NAME

DESCRIPTION

This manual page serves as a reference for editing npf.conf. Please refer to the official NPF documentation for comprehensive and in-depth information.

There are multiple structural elements npf.conf may contain: variable and table definitions (with or without content), abstraction groups, packet filtering rules, map rules for address translation and procedure definitions to call on filtered packets. The minimal npf.conf must contain a mandatory default group.

SYNTAX

$var1 = 10.0.0.1

$var2 = { 10.0.0.1, 10.0.0.2 }

table <1> type hash dynamic 

10.0.0.0/24 
10.1.1.1

$pub_if_list = { ifnet(wm0), ifnet(wm1) }

$pub_if4 = inet4(wm0) 
$pub_if6 = { inet6(wm0) }

group (name "my_group", interface wm0, in) { 
	# List of rules 
}

pass stateful in final family inet proto tcp flags S/SA \ 
	from $source port $sport to $dest port $dport apply "someproc"

map $ext_if dynamic 10.1.1.0/24 -> $pub_ip

procedure "someproc" { 
	log: npflog0 
	normalise: "random-id", "min-ttl" 64 
}

GRAMMAR

; Syntax of a single line.  Lines can be separated by LF (\n) or 
; a semicolon.  Comments start with a hash (#) character. 
 
syntax		= var-def | table-def | map | group | rproc | comment 
 
; Variable definition.  Names can be alpha-numeric, including "_" character. 
 
var-name	= "$" . string 
interface	= interface-name | var-name 
var-def		= var "=" ( var-value | "{" value *[ "," value ] "}" ) 
 
; Table definition.  Table ID shall be numeric.  Path is in the double quotes. 
 
table-id	= <tid> 
table-def	= "table" table-id "type" ( "hash" | "tree" ) 
		  ( "dynamic" | "file" path ) 
 
; Mapping for address translation. 
 
map		= "map" interface ( "static" | "dynamic" ) 
		  net-seg ( "->" | "<-" | "<->" ) net-seg 
		  [ "pass" filt-opts ] 
 
; Rule procedure definition.  The name should be in the double quotes. 
; 
; Each call can have its own options in a form of key-value pairs. 
; Both key and values may be strings (either in double quotes or not) 
; and numbers, depending on the extension. 
 
proc		= "procedure" proc-name "{" *( proc-call [ new-line ] ) "}" 
proc-opts	= key " " val [ "," proc-opts ] 
proc-call	= call-name ":" proc-opts new-line 
 
; Group definition and the ruleset. 
 
group		= "group" "(" ( "default" | group-opts ) ")" "{" ruleset "}" 
group-opts	= [ "name" string ] [ "interface" interface ] [ "in" | "out" ] 
ruleset		= [ rule new-line ] [ ruleset ] 
 
rule		= ( "block" [ block-opts ] | "pass" ) [ "stateful" ] 
		  [ "in" | out" ] [ "final" ] [ "on" iface ] 
		  [ "family" fam-opt ] [ "proto" protocol [ proto-opts ] ] 
		  ( "all" | filt-opts ) [ "apply" proc-name ] 
 
block-opts	= "return-rst" | "return-icmp" | "return" 
fam-opt		= "inet" | "inet6" 
proto-opts	= "flags" tcp-flags [ "/" tcp-flag-mask ] | 
		  "icmp-type" type [ "code" icmp-code ] 
 
addr-mask	= addr [ "/" mask ] 
filt-opts	= "from" filt-addr [ port-opts ] "to" filt-addr [ port-opts ] 
filt-addr	= [ interface | var-name | addr-mask | table-id | "any" ] 
filt-port	= "port" ( port-num | port-from "-" port-to | var-name )

FILES

/dev/npf

control device

/etc/npf.conf

default configuration file

/usr/share/examples/npf

directory containing further examples

EXAMPLES

$ext_if = ifnet(wm0) 
$int_if = ifnet(wm1) 
 
table <1> type hash file "/etc/npf_blacklist" 
table <2> type tree dynamic 
 
$services_tcp = { http, https, smtp, domain, 6000, 9022 } 
$services_udp = { domain, ntp, 6000 } 
$localnet = { 10.1.1.0/24 } 
 
# Note: if $ext_if has multiple IP address (e.g. IPv6 as well), 
# then the translation address has to be specified explicitly. 
map $ext_if dynamic 10.1.1.0/24 -> $ext_if 
map $ext_if dynamic 10.1.1.2 port 22 <- $ext_if port 9022 
 
procedure "log" { 
	# Note: npf_ext_log kernel module should be loaded, if not built-in. 
	# Also, the interface created, e.g.: ifconfig npflog0 create 
	log: npflog0 
} 
 
group (name "external", interface $ext_if) { 
	pass stateful out final all 
 
	block in final from <1> 
	pass stateful in final family inet proto tcp to $ext_if port ssh apply "log" 
	pass stateful in final proto tcp to $ext_if port $services_tcp 
	pass stateful in final proto udp to $ext_if port $services_udp 
	pass stateful in final proto tcp to $ext_if port 49151-65535	# Passive FTP 
	pass stateful in final proto udp to $ext_if port 33434-33600	# Traceroute 
} 
 
group (name "internal", interface $int_if) { 
	block in all 
	pass in final from <2> 
	pass out final all 
} 
 
group (default) { 
	pass final on lo0 all 
	block all 
}

SEE ALSO

HISTORY

AUTHORS