NPF (firewall)


NPF is a BSD licensed stateful packet filter, a central piece of software for firewalling. It is comparable to iptables, ipfw, ipfilter and PF. NPF is developed on NetBSD.

History

NPF was primarily written by Mindaugas Rasiukevicius. NPF first appeared in the NetBSD 6.0 release in 2012.

Features

NPF is designed for high performance on SMP systems and for easy extensibility.
It supports various forms of Network Address Translation, stateful packet inspection, tree and hash tables for IP sets, bytecode for custom filter rules and other features.
NPF has extension framework for supporting custom modules. Features such as packet logging, traffic normalization, random blocking are provided as NPF extensions.

Example of npf.conf


  1.  Assigning IPv4-only addresses of the specified interfaces.
$ext_if = inet4
$int_if = inet4
  1.  Efficient tables to store IP sets.
table <1> type hash file "/etc/npf_blacklist"
table <2> type tree dynamic
  1.  Variables with the service names.
$services_tcp = 
$services_udp = 
$localnet = 
  1.  Different forms of NAT are supported.
map $ext_if dynamic 10.1.1.0/24 -> $ext_if
map $ext_if dynamic 10.1.1.2 port 22 <- $ext_if port 9022
  1.  NPF has various extensions which are supported via custom procedures.
procedure "log" 
  1.  Grouping is mandatory in NPF.
  2.  There must be a default group.
group "external" on $ext_if 
group "internal" on $int_if 
group default