blob: 1577eabcd05e44dd02082785b787584aa3efbc68 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
# $NetBSD: host-npf.conf,v 1.6 2014/02/08 01:32:19 rmind Exp $
#
# this is an example of NPF rules for a host (i.e., not routing) with
# two network interfaces, wired and wifi
#
# it does both IPv4 and IPv6 and allows for DHCP in v4 and SLAAC in v6
# it also does IPSEC on the wifi
#
$wired_if = "wm0"
$wired_v4 = { inet4(wm0) }
$wired_v6 = { inet6(wm0) }
$wifi_if = "iwn0"
$wifi_v4 = { inet4(iwn0) }
$wifi_v6 = { inet6(iwn0) }
$dhcpserver = { 198.51.100.1 }
# sample udp service
$services_udp = { ntp }
# sample mixed service
$backupsrv_v4 = { 198.51.100.11 }
$backupsrv_v6 = { 2001:0DB8:404::11 }
$backup_port = { amanda }
# watching a tcpdump of npflog0, when it only logs blocks,
# can be very helpful for building the rules you actually need
procedure "log" {
log: npflog0
}
group "wired" on $wired_if {
# not being picky about our own address here
pass in final family inet6 proto ipv6-icmp all
pass out final family inet6 proto ipv6-icmp all
pass in final family inet4 proto icmp all
pass in final family inet4 proto tcp \
from $dhcpserver port bootps to $wired_v4 port bootpc
pass in final family inet4 proto udp \
from $dhcpserver port bootps to $wired_v4 port bootpc
pass in final family inet6 proto tcp to $wired_v6 port ssh
pass in final family inet4 proto tcp flags S/SA \
from $backupsrv_v4 to $wired_v4 port $backup_port
pass in final family inet4 proto udp \
from $backupsrv_v4 to $wired_v4 port $backup_port
pass in final family inet6 proto tcp flags S/SA \
from $backupsrv_v6 to $wired_v6 port $backup_port
pass in final family inet6 proto udp \
from $backupsrv_v6 to $wired_v6 port $backup_port
pass stateful in final family inet6 proto udp to $wired_v6 \
port $services_udp
pass stateful in final family inet4 proto udp to $wired_v6 \
port $services_udp
# only SYN packets need to generate state
pass stateful out final family inet6 proto tcp flags S/SA \
from $wired_v6
pass stateful out final family inet4 proto tcp flags S/SA \
from $wired_v4
# pass the other tcp packets without generating extra state
pass out final family inet6 proto tcp from $wired_v6
pass out final family inet4 proto tcp from $wired_v4
# all other types of traffic, generate state per packet
pass stateful out final family inet6 from $wired_v6
pass stateful out final family inet4 from $wired_v4
}
group "wifi" on $wifi_if {
# linklocal
pass in final family inet6 proto ipv6-icmp to fe80::/10
pass out final family inet6 proto ipv6-icmp from fe80::/10
# administrative multicasts
pass in final family inet6 proto ipv6-icmp to ff00::/10
pass out final family inet6 proto ipv6-icmp from ff00::/10
pass in final family inet6 proto ipv6-icmp to $wifi_v6
pass in final family inet4 proto icmp to $wifi_v6
pass in final family inet4 proto tcp \
from any port bootps to $wifi_v4 port bootpc
pass in final family inet4 proto udp \
from any port bootps to $wifi_v4 port bootpc
pass in final family inet6 proto tcp flags S/SA to $wifi_v6 port ssh
pass in final family inet6 proto udp to $wifi_v6 port $services_udp
pass in final family inet4 proto udp to $wifi_v4 port $services_udp
# IPSEC
pass in final family inet6 proto udp to $wifi_v6 port isakmp
pass in final family inet4 proto udp to $wifi_v4 port isakmp
pass in family inet6 proto esp all
pass in family inet4 proto esp all
# only SYN packets need to generate state
pass stateful out final family inet6 proto tcp flags S/SA \
from $wifi_v6
pass stateful out final family inet4 proto tcp flags S/SA \
from $wifi_v4
# pass the other tcp packets without generating extra state
pass out final family inet6 proto tcp from $wifi_v6
pass out final family inet4 proto tcp from $wifi_v4
# all other types of traffic, generate state per packet
pass stateful out final family inet6 from $wifi_v6
pass stateful out final family inet4 from $wifi_v4
}
group default {
pass final on lo0 all
block all apply "log"
}
|