World Library  
Flag as Inappropriate
Email this Article

NPF (firewall)

Article Id: WHEBN0028822805
Reproduction Date:

Title: NPF (firewall)  
Author: World Heritage Encyclopedia
Language: English
Subject: IPFilter, Netfilter, Firewall (computing), Context-based access control, Zorp firewall
Collection:
Publisher: World Heritage Encyclopedia
Publication
Date:
 

NPF (firewall)

NPF
Written in C
Operating system NetBSD
Type packet filter, Firewall
License BSD license

NPF is a BSD licensed stateful packet filter, a central piece of software for firewalling. It is comparable to iptables, ipfw, ipfilter and PF. NPF is developed on NetBSD.

History

NPF was primarily written by Mindaugas Rasiukevicius. NPF first appeared in the NetBSD 6.0 release in 2012.[1]

Features

NPF is designed for high performance on SMP systems and for easy extensibility. It supports various forms of Network Address Translation (NAT), stateful packet inspection, tree and hash tables for IP sets, bytecode (BPF or n-code) for custom filter rules and other features. NPF has extension framework for supporting custom modules. Features such as packet logging, traffic normalization, random blocking are provided as NPF extensions.

Example of npf.conf

# Assigning IPv4-only addresses of the specified interfaces.
$ext_if = inet4(wm0)
$int_if = inet4(wm1)

# Efficient tables to store IP sets.
table <1> type hash file "/etc/npf_blacklist"
table <2> type tree dynamic

# Variables with the service names.
$services_tcp = { http, https, smtp, domain 9022 }
$services_udp = { domain, ntp }
$localnet = { 10.1.1.0/24 }

# Different forms of NAT are supported.
map $ext_if dynamic 10.1.1.0/24 -> $ext_if
map $ext_if dynamic 10.1.1.2 port 22 <- $ext_if port 9022

# NPF has various extensions which are supported via custom procedures.
procedure "log" {
        log: npflog0
}

#
# Grouping is mandatory in NPF.
# There must be a default group.
#

group "external" on $ext_if {
        # Stateful passing of all outgoing traffic.
        pass stateful out final all

        block in final from <1>
        pass stateful in final family inet proto tcp to $ext_if port ssh apply "log"
        pass stateful in final proto tcp to $ext_if port $services_tcp
        pass stateful in final proto udp to $ext_if port $services_udp

        # Passive FTP and traceroute
        pass stateful in final proto tcp to $ext_if port 49151-65535
        pass stateful in final proto udp to $ext_if port 33434-33600
}

group "internal" on $int_if {
        # Ingress filtering as per RFC 2827.
        block in all
        pass in final from $localnet
        pass in final from <2>
        pass out final all
}

group default {
        pass final on lo0 all
        block all
}

References

  1. ^ http://mail-index.netbsd.org/netbsd-announce/2012/10/17/msg000161.html

External links

  • NPF documentation
  • Introducing NPF in NetBSD 6.0
  • npf.conf manual page
This article was sourced from Creative Commons Attribution-ShareAlike License; additional terms may apply. World Heritage Encyclopedia content is assembled from numerous content providers, Open Access Publishing, and in compliance with The Fair Access to Science and Technology Research Act (FASTR), Wikimedia Foundation, Inc., Public Library of Science, The Encyclopedia of Life, Open Book Publishers (OBP), PubMed, U.S. National Library of Medicine, National Center for Biotechnology Information, U.S. National Library of Medicine, National Institutes of Health (NIH), U.S. Department of Health & Human Services, and USA.gov, which sources content from all federal, state, local, tribal, and territorial government publication portals (.gov, .mil, .edu). Funding for USA.gov and content contributors is made possible from the U.S. Congress, E-Government Act of 2002.
 
Crowd sourced content that is contributed to World Heritage Encyclopedia is peer reviewed and edited by our editorial staff to ensure quality scholarly research articles.
 
By using this site, you agree to the Terms of Use and Privacy Policy. World Heritage Encyclopedia™ is a registered trademark of the World Public Library Association, a non-profit organization.
 


Copyright © World Library Foundation. All rights reserved. eBooks from Project Gutenberg are sponsored by the World Library Foundation,
a 501c(4) Member's Support Non-Profit Organization, and is NOT affiliated with any governmental agency or department.