1.\" $NetBSD: npfctl.8,v 1.24 2019/09/30 21:06:16 uwe Exp $ 2.\" 3.\" Copyright (c) 2009-2014 The NetBSD Foundation, Inc. 4.\" All rights reserved. 5.\" 6.\" This material is based upon work partially supported by The 7.\" NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 8.\" 9.\" Redistribution and use in source and binary forms, with or without 10.\" modification, are permitted provided that the following conditions 11.\" are met: 12.\" 1. Redistributions of source code must retain the above copyright 13.\" notice, this list of conditions and the following disclaimer. 14.\" 2. Redistributions in binary form must reproduce the above copyright 15.\" notice, this list of conditions and the following disclaimer in the 16.\" documentation and/or other materials provided with the distribution. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 19.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 20.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 21.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 22.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 28.\" POSSIBILITY OF SUCH DAMAGE. 29.\" 30.Dd August 26, 2019 31.Dt NPFCTL 8 32.Os 33.Sh NAME 34.Nm npfctl 35.Nd control NPF packet filter 36.Sh SYNOPSIS 37.Nm npfctl 38.Ar command 39.Op Ar arguments 40.\" ----- 41.Sh DESCRIPTION 42The 43.Nm 44command can be used to control the NPF packet filter. 45For a description of NPF's configuration file, see 46.Xr npf.conf 5 . 47.Pp 48The first argument, 49.Ar command , 50specifies the action to take. 51Valid commands are: 52.Bl -tag -width reload -offset 3n 53.It Ic start 54Enable packet inspection using the currently loaded configuration, if any. 55Note that this command does not load or reload the configuration, 56or affect existing connections. 57.It Ic stop 58Disable packet inspection. 59This command does not change the currently loaded configuration, 60or affect existing connections. 61.It Ic reload Op Ar path 62Load or reload configuration from file. 63The configuration file at 64.Pa /etc/npf.conf 65will be used unless a file is specified by 66.Ar path . 67All connections will be preserved during the reload, except those which 68will lose NAT policy due to removal. 69NAT policy is determined by the translation type and address. 70Note that change of filter criteria will not expire associated connections. 71The reload operation (i.e., replacing the ruleset, NAT policies and tables) 72is atomic. 73.It Ic flush 74Flush configuration. 75That is, remove all rules, tables and expire all connections. 76This command does not disable packet inspection. 77.It Ic show 78Show the current state and configuration. 79Syntax of printed configuration is for the user and may not match the 80.Xr npf.conf 5 81syntax. 82.It Ic validate Op Ar path 83Validate the configuration file and the processed form. 84The configuration file at 85.Pa /etc/npf.conf 86will be used unless a file is specified by 87.Ar path . 88.\" --- 89.It Ic rule Ar name Ic add Aq rule-syntax 90Add a rule to a dynamic ruleset specified by 91.Ar name . 92On success, returns a unique identifier which can be used to remove 93the rule with 94.Ic rem-id 95command. 96The identifier is alphanumeric string. 97.It Ic rule Ar name Ic rem Aq rule-syntax 98Remove a rule from a dynamic ruleset specified by 99.Ar name . 100This method uses SHA1 hash computed on a rule to identify it. 101Although very unlikely, it is subject to hash collisions. 102For a fully reliable and more efficient method, it is recommended to use 103.Ic rem-id 104command. 105.It Ic rule Ar name Ic rem-id Aq id 106Remove a rule specified by unique 107.Ar id 108from a dynamic ruleset specified by 109.Ar name . 110.It Ic rule Ar name Ic list 111List all rules in the dynamic ruleset specified by 112.Ar name . 113.It Ic rule Ar name Ic flush 114Remove all rules from the dynamic ruleset specified by 115.Ar name . 116.\" --- 117.It Ic table Ar name Ic add Aq Ar addr/mask 118In table 119.Ar name , 120add the IP address and optionally netmask, specified by 121.Aq Ar addr/mask . 122Only the tables of type "lpm" support masks. 123.It Ic table Ar name Ic rem Aq Ar addr/mask 124In table 125.Ar name , 126remove the IP address and optionally netmask, specified by 127.Aq Ar addr/mask . 128Only the tables of type "lpm" support masks. 129.It Ic table Ar name Ic test Aq Ar addr 130Query the table 131.Ar name 132for a specific IP address, specified by 133.Ar addr . 134If no mask is specified, a single host is assumed. 135.It Ic table Ar name Ic list 136List all entries in the currently loaded table specified by 137.Ar name . 138This operation is expensive and should be used with caution. 139.It Ic table Ar name Ic replace Oo Fl n Ar newname Oc Oo Fl t Ar type Oc Aq Ar path 140Replace the existing table specified by 141.Ar name 142with a new table built from the file specified by 143.Ar path . 144Optionally, the new table will: 145.Bl -tag -width xxxxxxxxxx -compact -offset 3n 146.It Fl n Ar newname 147be named 148.Ar newname , 149effectively renaming the table. 150If not specified, the name of the table being replaced will be used. 151.It Fl t Ar type 152be of type 153.Ar type ; 154currently supported types are 155.Cm ipset , 156.Cm lpm , 157or 158.Cm const . 159If not specified, the type of the table being replaced will be used. 160.El 161.\" --- 162.It Ic save 163Save the active configuration and a snapshot of the current connections. 164The data will be stored in the 165.Pa /var/db/npf.db 166file. 167Administrator may want to stop the packet inspection before saving. 168.It Ic load 169Load the saved configuration file and the connections from the file. 170Note that any existing connections will be destroyed. 171Administrator may want to start packet inspection after the load. 172.It Ic stats 173Print various statistics. 174.It Ic debug 175Process the configuration file, print the byte-code of each rule 176and dump the raw configuration. 177This is primarily for developer use. 178.It Ic list Oo Fl 46hNnw Oc Op Fl i Ar ifname 179Display a list of tracked connections: 180.Bl -tag -width xxxxxxxxx -compact -offset 3n 181.It Fl 4 182Display only IPv4 connections. 183.It Fl 6 184Display only IPv6 connections. 185.It Fl h 186Don't display a header. 187.It Fl N 188Try to resolve addresses. 189.It Fl n 190Only show NAT connections. 191.It Fl w 192Don't restrict display width. 193.It Fl i Ar ifname 194Display only connections through the named interface. 195.El 196.El 197.Sh PERFORMANCE 198Reloading the configuration is a relatively expensive operation. 199Therefore, frequent reloads should be avoided. 200Use of tables should be considered as an alternative design. 201See 202.Xr npf.conf 5 203for details. 204.\" ----- 205.Sh FILES 206.Bl -tag -width Pa -compact 207.It Pa /dev/npf 208control device 209.It Pa /etc/npf.conf 210default configuration file 211.El 212.\" ----- 213.Sh EXAMPLES 214Starting the NPF packet filter: 215.Bd -literal -offset indent 216# npfctl reload 217# npfctl start 218# npfctl show 219.Ed 220.Pp 221Addition and removal of entries in the table whose ID is "vip": 222.Bd -literal -offset indent 223# npfctl table "vip" add 10.0.0.1 224# npfctl table "vip" rem 182.168.0.0/24 225.Ed 226.Pp 227Replacing the existing table which has ID "svr" 228with a new const table populated from file "/tmp/npf_vps_new", 229and renamed to "vps": 230.Bd -literal -offset indent 231# npfctl table "svr" replace -n "vps" -t const "/tmp/npf_vps_new" 232.Ed 233.\" ----- 234.Sh SEE ALSO 235.Xr bpf 4 , 236.Xr npf.conf 5 , 237.Xr npf 7 , 238.Xr npfd 8 239.Sh HISTORY 240NPF first appeared in 241.Nx 6.0 . 242.Sh AUTHORS 243NPF was designed and implemented by 244.An Mindaugas Rasiukevicius . 245