Module Name: src Committed By: rmind Date: Sun Dec 9 22:12:26 UTC 2012
Modified Files: src/share/examples/npf: host-npf.conf soho_gw-npf.conf Log Message: Fix syntax error in the example, fix one rule and G/C "rid" procedure. To generate a diff of this commit: cvs rdiff -u -r1.3 -r1.4 src/share/examples/npf/host-npf.conf \ src/share/examples/npf/soho_gw-npf.conf Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/share/examples/npf/host-npf.conf diff -u src/share/examples/npf/host-npf.conf:1.3 src/share/examples/npf/host-npf.conf:1.4 --- src/share/examples/npf/host-npf.conf:1.3 Tue Dec 4 18:48:32 2012 +++ src/share/examples/npf/host-npf.conf Sun Dec 9 22:12:26 2012 @@ -1,4 +1,4 @@ -# $NetBSD: host-npf.conf,v 1.3 2012/12/04 18:48:32 spz Exp $ +# $NetBSD: host-npf.conf,v 1.4 2012/12/09 22:12:26 rmind Exp $ # # this is an example of NPF rules for a host (i.e., not routing) with # two network interfaces, wired and wifi @@ -6,6 +6,7 @@ # it does both IPv4 and IPv6 and allows for DHCP in v4 and SLAAC in v6 # it also does IPSEC on the wifi # + $wired_if = "wm0" $wired_v4 = { inet4(wm0) } $wired_v6 = { inet6(wm0) } @@ -30,10 +31,6 @@ procedure "log" { log: npflog0 } -procedure "rid" { - normalise: "random-id" -} - group (name "wired", interface $wired_if) { # not being picky about our own address here @@ -64,16 +61,16 @@ group (name "wired", interface $wired_if # only SYN packets need to generate state pass stateful out final family inet6 proto tcp flags S/SA \ - from $wired_v6 apply "rid" + from $wired_v6 pass stateful out final family inet proto tcp flags S/SA \ - from $wired_v4 apply "rid" + from $wired_v4 # pass the other tcp packets without generating extra state - pass out final family inet6 proto tcp from $wired_v6 apply "rid" - pass out final family inet proto tcp from $wired_v4 apply "rid" + pass out final family inet6 proto tcp from $wired_v6 + pass out final family inet proto tcp from $wired_v4 # all other types of traffic, generate state per packet - pass stateful out final family inet6 from $wired_v6 apply "rid" - pass stateful out final family inet from $wired_v4 apply "rid" + pass stateful out final family inet6 from $wired_v6 + pass stateful out final family inet from $wired_v4 } @@ -107,16 +104,16 @@ group (name "wifi", interface $wifi_if) # only SYN packets need to generate state pass stateful out final family inet6 proto tcp flags S/SA \ - from $wifi_v6 apply "rid" + from $wifi_v6 pass stateful out final family inet proto tcp flags S/SA \ - from $wifi_v4 apply "rid" + from $wifi_v4 # pass the other tcp packets without generating extra state - pass out final family inet6 proto tcp from $wifi_v6 apply "rid" - pass out final family inet proto tcp from $wifi_v4 apply "rid" + pass out final family inet6 proto tcp from $wifi_v6 + pass out final family inet proto tcp from $wifi_v4 # all other types of traffic, generate state per packet - pass stateful out final family inet6 from $wifi_v6 apply "rid" - pass stateful out final family inet from $wifi_v4 apply "rid" + pass stateful out final family inet6 from $wifi_v6 + pass stateful out final family inet from $wifi_v4 } group (default) { Index: src/share/examples/npf/soho_gw-npf.conf diff -u src/share/examples/npf/soho_gw-npf.conf:1.3 src/share/examples/npf/soho_gw-npf.conf:1.4 --- src/share/examples/npf/soho_gw-npf.conf:1.3 Tue Dec 4 18:48:32 2012 +++ src/share/examples/npf/soho_gw-npf.conf Sun Dec 9 22:12:26 2012 @@ -1,10 +1,11 @@ -# $NetBSD: soho_gw-npf.conf,v 1.3 2012/12/04 18:48:32 spz Exp $ +# $NetBSD: soho_gw-npf.conf,v 1.4 2012/12/09 22:12:26 rmind Exp $ # # SOHO border # # This is a natting border gateway/webserver/mailserver/nameserver # IPv4 only # + $ext_if = "wm0" $ext_v4 = inet4(wm0) $ext_addrs = { ifnet(wm0) } @@ -27,18 +28,14 @@ map $ext_if dynamic 198.51.100.0/24 -> $ # NAT traffic arriving on port 9022 of the external interface address # to host 198.51.100.2 port 22 -map $ext_if dynamic 198.51.100.2 port 22 <- $ext_v4 9022 +map $ext_if dynamic 198.51.100.2 port 22 <- $ext_v4 port 9022 procedure "log" { log: npflog0 } -procedure "rid" { - normalise: "random-id" -} - group (name "external", interface $ext_if) { - pass stateful out final from $ext_addrs apply "rid" + pass stateful out final all block in final from <1> pass stateful in final family inet proto tcp to $ext_v4 port ssh \ @@ -62,4 +59,3 @@ group (default) { pass final on lo0 all block all } -