Module Name: src
Committed By: spz
Date: Sat May 31 12:33:14 UTC 2014
Modified Files:
src/share/examples/npf: l2tp_gw-npf.conf
Log Message:
- match up comment and interface identifiers
- use RFC5737 documentation prefixes
- use a variable for the RFC1918 private address ranges
To generate a diff of this commit:
cvs rdiff -u -r1.4 -r1.5 src/share/examples/npf/l2tp_gw-npf.conf
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/share/examples/npf/l2tp_gw-npf.conf
diff -u src/share/examples/npf/l2tp_gw-npf.conf:1.4 src/share/examples/npf/l2tp_gw-npf.conf:1.5
--- src/share/examples/npf/l2tp_gw-npf.conf:1.4 Tue May 27 23:34:43 2014
+++ src/share/examples/npf/l2tp_gw-npf.conf Sat May 31 12:33:14 2014
@@ -1,17 +1,19 @@
# ex0 - (internal) network interface
-# 192.168.2.254/24
-# hme0 - (external) connection to Two Sigma
-# 74.66.0.142/24
+# 192.0.2.254/24
+# hme0 - (external) connection to Peer
+# 198.51.100.142/24
-$int_if = "sk0"
-$ext_if = "bge0"
+$int_if = "ex0"
+$ext_if = "hme0"
+
+$private_addr = { 10.0.0.0/8, 172.16.0.0/14, 192.168.0.0/16 }
alg "icmp"
#
# NAT for all.
#
-map $ext_if dynamic 192.168.1.0/24 -> inet4($ext_if)
+map $ext_if dynamic 192.0.2.0/24 -> inet4($ext_if)
#table <1> type tree file "/etc/npf_problem_sites"
@@ -37,20 +39,15 @@ group "external" on $ext_if {
#
# Block IANA-reserved addresses from entering or exiting
#
- block in final from 10.0.0.0/8 apply "log"
- block in final from 172.16.0.0/12 apply "log"
- block in final from 192.168.0.0/16 apply "log"
- #
- block out final to 10.0.0.0/8 apply "log"
- block out final to 172.16.0.0/12 apply "log"
- block out final to 192.168.0.0/16 apply "log"
+ block in final from $private_addr apply "log"
+ block out final to $private_addr apply "log"
#
pass stateful out final proto tcp all
pass stateful out final proto udp all
pass stateful out final proto icmp all
pass stateful out final proto ipv6-icmp all
- block in final proto tcp to 192.168.2.255 apply "log"
+ block in final proto tcp to 192.0.2.255 apply "log"
#
# Prevent IP spoofing attacks on the firewall.
