.\" $NetBSD: npfctl.8,v 1.21.2.2 2020/06/20 15:46:48 martin Exp $ .\" .\" Copyright (c) 2009-2014 The NetBSD Foundation, Inc. .\" All rights reserved. .\" .\" This material is based upon work partially supported by The .\" NetBSD Foundation under a contract with Mindaugas Rasiukevicius. .\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that the following conditions .\" are met: .\" 1. Redistributions of source code must retain the above copyright .\" notice, this list of conditions and the following disclaimer. .\" 2. Redistributions in binary form must reproduce the above copyright .\" notice, this list of conditions and the following disclaimer in the .\" documentation and/or other materials provided with the distribution. .\" .\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS .\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED .\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR .\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS .\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR .\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF .\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS .\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN .\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE .\" POSSIBILITY OF SUCH DAMAGE. .\" .Dd May 12, 2020 .Dt NPFCTL 8 .Os .Sh NAME .Nm npfctl .Nd control NPF packet filter .Sh SYNOPSIS .Nm npfctl .Ar command .Op Ar arguments .\" ----- .Sh DESCRIPTION The .Nm command can be used to control the NPF packet filter. For a description of NPF's configuration file, see .Xr npf.conf 5 . .Pp The first argument, .Ar command , specifies the action to take. Valid commands are: .Bl -tag -width reload -offset 3n .It Ic start Enable packet inspection using the currently loaded configuration, if any. Note that this command does not load or reload the configuration, or affect existing connections. .It Ic stop Disable packet inspection. This command does not change the currently loaded configuration, or affect existing connections. .It Ic reload Op Ar path Load or reload configuration from file. The configuration file at .Pa /etc/npf.conf will be used unless a file is specified by .Ar path . All connections will be preserved during the reload, except those which will lose NAT policy due to removal. NAT policy is determined by the translation type and address. Note that change of filter criteria will not expire associated connections. The reload operation (i.e., replacing the ruleset, NAT policies and tables) is atomic. .It Ic flush Flush configuration. That is, remove all rules, tables and expire all connections. This command does not disable packet inspection. .It Ic show Show the current state and configuration. Syntax of printed configuration is for the user and may not match the .Xr npf.conf 5 syntax. .It Ic validate Op Ar path Validate the configuration file and the processed form. The configuration file at .Pa /etc/npf.conf will be used unless a file is specified by .Ar path . The .Ar path may also be set to "-" for reading from .Em stdin . .\" --- .It Ic rule Ar name Ic add Aq rule-syntax Add a rule to a dynamic ruleset specified by .Ar name . On success, returns a unique identifier which can be used to remove the rule with .Ic rem-id command. The identifier is alphanumeric string. .It Ic rule Ar name Ic rem Aq rule-syntax Remove a rule from a dynamic ruleset specified by .Ar name . This method uses SHA1 hash computed on a rule to identify it. Although very unlikely, it is subject to hash collisions. For a fully reliable and more efficient method, it is recommended to use .Ic rem-id command. .It Ic rule Ar name Ic rem-id Aq id Remove a rule specified by unique .Ar id from a dynamic ruleset specified by .Ar name . .It Ic rule Ar name Ic list List all rules in the dynamic ruleset specified by .Ar name . .It Ic rule Ar name Ic flush Remove all rules from the dynamic ruleset specified by .Ar name . .\" --- .It Ic table Ar name Ic add Aq Ar addr/mask In table .Ar name , add the IP address and optionally netmask, specified by .Aq Ar addr/mask . Only the tables of type "lpm" support masks. .It Ic table Ar name Ic rem Aq Ar addr/mask In table .Ar name , remove the IP address and optionally netmask, specified by .Aq Ar addr/mask . Only the tables of type "lpm" support masks. .It Ic table Ar name Ic test Aq Ar addr Query the table .Ar name for a specific IP address, specified by .Ar addr . If no mask is specified, a single host is assumed. .It Ic table Ar name Ic list List all entries in the currently loaded table specified by .Ar name . This operation is expensive and should be used with caution. .It Ic table Ar name Ic replace Oo Fl n Ar newname Oc Oo Fl t Ar type Oc Aq Ar path Replace the existing table specified by .Ar name with a new table built from the file specified by .Ar path . Optionally, the new table will: .Bl -tag -width xxxxxxxxxx -compact -offset 3n .It Fl n Ar newname be named .Ar newname , effectively renaming the table. If not specified, the name of the table being replaced will be used. .It Fl t Ar type be of type .Ar type ; currently supported types are .Cm ipset , .Cm lpm , or .Cm const . If not specified, the type of the table being replaced will be used. .El .\" --- .It Ic save Op Ar path Save the active configuration with a snapshot of the current connections. The data will be stored in the .Pa /var/db/npf.db file unless a file is specified by .Ar path . Administrator may want to stop the packet inspection before saving. .It Ic load Load the saved configuration file and the connections from the file. Note that any existing connections will be destroyed. Administrator may want to start packet inspection after the load. .It Ic stats Print various statistics. .It Ic debug ( Fl a | Fl b Ar binary-config | Fl c Ar config ) \ Oo Fl o Ar outfile Oc Process the active configuration (if .Fl a is set), the given binary configuration (if .Fl b is set) or the given the plain configuration (if .Fl c is set). Print the byte-code of each rule and the encoded configuration data. Also, if .Fl o is set, write the binary configuration data into the given file. .Pp This is primarily for developer use. .It Ic list Oo Fl 46hNnW Oc Op Fl i Ar ifname Display a list of tracked connections: .Bl -tag -width xxxxxxxxx -compact -offset 3n .It Fl 4 Display only IPv4 connections. .It Fl 6 Display only IPv6 connections. .It Fl h Don't display a header. .It Fl N Try to resolve addresses. .It Fl n Only show NAT connections. .It Fl W Restrict the display width. .It Fl i Ar ifname Display only connections through the named interface. .El .El .Sh PERFORMANCE Reloading the configuration is a relatively expensive operation. Therefore, frequent reloads should be avoided. Use of tables should be considered as an alternative design. See .Xr npf.conf 5 for details. .\" ----- .Sh FILES .Bl -tag -width Pa -compact .It Pa /dev/npf control device .It Pa /etc/npf.conf default configuration file .El .\" ----- .Sh EXAMPLES Starting the NPF packet filter: .Bd -literal -offset indent # npfctl reload # npfctl start # npfctl show .Ed .Pp Addition and removal of entries in the table whose ID is "vip": .Bd -literal -offset indent # npfctl table "vip" add 10.0.0.1 # npfctl table "vip" rem 182.168.0.0/24 .Ed .Pp Replacing the existing table which has ID "svr" with a new const table populated from file "/tmp/npf_vps_new", and renamed to "vps": .Bd -literal -offset indent # npfctl table "svr" replace -n "vps" -t const "/tmp/npf_vps_new" .Ed .\" ----- .Sh SEE ALSO .Xr bpf 4 , .Xr npf.conf 5 , .Xr npf 7 , .Xr npfd 8 .Sh HISTORY NPF first appeared in .Nx 6.0 . .Sh AUTHORS NPF was designed and implemented by .An Mindaugas Rasiukevicius .