1# $NetBSD: npftest.conf,v 1.12 2024/10/30 11:03:32 riastradh Exp $ 2 3$ext_if = "npftest0" 4$int_if = "npftest1" 5 6set portmap.min_port 1024 7set portmap.max_port 65535 8 9# 10# RFC 5737 11# 12 13$pub_ip1 = 192.0.2.1 14$pub_ip2 = 192.0.2.2 15$pub_ip3 = 192.0.2.3 16 17$local_ip1 = 10.1.1.1 18$local_ip2 = 10.1.1.2 19$local_ip3 = 10.1.1.3 20$local_ip4 = 10.1.1.4 21 22$local_net = { 10.1.1.0/24 } 23$ports = { 8000, 9000 } 24 25map $ext_if static $local_ip3 <-> $pub_ip3 26map $ext_if dynamic $local_ip2 <-> $pub_ip2 27map $ext_if dynamic $local_net -> $pub_ip1 28map $ext_if dynamic $local_ip1 port 6000 <- $pub_ip1 port 8000 29 30$net6_inner = fd01:203:405::/48 31$net6_outer = 2001:db8:1::/48 32 33# Example of multiple addresses with a common 32-bit word, taken from 34# PR bin/55403: npfctl miscompiles IPv6 rules. 35$net6_pr55403 = { fe80::1, fe80::1000:0:0/95, fe80::2, fe80::2000:0:0/96, fe80::3, fe80::3000:0:0/97 } 36 37$net_a = 10.100.0.0/16 38$net_b = 10.255.0.0/16 39 40map $ext_if static algo npt66 $net6_inner <-> $net6_outer 41map $ext_if static algo netmap $net_a <-> $net_b 42map ruleset "map:some-daemon" on $ext_if 43 44group "ext" on $ext_if { 45 pass out final from $local_ip3 46 pass in final to $pub_ip3 47 48 pass out final from $net6_inner 49 pass in final to $net6_outer 50 51 pass out final from $net_a 52 pass in final to $net_b 53 54 pass stateful out final proto tcp flags S/SA all 55 pass stateful out final from $local_net 56 pass stateful in final to any port $ports 57 pass stateful in final proto icmp all 58 59 block all 60} 61 62group "int" on $int_if { 63 ruleset "test-rules" 64 pass stateful out final to $local_ip2 65 pass out final to $local_ip3 66 block final to $local_ip4 67 68 pass in final family inet6 proto udp from $net6_pr55403 69 pass in final family inet6 proto udp from ! $net6_pr55403 to $net6_pr55403 70} 71 72group default { 73 block all 74} 75