Introducing NPF in NetBSD 6.0

[Manuel Bouyer]

Dear All,
NetBSD 6.0 introduces NPF - a NetBSD packet filter. Please find a short
http://www.netbsd.org/~rmind/pub/npf_presentation_netbsd_6.pdf
http://www.netbsd.org/~rmind/pub/npf_manual_netbsd_6.pdf

thanks.

Right now I use ipf on a router, with groups made like that:
A set of groups for each vlan, which just checks that source IP comes
from the expected interface (anti-spoofing rules):

block in log level err quick from network_of_vlan_xxx/24 to any head 1xxx
pass in on vlanxxx from any to any group 1xxx
(repeat for each vlan)

Then rules are grouped by destination IP (a group can cover more
than one vlan). This is where the real filtering occurs, i.e. where
we allow/deny access to a specific port on a group of hosts (eventually based
on source address, e.g. for internal-only services):
block return-icmp in log quick from any to (list of IPs or networks/netmasks) head 2yyy
(and some 'pass in quick ... group 2yyy wich allows some packets to
get in).

Finally, if a packet is not for one of our internal IPs, some filtering
is applied to prevent some type of pakets from leaving our network.
Eventually we use groups in groups. We only use 'in' rules, the only 'out'
rule is pass ou all (in other words, filtering is applied when a packet
enters the router, not when it leaves the router).

If I understood it properly, in npf a group can only be defined based on
incoming interface, do you plan to expand this by match of arbitrary rules ?

Is there a way to explicitely allow, in a group, to leave this group a
process the remaning groups ?

[Darren Reed]

On Fri, Oct 26, 2012, at 11:45 AM, Manuel Bouyer wrote:
...

Post by Manuel Bouyer
A set of groups for each vlan, which just checks that source IP comes
block in log level err quick from network_of_vlan_xxx/24 to any head 1xxx
pass in on vlanxxx from any to any group 1xxx
(repeat for each vlan)

You can use ippools to do this in one rule by defining a pool
that maps networks to groups and then doing a pool lookup in
the main rule.

So in ippool.conf you would have:
group-map in role = ipf number = 1000
{ vlan1001/24, group = 1001; vlan1002/25, group = 1002; };

and then in ipf.conf you would have:
call now fr_srcgrpmap/1010 in all

Cheers,
Darren

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Mindaugas Rasiukevicius]

Post by Manuel Bouyer
<...>
If I understood it properly, in npf a group can only be defined based on
incoming interface, do you plan to expand this by match of arbitrary rules ?

Currently, the grouping is based on the interface. In the kernel, NPF
already supports nested rules. A group is just a rule having subrules.
The limitation is merely syntactic, as I wanted to put more thought on
the structuring of nested rules. It seems that you basically want the
iptables chains equivalent. :)

Post by Manuel Bouyer
Is there a way to explicitely allow, in a group, to leave this group a
process the remaning groups ?

No, but it would be ~trivial to add. Can you describe your use case?

[Manuel Bouyer]

Post by Mindaugas Rasiukevicius

Post by Manuel Bouyer
<...>
If I understood it properly, in npf a group can only be defined based on
incoming interface, do you plan to expand this by match of arbitrary rules ?

Currently, the grouping is based on the interface. In the kernel, NPF
already supports nested rules. A group is just a rule having subrules.
The limitation is merely syntactic, as I wanted to put more thought on
the structuring of nested rules. It seems that you basically want the
iptables chains equivalent. :)

Maybe, I don't know iptables at all

Post by Mindaugas Rasiukevicius

Post by Manuel Bouyer
Is there a way to explicitely allow, in a group, to leave this group a
process the remaning groups ?

No, but it would be ~trivial to add. Can you describe your use case?

The one I'm thinking of is anti-spoof:
block in log level err quick from network_of_vlan_xxx/24 to any head 1xxx
pass in on vlanxxx from any to any group 1xxx

if the packet is from network_of_vlan_xxx/24 but not from interface vlanxxx,
it's blocked by the head rule. The pass rule allows the packet to not be
blocked here, but it will go through the remaining rules, which may pass
or block it.