1# $NetBSD: npftest.conf,v 1.5 2014/02/13 03:34:40 rmind Exp $ 2 3$ext_if = "npftest0" 4$int_if = "npftest1" 5 6# 7# RFC 5737 8# 9 10$pub_ip1 = 192.0.2.1 11$pub_ip2 = 192.0.2.2 12$pub_ip3 = 192.0.2.3 13 14$local_ip1 = 10.1.1.1 15$local_ip2 = 10.1.1.2 16$local_ip3 = 10.1.1.3 17$local_ip4 = 10.1.1.4 18 19$local_net = { 10.1.1.0/24 } 20$ports = { 8000, 9000 } 21 22$net6_inner = fd01:203:405::/48 23$net6_outer = 2001:db8:1::/48 24 25map $ext_if static $local_ip3 <-> $pub_ip3 26map $ext_if dynamic $local_ip2 <-> $pub_ip2 27map $ext_if dynamic $local_net -> $pub_ip1 28map $ext_if dynamic $local_ip1 port 6000 <- $pub_ip1 port 8000 29 30map $ext_if static algo npt66 $net6_inner <-> $net6_outer 31 32group "ext" on $ext_if { 33 pass out final from $local_ip3 34 pass in final to $pub_ip3 35 36 pass out final from $net6_inner 37 pass in final to $net6_outer 38 39 pass stateful out final proto tcp flags S/SA all 40 pass stateful out final from $local_net 41 pass stateful in final to any port $ports 42 pass stateful in final proto icmp all 43 block all 44} 45 46group "int" on $int_if { 47 ruleset "test-rules" 48 pass stateful out final to $local_ip2 49 pass out final to $local_ip3 50 block final to $local_ip4 51} 52 53group default { 54 block all 55} 56