1# $NetBSD: npftest.conf,v 1.9 2020/05/30 14:16:56 rmind Exp $
2
3$ext_if = "npftest0"
4$int_if = "npftest1"
5
6set portmap.min_port 1024
7set portmap.max_port 65535
8
9#
10# RFC 5737
11#
12
13$pub_ip1 = 192.0.2.1
14$pub_ip2 = 192.0.2.2
15$pub_ip3 = 192.0.2.3
16
17$local_ip1 = 10.1.1.1
18$local_ip2 = 10.1.1.2
19$local_ip3 = 10.1.1.3
20$local_ip4 = 10.1.1.4
21
22$local_net = { 10.1.1.0/24 }
23$ports = { 8000, 9000 }
24
25map $ext_if static $local_ip3 <-> $pub_ip3
26map $ext_if dynamic $local_ip2 <-> $pub_ip2
27map $ext_if dynamic $local_net -> $pub_ip1
28map $ext_if dynamic $local_ip1 port 6000 <- $pub_ip1 port 8000
29
30$net6_inner = fd01:203:405::/48
31$net6_outer = 2001:db8:1::/48
32
33$net_a = 10.100.0.0/16
34$net_b = 10.255.0.0/16
35
36map $ext_if static algo npt66 $net6_inner <-> $net6_outer
37map $ext_if static algo netmap $net_a <-> $net_b
38map ruleset "map:some-daemon" on $ext_if
39
40group "ext" on $ext_if {
41	pass out final from $local_ip3
42	pass in final to $pub_ip3
43
44	pass out final from $net6_inner
45	pass in final to $net6_outer
46
47	pass out final from $net_a
48	pass in final to $net_b
49
50	pass stateful out final proto tcp flags S/SA all
51	pass stateful out final from $local_net
52	pass stateful in final to any port $ports
53	pass stateful in final proto icmp all
54	block all
55}
56
57group "int" on $int_if {
58	ruleset "test-rules"
59	pass stateful out final to $local_ip2
60	pass out final to $local_ip3
61	block final to $local_ip4
62}
63
64group default {
65	block all
66}
67