head	1.22;
access;
symbols
	netbsd-11-0-RC6:1.21
	netbsd-11-0-RC5:1.21
	netbsd-11-0-RC4:1.21
	netbsd-11-0-RC3:1.21
	netbsd-11-0-RC2:1.21
	netbsd-11-0-RC1:1.21
	perseant-exfatfs-base-20250801:1.21
	netbsd-11:1.21.0.4
	netbsd-11-base:1.21
	netbsd-10-1-RELEASE:1.20.8.1
	perseant-exfatfs-base-20240630:1.21
	perseant-exfatfs:1.21.0.2
	perseant-exfatfs-base:1.21
	netbsd-8-3-RELEASE:1.6
	netbsd-9-4-RELEASE:1.12.2.2
	netbsd-10-0-RELEASE:1.20.8.1
	netbsd-10-0-RC6:1.20.8.1
	netbsd-10-0-RC5:1.20.8.1
	netbsd-10-0-RC4:1.20.8.1
	netbsd-10-0-RC3:1.20.8.1
	netbsd-10-0-RC2:1.20.8.1
	netbsd-10-0-RC1:1.20.8.1
	netbsd-10:1.20.0.8
	netbsd-10-base:1.20
	netbsd-9-3-RELEASE:1.12.2.1
	cjep_sun2x-base1:1.20
	cjep_sun2x:1.20.0.6
	cjep_sun2x-base:1.20
	cjep_staticlib_x-base1:1.20
	netbsd-9-2-RELEASE:1.12.2.1
	cjep_staticlib_x:1.20.0.4
	cjep_staticlib_x-base:1.20
	netbsd-9-1-RELEASE:1.12.2.1
	phil-wifi-20200421:1.20
	phil-wifi-20200411:1.20
	is-mlppp:1.20.0.2
	is-mlppp-base:1.20
	phil-wifi-20200406:1.20
	netbsd-8-2-RELEASE:1.6
	netbsd-9-0-RELEASE:1.12.2.1
	netbsd-9-0-RC2:1.12.2.1
	netbsd-9-0-RC1:1.12.2.1
	phil-wifi-20191119:1.20
	netbsd-9:1.12.0.2
	netbsd-9-base:1.12
	phil-wifi-20190609:1.12
	netbsd-8-1-RELEASE:1.6
	netbsd-8-1-RC1:1.6
	pgoyette-compat-merge-20190127:1.6.24.1
	pgoyette-compat-20190127:1.7
	pgoyette-compat-20190118:1.7
	pgoyette-compat-1226:1.7
	pgoyette-compat-1126:1.7
	pgoyette-compat-1020:1.7
	pgoyette-compat-0930:1.7
	pgoyette-compat-0906:1.7
	netbsd-7-2-RELEASE:1.6
	pgoyette-compat-0728:1.6
	netbsd-8-0-RELEASE:1.6
	phil-wifi:1.6.0.26
	phil-wifi-base:1.6
	pgoyette-compat-0625:1.6
	netbsd-8-0-RC2:1.6
	pgoyette-compat-0521:1.6
	pgoyette-compat-0502:1.6
	pgoyette-compat-0422:1.6
	netbsd-8-0-RC1:1.6
	pgoyette-compat-0415:1.6
	pgoyette-compat-0407:1.6
	pgoyette-compat-0330:1.6
	pgoyette-compat-0322:1.6
	pgoyette-compat-0315:1.6
	netbsd-7-1-2-RELEASE:1.6
	pgoyette-compat:1.6.0.24
	pgoyette-compat-base:1.6
	netbsd-7-1-1-RELEASE:1.6
	matt-nb8-mediatek:1.6.0.22
	matt-nb8-mediatek-base:1.6
	perseant-stdc-iso10646:1.6.0.20
	perseant-stdc-iso10646-base:1.6
	netbsd-8:1.6.0.18
	netbsd-8-base:1.6
	prg-localcount2-base3:1.6
	prg-localcount2-base2:1.6
	prg-localcount2-base1:1.6
	prg-localcount2:1.6.0.16
	prg-localcount2-base:1.6
	pgoyette-localcount-20170426:1.6
	bouyer-socketcan-base1:1.6
	pgoyette-localcount-20170320:1.6
	netbsd-7-1:1.6.0.14
	netbsd-7-1-RELEASE:1.6
	netbsd-7-1-RC2:1.6
	netbsd-7-nhusb-base-20170116:1.6
	bouyer-socketcan:1.6.0.12
	bouyer-socketcan-base:1.6
	pgoyette-localcount-20170107:1.6
	netbsd-7-1-RC1:1.6
	pgoyette-localcount-20161104:1.6
	netbsd-7-0-2-RELEASE:1.6
	localcount-20160914:1.6
	netbsd-7-nhusb:1.6.0.10
	netbsd-7-nhusb-base:1.6
	pgoyette-localcount-20160806:1.6
	pgoyette-localcount-20160726:1.6
	pgoyette-localcount:1.6.0.8
	pgoyette-localcount-base:1.6
	netbsd-7-0-1-RELEASE:1.6
	netbsd-7-0:1.6.0.6
	netbsd-7-0-RELEASE:1.6
	netbsd-7-0-RC3:1.6
	netbsd-7-0-RC2:1.6
	netbsd-7-0-RC1:1.6
	netbsd-6-0-6-RELEASE:1.2.4.2
	netbsd-6-1-5-RELEASE:1.2.4.4
	netbsd-7:1.6.0.4
	netbsd-7-base:1.6
	yamt-pagecache-base9:1.6
	yamt-pagecache-tag8:1.2.6.3
	netbsd-6-1-4-RELEASE:1.2.4.4
	netbsd-6-0-5-RELEASE:1.2.4.2
	tls-earlyentropy:1.6.0.2
	tls-earlyentropy-base:1.6
	riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.6
	riastradh-drm2-base3:1.6
	netbsd-6-1-3-RELEASE:1.2.4.4
	netbsd-6-0-4-RELEASE:1.2.4.2
	netbsd-6-1-2-RELEASE:1.2.4.4
	netbsd-6-0-3-RELEASE:1.2.4.2
	netbsd-6-1-1-RELEASE:1.2.4.4
	riastradh-drm2-base2:1.4
	riastradh-drm2-base1:1.4
	riastradh-drm2:1.4.0.2
	riastradh-drm2-base:1.4
	netbsd-6-1:1.2.4.4.0.2
	netbsd-6-0-2-RELEASE:1.2.4.2
	netbsd-6-1-RELEASE:1.2.4.4
	netbsd-6-1-RC4:1.2.4.4
	netbsd-6-1-RC3:1.2.4.4
	agc-symver:1.4.0.4
	agc-symver-base:1.4
	netbsd-6-1-RC2:1.2.4.4
	netbsd-6-1-RC1:1.2.4.4
	yamt-pagecache-base8:1.4
	netbsd-6-0-1-RELEASE:1.2.4.2
	yamt-pagecache-base7:1.4
	matt-nb6-plus:1.2.0.8
	matt-nb6-plus-nbase:1.2.4.2
	yamt-pagecache:1.2.0.6
	yamt-pagecache-base6:1.2
	netbsd-6-0:1.2.4.2.0.2
	netbsd-6-0-RELEASE:1.2.4.2
	netbsd-6:1.2.0.4
	tls-maxphys:1.2.0.2
	tls-maxphys-base:1.6;
locks; strict;
comment	@# @;


1.22
date	2026.01.12.17.01.32;	author pgoyette;	state Exp;
branches;
next	1.21;
commitid	i8zU4Xw6MTNAP7qG;

1.21
date	2023.07.31.16.09.01;	author tsutsui;	state Exp;
branches;
next	1.20;
commitid	nO0EB0cYNQz8lYyE;

1.20
date	2019.11.18.22.27.27;	author sevan;	state Exp;
branches
	1.20.8.1;
next	1.19;
commitid	VQGz6rUhFvEsPnLB;

1.19
date	2019.09.22.19.51.18;	author sevan;	state Exp;
branches;
next	1.18;
commitid	nkKb5WD1S6hDP2EB;

1.18
date	2019.09.22.19.30.15;	author sevan;	state Exp;
branches;
next	1.17;
commitid	xoJdGH62HAXpI2EB;

1.17
date	2019.09.21.23.55.01;	author sevan;	state Exp;
branches;
next	1.16;
commitid	ln9QiDMTFQBedWDB;

1.16
date	2019.09.21.21.10.56;	author sevan;	state Exp;
branches;
next	1.15;
commitid	gqreihthhorWiVDB;

1.15
date	2019.09.21.20.41.52;	author sevan;	state Exp;
branches;
next	1.14;
commitid	ZRX7DwWMPGHY8VDB;

1.14
date	2019.09.21.20.35.52;	author sevan;	state Exp;
branches;
next	1.13;
commitid	XnrLzgUHvRFU6VDB;

1.13
date	2019.09.21.20.31.31;	author sevan;	state Exp;
branches;
next	1.12;
commitid	qRrssi294teL4VDB;

1.12
date	2019.04.11.10.17.21;	author sevan;	state Exp;
branches
	1.12.2.1;
next	1.11;
commitid	60fpYXpbcyMzVUiB;

1.11
date	2019.04.11.09.59.24;	author sevan;	state Exp;
branches;
next	1.10;
commitid	zIltRitX1BwVOUiB;

1.10
date	2019.04.10.23.14.46;	author sevan;	state Exp;
branches;
next	1.9;
commitid	PqHGJgcMzGMegRiB;

1.9
date	2019.04.10.23.13.02;	author sevan;	state Exp;
branches;
next	1.8;
commitid	zBVNkFVI3G9pfRiB;

1.8
date	2019.04.10.23.00.43;	author sevan;	state Exp;
branches;
next	1.7;
commitid	Nnib2GLHY2uyaRiB;

1.7
date	2018.08.20.20.45.52;	author rjs;	state Exp;
branches;
next	1.6;
commitid	bEkGSjGb8XWqVTOA;

1.6
date	2014.02.08.01.32.19;	author rmind;	state Exp;
branches
	1.6.24.1
	1.6.26.1;
next	1.5;
commitid	nghmczzdcmOiHeox;

1.5
date	2013.09.20.17.51.04;	author spz;	state Exp;
branches;
next	1.4;
commitid	taouOi1n0WTqEc6x;

1.4
date	2012.12.09.22.12.26;	author rmind;	state Exp;
branches;
next	1.3;

1.3
date	2012.12.04.18.48.32;	author spz;	state Exp;
branches;
next	1.2;

1.2
date	2012.08.21.08.25.21;	author spz;	state Exp;
branches
	1.2.2.1
	1.2.4.1
	1.2.6.1
	1.2.8.1;
next	1.1;

1.1
date	2012.08.21.06.54.39;	author spz;	state Exp;
branches;
next	;

1.20.8.1
date	2023.11.05.17.38.24;	author martin;	state Exp;
branches;
next	;
commitid	WsFFH1tEA0XIIrLE;

1.12.2.1
date	2019.11.19.10.56.35;	author martin;	state Exp;
branches;
next	1.12.2.2;
commitid	bN2sOsl7GZWB0sLB;

1.12.2.2
date	2023.11.05.17.39.38;	author martin;	state Exp;
branches;
next	;
commitid	DVhhRhUqtDj9JrLE;

1.6.24.1
date	2018.09.06.06.55.21;	author pgoyette;	state Exp;
branches;
next	;
commitid	HCi1bXD317XIK0RA;

1.6.26.1
date	2019.06.10.22.05.38;	author christos;	state Exp;
branches;
next	1.6.26.2;
commitid	jtc8rnCzWiEEHGqB;

1.6.26.2
date	2020.04.13.08.03.24;	author martin;	state Exp;
branches;
next	;
commitid	X01YhRUPVUDaec4C;

1.2.2.1
date	2013.02.25.00.28.12;	author tls;	state Exp;
branches;
next	1.2.2.2;

1.2.2.2
date	2014.08.20.00.02.30;	author tls;	state Exp;
branches;
next	;
commitid	jTnpym9Qu0o4R1Nx;

1.2.4.1
date	2012.08.21.08.25.21;	author riz;	state dead;
branches;
next	1.2.4.2;

1.2.4.2
date	2012.10.01.20.15.34;	author riz;	state Exp;
branches;
next	1.2.4.3;

1.2.4.3
date	2012.12.11.04.31.53;	author riz;	state Exp;
branches;
next	1.2.4.4;

1.2.4.4
date	2012.12.15.23.31.07;	author riz;	state Exp;
branches;
next	;

1.2.6.1
date	2012.08.21.08.25.21;	author yamt;	state dead;
branches;
next	1.2.6.2;

1.2.6.2
date	2012.10.30.18.59.35;	author yamt;	state Exp;
branches;
next	1.2.6.3;

1.2.6.3
date	2013.01.16.05.32.35;	author yamt;	state Exp;
branches;
next	1.2.6.4;

1.2.6.4
date	2014.05.22.11.37.45;	author yamt;	state Exp;
branches;
next	;
commitid	P3Rlj4go6xHqKwBx;

1.2.8.1
date	2012.08.21.08.25.21;	author matt;	state dead;
branches;
next	1.2.8.2;

1.2.8.2
date	2012.11.20.23.13.36;	author matt;	state Exp;
branches;
next	;


desc
@@


1.22
log
@More blacklist --> blocklist
@
text
@# $NetBSD: soho_gw-npf.conf,v 1.21 2023/07/31 16:09:01 tsutsui Exp $
#
# SOHO border
#
# This is a natting border gateway/webserver/mailserver/nameserver
# IPv4 only
#

$ext_if = "wm0"
$ext_v4 = inet4($ext_if)
$ext_addrs = ifaddrs($ext_if)

$int_if = "wm1"

# a "naughty" step^W table to house blocked candidates in
# feed this using e.g.: npfctl table "naughty" add 203.0.113.99
table <naughty> type ipset

$services_tcp = { http, https, smtp, domain, 6000, 9022 }
$services_udp = { domain, ntp, 6000 }
$localnet = { 198.51.100.0/24 }

# NAT outgoing to the address of the external interface
# Note: if $ext_if has multiple IP addresses (e.g. IPv6 as well),
# then the translation address has to be specified explicitly.
map $ext_if dynamic $localnet -> $ext_v4

# NAT traffic arriving on port 9022 of the external interface address
# to host 198.51.100.2 port 22
map $ext_if dynamic 198.51.100.2 port 22 <- $ext_v4 port 9022

procedure "log" {
	# Send log events to npflog0, see npfd(8)
	log: npflog0
}

group "external" on $ext_if {
	# Allow all outbound traffic
	pass stateful out all

	# Block inbound traffic from those on the naughty table 
	block in from <naughty>

	# Placeholder for blocklistd (configuration separate) to add blocked hosts
	ruleset "blocklistd"

	# Allow inbound SSH and log all connection attempts
	pass stateful in family inet4 proto tcp to $ext_v4 port ssh \
		apply "log"

	# Allow inbound traffic for services hosted on TCP
	pass stateful in proto tcp to $ext_addrs port $services_tcp

	# Allow inbound traffic for services hosted on UDP
	pass stateful in proto udp to $ext_addrs port $services_udp

	# Allow being tracerouted
	pass stateful in proto udp to $ext_addrs port 33434-33600
}

group "internal" on $int_if {
	# Allow inbound traffic from LAN
	pass in from $localnet

	# All outbound traffic to LAN
	pass out all
}

group default {
	# Default deny, otherwise last matching rule wins
	block all apply "log"

	# Don't block loopback
	pass on lo0 all

	# Allow incoming IPv4 pings
	pass in family inet4 proto icmp icmp-type echo all
}
@


1.21
log
@Use proper variables for interface names in examples.
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.20 2019/11/18 22:27:27 sevan Exp $
d44 2
a45 2
	# Placeholder for blacklistd (configuration separate) to add blocked hosts
	ruleset "blacklistd"
@


1.20
log
@Rename the block table to something else to make it easier to differentiate
between action and name. Use this table as the example for populating by npfctl.

Drop the int-block table, it's quite cumbersome to have a firewall which
needs the internal network lists added if reboot. Use the localnet variable to
indicated which network we should pass in traffic from instead.
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.19 2019/09/22 19:51:18 sevan Exp $
d10 2
a11 2
$ext_v4 = inet4(wm0)
$ext_addrs = ifaddrs(wm0)
@


1.20.8.1
log
@Pull up following revision(s) (requested by tsutsui in ticket #458):

	share/examples/npf/host-npf.conf: revision 1.12
	share/examples/npf/soho_gw-npf.conf: revision 1.21

Use proper variables for interface names in examples.
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.20 2019/11/18 22:27:27 sevan Exp $
d10 2
a11 2
$ext_v4 = inet4($ext_if)
$ext_addrs = ifaddrs($ext_if)
@


1.19
log
@Add support for blacklistd
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.18 2019/09/22 19:30:15 sevan Exp $
d15 3
a17 4
# a table to house e.g. block candidates in
table <block> type ipset file "/usr/share/examples/npf/hashtablefile"
# feed this using e.g.: npfctl table "int-block" add 198.51.100.16/29
table <int-block> type lpm
d41 2
a42 2
	# Block inbound traffic from those on the block table 
	block in from <block>
d63 1
a63 1
	pass in from <int-block>
@


1.18
log
@Passive FTP works as a client without this and we're not hosting an FTP server (port are not listed in services_tcp)
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.17 2019/09/21 23:55:01 sevan Exp $
d45 3
@


1.17
log
@pastos
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.16 2019/09/21 21:10:56 sevan Exp $
a54 3
	# Passive FTP
	pass stateful in proto tcp to $ext_addrs port 49151-65535

@


1.16
log
@improve description
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.15 2019/09/21 20:41:52 sevan Exp $
d45 1
a45 1
	# Allow SSH on wired interface and log all connection attempts
d52 1
a52 1
	# Allow inbound traffic for services hosted on TCP
@


1.15
log
@Add descriptions for all rules and make use of localnet variable in place of direct IP address
@
text
@d1 1
a1 1
# $NetBSD$
d57 2
a58 1
	# Traceroute
@


1.14
log
@default policy is to blockall
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.13 2019/09/21 20:31:31 sevan Exp $
d27 1
a27 1
map $ext_if dynamic 198.51.100.0/24 -> $ext_v4
d34 1
d39 1
d42 1
d44 2
d48 2
d51 2
d62 1
d64 2
d70 4
d75 3
a77 1
	block all
@


1.13
log
@Drop the final keyword to use the default policy of last matching rule wins
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.12 2019/04/11 10:17:21 sevan Exp $
a52 1
	block in all
@


1.12
log
@s/ifnets/ifaddrs
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.11 2019/04/11 09:59:24 sevan Exp $
d38 1
a38 1
	pass stateful out final all
d40 2
a41 2
	block in final from <block>
	pass stateful in final family inet4 proto tcp to $ext_v4 port ssh \
d43 2
a44 2
	pass stateful in final proto tcp to $ext_addrs port $services_tcp
	pass stateful in final proto udp to $ext_addrs port $services_udp
d47 1
a47 1
	pass stateful in final proto tcp to $ext_addrs port 49151-65535
d49 1
a49 1
	pass stateful in final proto udp to $ext_addrs port 33434-33600
d54 2
a55 2
	pass in final from <int-block>
	pass out final all
d59 1
a59 1
	pass final on lo0 all
@


1.12.2.1
log
@Pull up following revision(s) (requested by sevan in ticket #444):

	share/examples/npf/soho_gw-npf.conf: revision 1.13
	share/examples/npf/soho_gw-npf.conf: revision 1.14
	share/examples/npf/soho_gw-npf.conf: revision 1.15
	share/examples/npf/soho_gw-npf.conf: revision 1.16
	share/examples/npf/soho_gw-npf.conf: revision 1.17
	share/examples/npf/soho_gw-npf.conf: revision 1.18
	share/examples/npf/soho_gw-npf.conf: revision 1.19
	share/examples/npf/soho_gw-npf.conf: revision 1.20

Drop the final keyword to use the default policy of last matching rule wins
default policy is to blockall

Add descriptions for all rules and make use of localnet variable in
place of direct IP address
improve description

pastos

Passive FTP works as a client without this and we're not hosting an FTP
server (port are not listed in services_tcp)

Add support for blacklistd

Rename the block table to something else to make it easier to differentiate
between action and name. Use this table as the example for populating by
npfctl.

Drop the int-block table, it's quite cumbersome to have a firewall which
needs the internal network lists added if reboot. Use the localnet
variable to indicated which network we should pass in traffic from instead.
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.12 2019/04/11 10:17:21 sevan Exp $
d15 4
a18 3
# a "naughty" step^W table to house blocked candidates in
# feed this using e.g.: npfctl table "naughty" add 203.0.113.99
table <naughty> type ipset
d27 1
a27 1
map $ext_if dynamic $localnet -> $ext_v4
a33 1
	# Send log events to npflog0, see npfd(8)
d38 1
a38 2
	# Allow all outbound traffic
	pass stateful out all
d40 2
a41 8
	# Block inbound traffic from those on the naughty table 
	block in from <naughty>

	# Placeholder for blacklistd (configuration separate) to add blocked hosts
	ruleset "blacklistd"

	# Allow inbound SSH and log all connection attempts
	pass stateful in family inet4 proto tcp to $ext_v4 port ssh \
d43 2
d46 4
a49 8
	# Allow inbound traffic for services hosted on TCP
	pass stateful in proto tcp to $ext_addrs port $services_tcp

	# Allow inbound traffic for services hosted on UDP
	pass stateful in proto udp to $ext_addrs port $services_udp

	# Allow being tracerouted
	pass stateful in proto udp to $ext_addrs port 33434-33600
d53 3
a55 5
	# Allow inbound traffic from LAN
	pass in from $localnet

	# All outbound traffic to LAN
	pass out all
d59 2
a60 8
	# Default deny, otherwise last matching rule wins
	block all apply "log"

	# Don't block loopback
	pass on lo0 all

	# Allow incoming IPv4 pings
	pass in family inet4 proto icmp icmp-type echo all
@


1.12.2.2
log
@Pull up following revision(s) (requested by tsutsui in ticket #1762):

	share/examples/npf/host-npf.conf: revision 1.12
	share/examples/npf/soho_gw-npf.conf: revision 1.21

Use proper variables for interface names in examples.
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.12.2.1 2019/11/19 10:56:35 martin Exp $
d10 2
a11 2
$ext_v4 = inet4($ext_if)
$ext_addrs = ifaddrs($ext_if)
@


1.11
log
@Revert previous & just use the inets function to handle both address families.
Heads up by <leot>
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.10 2019/04/10 23:14:46 sevan Exp $
d11 1
a11 1
$ext_addrs = inets(wm0)
@


1.10
log
@typo
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.9 2019/04/10 23:13:02 sevan Exp $
d11 1
a11 2
$ext_addrs = inet4(wm0)
$ext_addrs6 = inet6(wm0)
a44 2
	pass stateful in final family inet6 proto tcp to $ext_addrs6 port $services_tcp
	pass stateful in final family inet6 proto udp to $ext_addrs6 port $services_udp
a47 1
	pass stateful in final family inet6 proto tcp to $ext_addrs6 port 49151-65535
a49 1
	pass stateful in final family inet6 proto udp to $ext_addrs6 port 33434-33600
@


1.9
log
@Use a separate variable for IPv6.
Found with npfctl validate.
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.8 2019/04/10 23:00:43 sevan Exp $
d51 1
a51 1
	pass stateful in final family inet6 proto tcp to $ext_addrs port 49151-65535
d54 1
a54 1
	pass stateful in final family inet6 proto udp to $ext_addrs port 33434-33600
@


1.8
log
@Switch out deprecated keywords.
Found with npfctl validate.
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.7 2018/08/20 20:45:52 rjs Exp $
d11 2
a12 1
$ext_addrs = { inet4(wm0), inet6(wm0) }
d46 2
d51 1
d54 1
@


1.7
log
@Fix cvs id.
@
text
@d1 1
a1 1
# $NetBSD: $
d16 1
a16 1
table <block> type hash file "/usr/share/examples/npf/hashtablefile"
d18 1
a18 1
table <int-block> type tree dynamic
@


1.6
log
@Sync some NPF config examples with the reality.
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.5 2013/09/20 17:51:04 spz Exp $
@


1.6.26.1
log
@Sync with HEAD
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.12 2019/04/11 10:17:21 sevan Exp $
d11 1
a11 1
$ext_addrs = ifaddrs(wm0)
d16 1
a16 1
table <block> type ipset file "/usr/share/examples/npf/hashtablefile"
d18 1
a18 1
table <int-block> type lpm
@


1.6.26.2
log
@Mostly merge changes from HEAD upto 20200411
@
text
@d1 1
a1 1
# $NetBSD$
d15 4
a18 3
# a "naughty" step^W table to house blocked candidates in
# feed this using e.g.: npfctl table "naughty" add 203.0.113.99
table <naughty> type ipset
d27 1
a27 1
map $ext_if dynamic $localnet -> $ext_v4
a33 1
	# Send log events to npflog0, see npfd(8)
d38 1
a38 2
	# Allow all outbound traffic
	pass stateful out all
d40 2
a41 8
	# Block inbound traffic from those on the naughty table 
	block in from <naughty>

	# Placeholder for blacklistd (configuration separate) to add blocked hosts
	ruleset "blacklistd"

	# Allow inbound SSH and log all connection attempts
	pass stateful in family inet4 proto tcp to $ext_v4 port ssh \
d43 2
d46 4
a49 8
	# Allow inbound traffic for services hosted on TCP
	pass stateful in proto tcp to $ext_addrs port $services_tcp

	# Allow inbound traffic for services hosted on UDP
	pass stateful in proto udp to $ext_addrs port $services_udp

	# Allow being tracerouted
	pass stateful in proto udp to $ext_addrs port 33434-33600
d53 3
a55 5
	# Allow inbound traffic from LAN
	pass in from $localnet

	# All outbound traffic to LAN
	pass out all
d59 2
a60 8
	# Default deny, otherwise last matching rule wins
	block all apply "log"

	# Don't block loopback
	pass on lo0 all

	# Allow incoming IPv4 pings
	pass in family inet4 proto icmp icmp-type echo all
@


1.6.24.1
log
@Sync with HEAD

Resolve a couple of conflicts (result of the uimin/uimax changes)
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.7 2018/08/20 20:45:52 rjs Exp $
@


1.5
log
@track syntax change in npf.conf regarding group
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.4 2012/12/09 22:12:26 rmind Exp $
d11 1
a11 1
$ext_addrs = { ifnet(wm0) }
d16 3
a18 3
table <1> type hash file "/usr/share/examples/npf/hashtablefile"
# feed this using "npfctl table 2 add 198.51.100.16/29" f.e.
table <2> type tree dynamic
d40 2
a41 2
	block in final from <1>
	pass stateful in final family inet proto tcp to $ext_v4 port ssh \
d54 1
a54 1
	pass in final from <2>
@


1.4
log
@Fix syntax error in the example, fix one rule and G/C "rid" procedure.
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.3 2012/12/04 18:48:32 spz Exp $
d37 1
a37 1
group (name "external", interface $ext_if) {
d52 1
a52 1
group (name "internal", interface $int_if) {
d58 1
a58 1
group (default) {
@


1.3
log
@adjust to current npf.conf syntax
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.2 2012/08/21 08:25:21 spz Exp $
d8 1
d31 1
a31 1
map $ext_if dynamic 198.51.100.2 port 22 <- $ext_v4 9022
a36 4
procedure "rid" {
	normalise: "random-id"
}

d38 1
a38 1
	pass stateful out final from $ext_addrs apply "rid"
a61 1

@


1.2
log
@add id string, fix comments
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.1 2012/08/21 06:54:39 spz Exp $
d9 3
d26 1
a26 1
map $ext_if dynamic 198.51.100.0/24 -> $ext_if
d30 1
a30 1
map $ext_if dynamic 198.51.100.2 port 22 <- $ext_if 9022
d41 1
a41 1
	pass stateful out final from $ext_if apply "rid"
d44 1
a44 1
	pass stateful in final family inet proto tcp to $ext_if port ssh \
d46 2
a47 2
	pass stateful in final proto tcp to $ext_if port $services_tcp
	pass stateful in final proto udp to $ext_if port $services_udp
d50 1
a50 1
	pass stateful in final proto tcp to $ext_if port 49151-65535
d52 1
a52 1
	pass stateful in final proto udp to $ext_if port 33434-33600
@


1.2.2.1
log
@resync with head
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.2 2012/08/21 08:25:21 spz Exp $
a7 1

a8 3
$ext_v4 = inet4(wm0)
$ext_addrs = { ifnet(wm0) }

d23 1
a23 1
map $ext_if dynamic 198.51.100.0/24 -> $ext_v4
d27 1
a27 1
map $ext_if dynamic 198.51.100.2 port 22 <- $ext_v4 port 9022
d33 4
d38 1
a38 1
	pass stateful out final all
d41 1
a41 1
	pass stateful in final family inet proto tcp to $ext_v4 port ssh \
d43 2
a44 2
	pass stateful in final proto tcp to $ext_addrs port $services_tcp
	pass stateful in final proto udp to $ext_addrs port $services_udp
d47 1
a47 1
	pass stateful in final proto tcp to $ext_addrs port 49151-65535
d49 1
a49 1
	pass stateful in final proto udp to $ext_addrs port 33434-33600
d62 1
@


1.2.2.2
log
@Rebase to HEAD as of a few days ago.
@
text
@d1 1
a1 1
# $NetBSD$
d11 1
a11 1
$ext_addrs = { inet4(wm0), inet6(wm0) }
d16 3
a18 3
table <block> type hash file "/usr/share/examples/npf/hashtablefile"
# feed this using e.g.: npfctl table "int-block" add 198.51.100.16/29
table <int-block> type tree dynamic
d37 1
a37 1
group "external" on $ext_if {
d40 2
a41 2
	block in final from <block>
	pass stateful in final family inet4 proto tcp to $ext_v4 port ssh \
d52 1
a52 1
group "internal" on $int_if {
d54 1
a54 1
	pass in final from <int-block>
d58 1
a58 1
group default {
@


1.2.8.1
log
@file soho_gw-npf.conf was added on branch matt-nb6-plus on 2012-11-20 23:13:36 +0000
@
text
@d1 62
@


1.2.8.2
log
@Add missing files.
@
text
@a0 62
# $NetBSD: soho_gw-npf.conf,v 1.2.4.2 2012/10/01 20:15:34 riz Exp $
#
# SOHO border
#
# This is a natting border gateway/webserver/mailserver/nameserver
# IPv4 only
#
$ext_if = "wm0"
$int_if = "wm1"

# a table to house e.g. block candidates in
table <1> type hash file "/usr/share/examples/npf/hashtablefile"
# feed this using "npfctl table 2 add 198.51.100.16/29" f.e.
table <2> type tree dynamic

$services_tcp = { http, https, smtp, domain, 6000, 9022 }
$services_udp = { domain, ntp, 6000 }
$localnet = { 198.51.100.0/24 }

# NAT outgoing to the address of the external interface
# Note: if $ext_if has multiple IP addresses (e.g. IPv6 as well),
# then the translation address has to be specified explicitly.
map $ext_if dynamic 198.51.100.0/24 -> $ext_if

# NAT traffic arriving on port 9022 of the external interface address
# to host 198.51.100.2 port 22
map $ext_if dynamic 198.51.100.2 port 22 <- $ext_if 9022

procedure "log" {
	log: npflog0
}

procedure "rid" {
	normalise: "random-id"
}

group (name "external", interface $ext_if) {
	pass stateful out final from $ext_if apply "rid"

	block in final from <1>
	pass stateful in final family inet proto tcp to $ext_if port ssh \
		apply "log"
	pass stateful in final proto tcp to $ext_if port $services_tcp
	pass stateful in final proto udp to $ext_if port $services_udp

	# Passive FTP
	pass stateful in final proto tcp to $ext_if port 49151-65535
	# Traceroute
	pass stateful in final proto udp to $ext_if port 33434-33600
}

group (name "internal", interface $int_if) {
	block in all
	pass in final from <2>
	pass out final all
}

group (default) {
	pass final on lo0 all
	block all
}

@


1.2.6.1
log
@file soho_gw-npf.conf was added on branch yamt-pagecache on 2012-10-30 18:59:35 +0000
@
text
@d1 62
@


1.2.6.2
log
@sync with head
@
text
@a0 62
# $NetBSD$
#
# SOHO border
#
# This is a natting border gateway/webserver/mailserver/nameserver
# IPv4 only
#
$ext_if = "wm0"
$int_if = "wm1"

# a table to house e.g. block candidates in
table <1> type hash file "/usr/share/examples/npf/hashtablefile"
# feed this using "npfctl table 2 add 198.51.100.16/29" f.e.
table <2> type tree dynamic

$services_tcp = { http, https, smtp, domain, 6000, 9022 }
$services_udp = { domain, ntp, 6000 }
$localnet = { 198.51.100.0/24 }

# NAT outgoing to the address of the external interface
# Note: if $ext_if has multiple IP addresses (e.g. IPv6 as well),
# then the translation address has to be specified explicitly.
map $ext_if dynamic 198.51.100.0/24 -> $ext_if

# NAT traffic arriving on port 9022 of the external interface address
# to host 198.51.100.2 port 22
map $ext_if dynamic 198.51.100.2 port 22 <- $ext_if 9022

procedure "log" {
	log: npflog0
}

procedure "rid" {
	normalise: "random-id"
}

group (name "external", interface $ext_if) {
	pass stateful out final from $ext_if apply "rid"

	block in final from <1>
	pass stateful in final family inet proto tcp to $ext_if port ssh \
		apply "log"
	pass stateful in final proto tcp to $ext_if port $services_tcp
	pass stateful in final proto udp to $ext_if port $services_udp

	# Passive FTP
	pass stateful in final proto tcp to $ext_if port 49151-65535
	# Traceroute
	pass stateful in final proto udp to $ext_if port 33434-33600
}

group (name "internal", interface $int_if) {
	block in all
	pass in final from <2>
	pass out final all
}

group (default) {
	pass final on lo0 all
	block all
}

@


1.2.6.3
log
@sync with (a bit old) head
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.2.6.2 2012/10/30 18:59:35 yamt Exp $
a7 1

a8 3
$ext_v4 = inet4(wm0)
$ext_addrs = { ifnet(wm0) }

d23 1
a23 1
map $ext_if dynamic 198.51.100.0/24 -> $ext_v4
d27 1
a27 1
map $ext_if dynamic 198.51.100.2 port 22 <- $ext_v4 port 9022
d33 4
d38 1
a38 1
	pass stateful out final all
d41 1
a41 1
	pass stateful in final family inet proto tcp to $ext_v4 port ssh \
d43 2
a44 2
	pass stateful in final proto tcp to $ext_addrs port $services_tcp
	pass stateful in final proto udp to $ext_addrs port $services_udp
d47 1
a47 1
	pass stateful in final proto tcp to $ext_addrs port 49151-65535
d49 1
a49 1
	pass stateful in final proto udp to $ext_addrs port 33434-33600
d62 1
@


1.2.6.4
log
@sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.2.6.3 2013/01/16 05:32:35 yamt Exp $
d11 1
a11 1
$ext_addrs = { inet4(wm0), inet6(wm0) }
d16 3
a18 3
table <block> type hash file "/usr/share/examples/npf/hashtablefile"
# feed this using e.g.: npfctl table "int-block" add 198.51.100.16/29
table <int-block> type tree dynamic
d37 1
a37 1
group "external" on $ext_if {
d40 2
a41 2
	block in final from <block>
	pass stateful in final family inet4 proto tcp to $ext_v4 port ssh \
d52 1
a52 1
group "internal" on $int_if {
d54 1
a54 1
	pass in final from <int-block>
d58 1
a58 1
group default {
@


1.2.4.1
log
@file soho_gw-npf.conf was added on branch netbsd-6 on 2012-10-01 20:15:34 +0000
@
text
@d1 62
@


1.2.4.2
log
@Pull up following revision(s) (requested by rmind in ticket #584):
	share/examples/npf/treetablefile: revision 1.1
	share/examples/npf/Makefile: revision 1.1
	distrib/sets/lists/base/mi: revision 1.1003
	share/examples/npf/host-npf.conf: revision 1.2
	share/examples/Makefile: revision 1.21
	share/examples/npf/soho_gw-npf.conf: revision 1.1
	etc/mtree/NetBSD.dist.base: revision 1.104
	share/examples/npf/soho_gw-npf.conf: revision 1.2
	share/examples/npf/hashtablefile: revision 1.1
the example from the man page, with a few extra comments
add id string, fix comments
actually install the new npf examples
add examples for a hash table file and a tree table file
add an ID string to host-npf.conf
@
text
@a0 62
# $NetBSD: soho_gw-npf.conf,v 1.1 2012/08/21 06:54:39 spz Exp $
#
# SOHO border
#
# This is a natting border gateway/webserver/mailserver/nameserver
# IPv4 only
#
$ext_if = "wm0"
$int_if = "wm1"

# a table to house e.g. block candidates in
table <1> type hash file "/usr/share/examples/npf/hashtablefile"
# feed this using "npfctl table 2 add 198.51.100.16/29" f.e.
table <2> type tree dynamic

$services_tcp = { http, https, smtp, domain, 6000, 9022 }
$services_udp = { domain, ntp, 6000 }
$localnet = { 198.51.100.0/24 }

# NAT outgoing to the address of the external interface
# Note: if $ext_if has multiple IP addresses (e.g. IPv6 as well),
# then the translation address has to be specified explicitly.
map $ext_if dynamic 198.51.100.0/24 -> $ext_if

# NAT traffic arriving on port 9022 of the external interface address
# to host 198.51.100.2 port 22
map $ext_if dynamic 198.51.100.2 port 22 <- $ext_if 9022

procedure "log" {
	log: npflog0
}

procedure "rid" {
	normalise: "random-id"
}

group (name "external", interface $ext_if) {
	pass stateful out final from $ext_if apply "rid"

	block in final from <1>
	pass stateful in final family inet proto tcp to $ext_if port ssh \
		apply "log"
	pass stateful in final proto tcp to $ext_if port $services_tcp
	pass stateful in final proto udp to $ext_if port $services_udp

	# Passive FTP
	pass stateful in final proto tcp to $ext_if port 49151-65535
	# Traceroute
	pass stateful in final proto udp to $ext_if port 33434-33600
}

group (name "internal", interface $int_if) {
	block in all
	pass in final from <2>
	pass out final all
}

group (default) {
	pass final on lo0 all
	block all
}

@


1.2.4.3
log
@Pull up following revision(s) (requested by rmind in ticket #736):
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.17
	sys/net/npf/npf_tableset.c: revision 1.16
	usr.sbin/npf/npfctl/npfctl.h: revision 1.23
	usr.sbin/npf/npfctl/npf_data.c: revision 1.19
	usr.sbin/npf/npfctl/npf_build.c: revision 1.15
	share/examples/npf/host-npf.conf: revision 1.3
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.9
	share/examples/npf/soho_gw-npf.conf: revision 1.3
	usr.sbin/npf/npfctl/npf_var.h: revision 1.6
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.24
npfctl: extend syntax for extracting interface IP address(es) by the family.
adjust to current npf.conf syntax
npf_table_list: avoid triggering assert on diagnostic.
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.2.4.2 2012/10/01 20:15:34 riz Exp $
a8 3
$ext_v4 = inet4(wm0)
$ext_addrs = { ifnet(wm0) }

d23 1
a23 1
map $ext_if dynamic 198.51.100.0/24 -> $ext_v4
d27 1
a27 1
map $ext_if dynamic 198.51.100.2 port 22 <- $ext_v4 9022
d38 1
a38 1
	pass stateful out final from $ext_addrs apply "rid"
d41 1
a41 1
	pass stateful in final family inet proto tcp to $ext_v4 port ssh \
d43 2
a44 2
	pass stateful in final proto tcp to $ext_addrs port $services_tcp
	pass stateful in final proto udp to $ext_addrs port $services_udp
d47 1
a47 1
	pass stateful in final proto tcp to $ext_addrs port 49151-65535
d49 1
a49 1
	pass stateful in final proto udp to $ext_addrs port 33434-33600
@


1.2.4.4
log
@Pull up following revision(s) (requested by rmind in ticket #744):
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.25
	share/examples/npf/host-npf.conf: revision 1.4
	share/examples/npf/soho_gw-npf.conf: revision 1.4
Fix syntax error in the example, fix one rule and G/C &quot;rid&quot; procedure.
- npf.conf(5): fix of the example config.
- Mention npf_ext_log in a comment.
@
text
@d1 1
a1 1
# $NetBSD: soho_gw-npf.conf,v 1.2.4.3 2012/12/11 04:31:53 riz Exp $
a7 1

d30 1
a30 1
map $ext_if dynamic 198.51.100.2 port 22 <- $ext_v4 port 9022
d36 4
d41 1
a41 1
	pass stateful out final all
d65 1
@


1.1
log
@the example from the man page, with a few extra comments
@
text
@d1 1
a1 1
# $NetBSD$
d6 1
d11 3
a13 2
table <1> type hash file "/etc/npf_blacklist"
# for NAT
@