197 lines
6.2 KiB
Groff
197 lines
6.2 KiB
Groff
.\" $NetBSD: npfctl.8,v 1.17 2014/08/03 00:02:56 rmind Exp $
|
|
.\"
|
|
.\" Copyright (c) 2009-2014 The NetBSD Foundation, Inc.
|
|
.\" All rights reserved.
|
|
.\"
|
|
.\" This material is based upon work partially supported by The
|
|
.\" NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
|
|
.\"
|
|
.\" Redistribution and use in source and binary forms, with or without
|
|
.\" modification, are permitted provided that the following conditions
|
|
.\" are met:
|
|
.\" 1. Redistributions of source code must retain the above copyright
|
|
.\" notice, this list of conditions and the following disclaimer.
|
|
.\" 2. Redistributions in binary form must reproduce the above copyright
|
|
.\" notice, this list of conditions and the following disclaimer in the
|
|
.\" documentation and/or other materials provided with the distribution.
|
|
.\"
|
|
.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
|
|
.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
|
|
.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
|
.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
|
|
.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
|
.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
|
.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
.\" POSSIBILITY OF SUCH DAMAGE.
|
|
.\"
|
|
.Dd August 2, 2014
|
|
.Dt NPFCTL 8
|
|
.Os
|
|
.Sh NAME
|
|
.Nm npfctl
|
|
.Nd control NPF packet filter
|
|
.Sh SYNOPSIS
|
|
.Nm npfctl
|
|
.Ar command
|
|
.Op Ar arguments
|
|
.\" -----
|
|
.Sh DESCRIPTION
|
|
The
|
|
.Nm
|
|
command can be used to control the NPF packet filter.
|
|
For a description of NPF's configuration file, see
|
|
.Xr npf.conf 5 .
|
|
.Pp
|
|
The first argument,
|
|
.Ar command ,
|
|
specifies the action to take.
|
|
Valid commands are:
|
|
.Bl -tag -width reload -offset 3n
|
|
.It Ic start
|
|
Enable packet inspection using the currently loaded configuration, if any.
|
|
Note that this command does not load or reload the configuration,
|
|
or affect existing connections.
|
|
.It Ic stop
|
|
Disable packet inspection.
|
|
This command does not change the currently loaded configuration,
|
|
or affect existing connections.
|
|
.It Ic reload Op Ar path
|
|
Load or reload configuration from file.
|
|
The configuration file at
|
|
.Pa /etc/npf.conf
|
|
will be used unless a file is specified by
|
|
.Ar path .
|
|
All connections will be preserved during the reload, except those which
|
|
will lose NAT policy due to removal.
|
|
NAT policy is determined by the translation type and address.
|
|
Note that change of filter criteria will not expire associated connections.
|
|
The reload operation (i.e., replacing the ruleset, NAT policies and tables)
|
|
is atomic.
|
|
.It Ic flush
|
|
Flush configuration.
|
|
That is, remove all rules, tables and expire all connections.
|
|
This command does not disable packet inspection.
|
|
.It Ic show
|
|
Show the current state and configuration.
|
|
Syntax of printed configuration is for the user and may not match the
|
|
.Xr npf.conf 5
|
|
syntax.
|
|
.It Ic validate Op Ar path
|
|
Validate the configuration file and the processed form.
|
|
The configuration file at
|
|
.Pa /etc/npf.conf
|
|
will be used unless a file is specified by
|
|
.Ar path .
|
|
.\" ---
|
|
.It Ic rule Ar name Ic add Aq rule-syntax
|
|
Add a rule to a dynamic ruleset specified by
|
|
.Ar name .
|
|
On success, returns a unique identifier which can be used to remove
|
|
the rule with
|
|
.Ic rem-id
|
|
command.
|
|
The identifier is alphanumeric string.
|
|
.It Ic rule Ar name Ic rem Aq rule-syntax
|
|
Remove a rule from a dynamic ruleset specified by
|
|
.Ar name .
|
|
This method uses SHA1 hash computed on a rule to identify it.
|
|
Although very unlikely, it is subject to hash collisions.
|
|
For a fully reliable and more efficient method, it is recommended to use
|
|
.Ic rem-id
|
|
command.
|
|
.It Ic rule Ar name Ic rem-id Aq id
|
|
Remove a rule specified by unique
|
|
.Ar id
|
|
from a dynamic ruleset specified by
|
|
.Ar name .
|
|
.It Ic rule Ar name Ic list
|
|
List all rules in the dynamic ruleset specified by
|
|
.Ar name .
|
|
.It Ic rule Ar name Ic flush
|
|
Remove all rules from the dynamic ruleset specified by
|
|
.Ar name .
|
|
.\" ---
|
|
.It Ic table Ar tid Ic add Aq Ar addr/mask
|
|
In table
|
|
.Ar tid ,
|
|
add the IP address and optionally netmask, specified by
|
|
.Aq Ar addr/mask .
|
|
Only tree-type tables support masks.
|
|
.It Ic table Ar tid Ic rem Aq Ar addr/mask
|
|
In table
|
|
.Ar tid ,
|
|
remove the IP address and optionally netmask, specified by
|
|
.Aq Ar addr/mask .
|
|
Only tree-type tables support masks.
|
|
.It Ic table Ar tid Ic test Aq Ar addr
|
|
Query the table
|
|
.Ar tid
|
|
for a specific IP address, specified by
|
|
.Ar addr .
|
|
If no mask is specified, a single host is assumed.
|
|
.It Ic table Ar tid Ic list
|
|
List all entries in the currently loaded table specified by
|
|
.Ar tid .
|
|
This operation is expensive and should be used with caution.
|
|
.\" ---
|
|
.It Ic save
|
|
Save the active configuration and a spanshot of the current connections.
|
|
The data will be stored in the
|
|
.Pa /var/db/npf.db
|
|
file.
|
|
Administrator may want to stop the packet inspection before saving.
|
|
.It Ic load
|
|
Load the saved configuration file and the connections from the file.
|
|
Note that any existing connections will be destroyed.
|
|
Administrator may want to start packet inspection after the load.
|
|
.It Ic stats
|
|
Print various statistics.
|
|
.It Ic debug
|
|
Process the configuration file, print the byte-code of each rule
|
|
and dump the raw configuration.
|
|
This is primarily for developer use.
|
|
.El
|
|
.Sh PERFORMANCE
|
|
Reloading the configuration is a relatively expensive operation.
|
|
Therefore, frequent reloads should be avoided.
|
|
Use of tables should be considered as an alternative design.
|
|
See
|
|
.Xr npf.conf 5
|
|
for details.
|
|
.\" -----
|
|
.Sh FILES
|
|
.Bl -tag -width /etc/npf.conf -compact
|
|
.It Pa /dev/npf
|
|
control device
|
|
.It Pa /etc/npf.conf
|
|
default configuration file
|
|
.El
|
|
.\" -----
|
|
.Sh EXAMPLES
|
|
Starting the NPF packet filter:
|
|
.Bd -literal -offset indent
|
|
# npfctl reload
|
|
# npfctl start
|
|
# npfctl show
|
|
.Ed
|
|
.Pp
|
|
Addition and removal of entries in the table whose ID is 2:
|
|
.Bd -literal -offset indent
|
|
# npfctl table 2 add 10.0.0.1
|
|
# npfctl table 2 rem 182.168.0.0/24
|
|
.Ed
|
|
.\" -----
|
|
.Sh SEE ALSO
|
|
.Xr bpf 4 ,
|
|
.Xr npf.conf 5 ,
|
|
.Xr npf 7
|
|
.Sh HISTORY
|
|
NPF first appeared in
|
|
.Nx 6.0 .
|
|
.Sh AUTHORS
|
|
NPF was designed and implemented by
|
|
.An Mindaugas Rasiukevicius .
|