65will be used unless a file is specified by 66.Ar path . 67All connections will be preserved during the reload, except those which 68will lose NAT policy due to removal. 69NAT policy is determined by the translation type and address. 70Note that change of filter criteria will not expire associated connections. 71The reload operation (i.e., replacing the ruleset, NAT policies and tables) 72is atomic. 73.It Ic flush 74Flush configuration. 75That is, remove all rules, tables and expire all connections. 76This command does not disable packet inspection. 77.It Ic show 78Show the current state and configuration. 79Syntax of printed configuration is for the user and may not match the 80.Xr npf.conf 5 81syntax. 82.It Ic validate Op Ar path 83Validate the configuration file and the processed form. 84The configuration file at 85.Pa /etc/npf.conf 86will be used unless a file is specified by 87.Ar path . 88.\" --- 89.It Ic rule Ar name Ic add Aq rule-syntax 90Add a rule to a dynamic ruleset specified by 91.Ar name . 92On success, returns a unique identifier which can be used to remove 93the rule with 94.Ic rem-id 95command. 96The identifier is alphanumeric string. 97.It Ic rule Ar name Ic rem Aq rule-syntax 98Remove a rule from a dynamic ruleset specified by 99.Ar name . 100This method uses SHA1 hash computed on a rule to identify it. 101Although very unlikely, it is subject to hash collisions. 102For a fully reliable and more efficient method, it is recommended to use 103.Ic rem-id 104command. 105.It Ic rule Ar name Ic rem-id Aq id 106Remove a rule specified by unique 107.Ar id 108from a dynamic ruleset specified by 109.Ar name . 110.It Ic rule Ar name Ic list 111List all rules in the dynamic ruleset specified by 112.Ar name . 113.It Ic rule Ar name Ic flush 114Remove all rules from the dynamic ruleset specified by 115.Ar name . 116.\" --- 117.It Ic table Ar tid Ic add Aq Ar addr/mask 118In table 119.Ar tid , 120add the IP address and optionally netmask, specified by 121.Aq Ar addr/mask . 122Only tree-type tables support masks. 123.It Ic table Ar tid Ic rem Aq Ar addr/mask 124In table 125.Ar tid , 126remove the IP address and optionally netmask, specified by 127.Aq Ar addr/mask . 128Only tree-type tables support masks. 129.It Ic table Ar tid Ic test Aq Ar addr 130Query the table 131.Ar tid 132for a specific IP address, specified by 133.Ar addr . 134If no mask is specified, a single host is assumed. 135.It Ic table Ar tid Ic list 136List all entries in the currently loaded table specified by 137.Ar tid . 138This operation is expensive and should be used with caution. 139.\" --- 140.It Ic save 141Save the active configuration and a snapshot of the current connections. 142The data will be stored in the 143.Pa /var/db/npf.db 144file. 145Administrator may want to stop the packet inspection before saving. 146.It Ic load 147Load the saved configuration file and the connections from the file. 148Note that any existing connections will be destroyed. 149Administrator may want to start packet inspection after the load. 150.It Ic stats 151Print various statistics. 152.It Ic debug 153Process the configuration file, print the byte-code of each rule 154and dump the raw configuration. 155This is primarily for developer use. 156.It Ic list Oo Fl 46hNnw Oc Op Fl i Ar ifname 157Display a list of tracked connections: 158.Bl -tag -width xxxxxxxxx -compact -offset 3n 159.It Fl 4 160Display only IPv4 connections. 161.It Fl 6 162Display only IPv6 connections. 163.It Fl h 164Don't display a header. 165.It Fl N 166Try to resolve addresses. 167.It Fl n 168Only show NAT connections. 169.It Fl w 170Don't restrict display width. 171.It Fl i Ar ifname 172Display only connections through the named interface. 173.El 174.El 175.Sh PERFORMANCE 176Reloading the configuration is a relatively expensive operation. 177Therefore, frequent reloads should be avoided. 178Use of tables should be considered as an alternative design. 179See 180.Xr npf.conf 5 181for details. 182.\" ----- 183.Sh FILES 184.Bl -tag -width /etc/npf.conf -compact 185.It Pa /dev/npf 186control device 187.It Pa /etc/npf.conf 188default configuration file 189.El 190.\" ----- 191.Sh EXAMPLES 192Starting the NPF packet filter: 193.Bd -literal -offset indent 194# npfctl reload 195# npfctl start 196# npfctl show 197.Ed 198.Pp 199Addition and removal of entries in the table whose ID is 2: 200.Bd -literal -offset indent 201# npfctl table 2 add 10.0.0.1 202# npfctl table 2 rem 182.168.0.0/24 203.Ed 204.\" ----- 205.Sh SEE ALSO 206.Xr bpf 4 , 207.Xr npf.conf 5 , 208.Xr npf 7 , 209.Xr npfd 8 210.Sh HISTORY 211NPF first appeared in 212.Nx 6.0 . 213.Sh AUTHORS 214NPF was designed and implemented by 215.An Mindaugas Rasiukevicius . 216