search

rmind / npf

NPF: packet filter with stateful inspection, NAT, IP sets, etc.
Other
239 stars 42 forks source link

npfctl multi-element parsing/support has problems #88

Closed rmind closed 4 years ago

rmind commented 4 years ago

There are a few multi-element combinations which are currently not supported by npfctl.

  1. Mixing of protocols, e.g.: pass proto { tcp, udp } from 10.0.0.0/8

  2. Mixing of IP addresses and tables: pass from { 10.0.0.2, <some-table> }

  3. Static NAT rule expressed with any (e.g. bi-directional NAT entries), e.g. map eth0 static no-ports 10.1.1.3 <- any pass family inet4 to 192.0.2.3

rmind commented 4 years ago

Fixed by #95, #96 and #97.