tech-net archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

npf questions/experience migrating from ipf on NetBSD8

> I decided to dig into replacing my ipnat/ipf ruleset with npf for my
> home router/firewall/nameserver/webserver so I can migrate from
> NetBSD 8 --> NetBSD 9 with less pain/fear...
> Started with soho_gw-npf.conf from /usr/share/examples/npf/
> amd64 NetBSD 8_stable (quad xeon, plenty of ram, raidframe root)

So far,

suspect that the validate error is known since there are now parameters
(npf-param) that can be tweaked in NetBSD 9 for portmapping ranges...

received thoughtful advice on filtering rules, so will start out less
restrictive just to get an operable setup...

Thing not well documented about npf I think I have learned?
In addition to the man pages and npf documentation at:
I found this link which gave a couple of clues
but not all...
Is there someplace else I should be looking?

1) In NetBSD 8 (probably 9?), need to modify the GENERIC
   kernel to include(uncomment):
     pseudo-device   npf             # NPF packet filter
     pseudo-device   bpfilter        # Berkeley packet filter
   Should this be listed somewhere?
   Probably in "The Guide" update for npf?
2) Looks like we aught to be clear what sysctl variables need
   set to what...
   For my ipf setup, already had:
   Do I also need:
     kern.securelevel=0  ?
3) At a minimum will want to add in rc.conf or rc.local:
   npf=YES (disable the ipf stuff with NO for testing)
   anything else in here? npfd or some logging daemon?
4) What do I need to do to enable logging in npf? I can see the
   directives in the example config file, but no logs
   seem to be written?
   Would like a log like I get with ipf with action/rule/addresses in
human readable form.

After recompiling an GENERIC NetBSD8_Stable kernal with npf pseudo-device,
I could ping the internet from the console, but not from machines attached
to my lan...
Here are some diagnostics...

# npfctl show
# filtering:    active
# config:       loaded

procedure "log"

map wm0 dynamic any -> pass family inet4 from #

group "external" on wm0 # id="1"
        pass stateful out final flags S/FSRA # id="2"
        pass stateful in final family inet4 proto tcp flags S/FSRA to { port 9030, port 9001 } # id="3"
        pass out final family inet4 proto tcp from { port 9030,
port 9001 } # id="4"
        pass stateful in final family inet4 proto tcp flags S/FSRA to { port 22, port 115 } apply "log" # id="5"
        pass stateful in final family inet4 proto tcp flags S/FSRA to { port 80, port 443, port 25, port 53 } # id="6"
        pass stateful in final family inet4 proto udp to { port
53, port 123 } # id="7"
        pass stateful in final family inet4 proto tcp flags S/FSRA to port 49151:65535 # id="8"
        pass stateful in final family inet4 proto udp to port
33434:33600 # id="9"

group "internal" on bge0 # id="a"
        pass stateful in final family inet4 flags S/FSRA from # id="b"
        pass out final family inet4 to # id="c"
        pass out all apply "log" # id="d"
        pass stateful in flags S/FSRA apply "log" # id="e"

group # id="f"
        pass final on lo0 all # id="10"
        block all # id="11"

# npfctl stats
Packets passed:
        0 default pass
        14654 ruleset pass
        13798 state pass
Packets blocked:
        0 default block
        585 ruleset block
State and NAT entries:
        17482 state allocations
        17234 state destructions
        0 NAT entry allocations
        0 NAT entry destructions
Network buffers:
        0 non-contiguous cases
        0 contig alloc failures
Invalid packet state cases:
        0 cases in total
        0 TCP case I
        0 TCP case II
        0 TCP case III
Packet race cases:
        0 NAT association race
        14166 duplicate state race
        0 fragments
        0 reassembled
        0 failed reassembly
        0 unexpected errors
# npfctl list
                             From address:port                            
    To address:port
 [many more entries in the list]
It looks like connections are being established, just not connected and
routed to my lan somehow...?

I tried to ping from a Win10 console and the response was that else was unreachable...
And yes, my internal interface was reachable (

Comments/pointers welcome...

Home | Main Index | Thread Index | Old Index