NetBSD-Users archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: stateful npf

Another attempt at npf state on -current/amd64.

ext iwn0:
int wm0:

Toy ipf setup works as expected:

# cat /etc/ipnat.conf
map iwn0 -> portmap tcp/udp 40000:6000
map iwn0 ->
# cat /etc/ipf.conf
block in on wm0 all
pass in proto tcp from any to port = 80 flags S/SA keep state

I hope this is the equivalent in npf:

# cat /etc/npf.conf
map iwn0 dynamic ->

group "ext" on wm0 {
  block in all
  pass stateful in proto tcp flags S/SA from any to port 80

group default {
  pass all

test: plug NetBSD-running rpi into wm0 as and grab web page
from another NetBSD/amd64 webserver, Webpage arrives with ipf,
but not with npf.



Home | Main Index | Thread Index | Old Index