1# $NetBSD: npftest.conf,v 1.9 2020/05/30 14:16:56 rmind Exp $ 2 3$ext_if = "npftest0" 4$int_if = "npftest1" 5 6set portmap.min_port 1024 7set portmap.max_port 65535 8 9# 10# RFC 5737 11# 12 13$pub_ip1 = 192.0.2.1 14$pub_ip2 = 192.0.2.2 15$pub_ip3 = 192.0.2.3 16 17$local_ip1 = 10.1.1.1 18$local_ip2 = 10.1.1.2 19$local_ip3 = 10.1.1.3 20$local_ip4 = 10.1.1.4 21 22$local_net = { 10.1.1.0/24 } 23$ports = { 8000, 9000 } 24 25map $ext_if static $local_ip3 <-> $pub_ip3 26map $ext_if dynamic $local_ip2 <-> $pub_ip2 27map $ext_if dynamic $local_net -> $pub_ip1 28map $ext_if dynamic $local_ip1 port 6000 <- $pub_ip1 port 8000 29 30$net6_inner = fd01:203:405::/48 31$net6_outer = 2001:db8:1::/48 32 33$net_a = 10.100.0.0/16 34$net_b = 10.255.0.0/16 35 36map $ext_if static algo npt66 $net6_inner <-> $net6_outer 37map $ext_if static algo netmap $net_a <-> $net_b 38map ruleset "map:some-daemon" on $ext_if 39 40group "ext" on $ext_if { 41 pass out final from $local_ip3 42 pass in final to $pub_ip3 43 44 pass out final from $net6_inner 45 pass in final to $net6_outer 46 47 pass out final from $net_a 48 pass in final to $net_b 49 50 pass stateful out final proto tcp flags S/SA all 51 pass stateful out final from $local_net 52 pass stateful in final to any port $ports 53 pass stateful in final proto icmp all 54 block all 55} 56 57group "int" on $int_if { 58 ruleset "test-rules" 59 pass stateful out final to $local_ip2 60 pass out final to $local_ip3 61 block final to $local_ip4 62} 63 64group default { 65 block all 66} 67