blob: 2fda3a46c63f14fd40e0cb8d79bc03b94d1603a1 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
|
# $NetBSD: npftest.conf,v 1.9 2020/05/30 14:16:56 rmind Exp $
$ext_if = "npftest0"
$int_if = "npftest1"
set portmap.min_port 1024
set portmap.max_port 65535
#
# RFC 5737
#
$pub_ip1 = 192.0.2.1
$pub_ip2 = 192.0.2.2
$pub_ip3 = 192.0.2.3
$local_ip1 = 10.1.1.1
$local_ip2 = 10.1.1.2
$local_ip3 = 10.1.1.3
$local_ip4 = 10.1.1.4
$local_net = { 10.1.1.0/24 }
$ports = { 8000, 9000 }
map $ext_if static $local_ip3 <-> $pub_ip3
map $ext_if dynamic $local_ip2 <-> $pub_ip2
map $ext_if dynamic $local_net -> $pub_ip1
map $ext_if dynamic $local_ip1 port 6000 <- $pub_ip1 port 8000
$net6_inner = fd01:203:405::/48
$net6_outer = 2001:db8:1::/48
$net_a = 10.100.0.0/16
$net_b = 10.255.0.0/16
map $ext_if static algo npt66 $net6_inner <-> $net6_outer
map $ext_if static algo netmap $net_a <-> $net_b
map ruleset "map:some-daemon" on $ext_if
group "ext" on $ext_if {
pass out final from $local_ip3
pass in final to $pub_ip3
pass out final from $net6_inner
pass in final to $net6_outer
pass out final from $net_a
pass in final to $net_b
pass stateful out final proto tcp flags S/SA all
pass stateful out final from $local_net
pass stateful in final to any port $ports
pass stateful in final proto icmp all
block all
}
group "int" on $int_if {
ruleset "test-rules"
pass stateful out final to $local_ip2
pass out final to $local_ip3
block final to $local_ip4
}
group default {
block all
}
|