Module Name: src Committed By: rmind Date: Sun Apr 7 22:23:40 UTC 2019
Modified Files: src/usr.sbin/npf/npfctl: npf.conf.5 Log Message: npf.conf(5): Add more info about ifaddrs(). To generate a diff of this commit: cvs rdiff -u -r1.84 -r1.85 src/usr.sbin/npf/npfctl/npf.conf.5 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/usr.sbin/npf/npfctl/npf.conf.5 diff -u src/usr.sbin/npf/npfctl/npf.conf.5:1.84 src/usr.sbin/npf/npfctl/npf.conf.5:1.85 --- src/usr.sbin/npf/npfctl/npf.conf.5:1.84 Sat Jan 19 21:19:32 2019 +++ src/usr.sbin/npf/npfctl/npf.conf.5 Sun Apr 7 22:23:40 2019 @@ -1,4 +1,4 @@ -.\" $NetBSD: npf.conf.5,v 1.84 2019/01/19 21:19:32 rmind Exp $ +.\" $NetBSD: npf.conf.5,v 1.85 2019/04/07 22:23:40 rmind Exp $ .\" .\" Copyright (c) 2009-2018 The NetBSD Foundation, Inc. .\" All rights reserved. @@ -27,7 +27,7 @@ .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE .\" POSSIBILITY OF SUCH DAMAGE. .\" -.Dd January 14, 2019 +.Dd February 2, 2019 .Dt NPF.CONF 5 .Os .Sh NAME @@ -148,12 +148,16 @@ The .Cm family keyword of a filtering rule can be used in combination to explicitly select an IP address type. +This function can also be used with +.Cm map +to specify the translation address, see below. .El .Pp Example of configuration: .Bd -literal -offset indent $var1 = inet4(wm0) $var2 = ifaddrs(wm0) + group default { block in on wm0 all # rule 1 block in on $var1 all # rule 2 @@ -350,6 +354,11 @@ redirecting the public port 9022 to the .Pp .Dl map $ext_if dynamic proto tcp 10.1.1.2 port 22 <- $ext_if port 9022 .Pp +The translation address can also by dynamic, based on the interface. +The following would select IPv4 address currently assigned to the interface: +.Pp +.Dl map $ext_if dynamic 10.1.1.0/24 -> ifaddrs($ext_if) +.Pp If the dynamic NAT is configured with multiple translation addresses, then a custom selection algorithm can be chosen using the .Cm algo @@ -587,10 +596,9 @@ $localnet = { 10.1.1.0/24 } alg "icmp" -# Note: if $ext_if has multiple IP address (e.g. IPv6 as well), -# then the translation address has to be specified explicitly. -map $ext_if dynamic 10.1.1.0/24 -> $ext_if -map $ext_if dynamic proto tcp 10.1.1.2 port 22 <- $ext_if port 9022 +# These NAT rules will dynamically select the interface address(es). +map $ext_if dynamic 10.1.1.0/24 -> ifaddrs($ext_if) +map $ext_if dynamic proto tcp 10.1.1.2 port 22 <- ifaddrs($ext_if) port 9022 procedure "log" { # The logging facility can be used together with npfd(8). @@ -635,7 +643,7 @@ group default { .Xr npfctl 8 , .Xr npfd 8 .Pp -.Lk http://www.netbsd.org/~rmind/npf/ "NPF documentation website" +.Lk http://rmind.github.io/npf/ "NPF documentation website" .Sh HISTORY NPF first appeared in .Nx 6.0 .