068cee2998
as per RFC 6296. Add a unit test. Also, bump NPF_VERSION. Thanks to S.P.Zeidler for the help with NPTv6 work!
56 lines
1.1 KiB
Plaintext
56 lines
1.1 KiB
Plaintext
# $NetBSD: npftest.conf,v 1.5 2014/02/13 03:34:40 rmind Exp $
|
|
|
|
$ext_if = "npftest0"
|
|
$int_if = "npftest1"
|
|
|
|
#
|
|
# RFC 5737
|
|
#
|
|
|
|
$pub_ip1 = 192.0.2.1
|
|
$pub_ip2 = 192.0.2.2
|
|
$pub_ip3 = 192.0.2.3
|
|
|
|
$local_ip1 = 10.1.1.1
|
|
$local_ip2 = 10.1.1.2
|
|
$local_ip3 = 10.1.1.3
|
|
$local_ip4 = 10.1.1.4
|
|
|
|
$local_net = { 10.1.1.0/24 }
|
|
$ports = { 8000, 9000 }
|
|
|
|
$net6_inner = fd01:203:405::/48
|
|
$net6_outer = 2001:db8:1::/48
|
|
|
|
map $ext_if static $local_ip3 <-> $pub_ip3
|
|
map $ext_if dynamic $local_ip2 <-> $pub_ip2
|
|
map $ext_if dynamic $local_net -> $pub_ip1
|
|
map $ext_if dynamic $local_ip1 port 6000 <- $pub_ip1 port 8000
|
|
|
|
map $ext_if static algo npt66 $net6_inner <-> $net6_outer
|
|
|
|
group "ext" on $ext_if {
|
|
pass out final from $local_ip3
|
|
pass in final to $pub_ip3
|
|
|
|
pass out final from $net6_inner
|
|
pass in final to $net6_outer
|
|
|
|
pass stateful out final proto tcp flags S/SA all
|
|
pass stateful out final from $local_net
|
|
pass stateful in final to any port $ports
|
|
pass stateful in final proto icmp all
|
|
block all
|
|
}
|
|
|
|
group "int" on $int_if {
|
|
ruleset "test-rules"
|
|
pass stateful out final to $local_ip2
|
|
pass out final to $local_ip3
|
|
block final to $local_ip4
|
|
}
|
|
|
|
group default {
|
|
block all
|
|
}
|