NPF (firewall)

Quality 0.50 · 1 view · Updated 2 months ago

Packet filter software

title: "NPF (firewall)" type: doc version: 1 created: 2026-02-28 author: "Wikipedia contributors" status: active scope: public tags: ["bsd-software", "netbsd", "firewall-software"] description: "Packet filter software" topic_path: "general/bsd-software" source: "https://en.wikipedia.org/wiki/NPF_(firewall)" license: "CC BY-SA 4.0" wikipedia_page_id: 0 wikipedia_revision_id: 0

::summary Packet filter software ::

::data[format=table title="Infobox software"]

FieldValue
nameNPF
authorMindaugas Rasiukevicius
released
operating systemNetBSD
programming languageC
genrepacket filter, Firewall
licenseBSD license
::

| name = NPF | logo = | screenshot = | caption = | author = Mindaugas Rasiukevicius | developer = | released = | latest release version = | latest release date = | latest preview version = | latest preview date = | operating system = NetBSD | programming language = C | genre = packet filter, Firewall | license = BSD license | website = NPF is a BSD licensed stateful packet filter, a central piece of software for firewalling. It is comparable to iptables, ipfw, ipfilter and PF. NPF is developed on NetBSD.

History

NPF was primarily written by Mindaugas Rasiukevicius. NPF first appeared in the NetBSD 6.0 release in 2012.

Features

NPF is designed for high performance on SMP systems and for easy extensibility. It supports various forms of Network Address Translation (NAT), stateful packet inspection, tree and hash tables for IP sets, bytecode (BPF or n-code) for custom filter rules and other features. NPF has extension framework for supporting custom modules. Features such as packet logging, traffic normalization, random blocking are provided as NPF extensions.

Example of npf.conf

  1. Assigning IPv4-only addresses of the specified interfaces. $ext_if = inet4(wm0) $int_if = inet4(wm1)

  2. Efficient tables to store IP sets. table type hash file "/etc/npf_blacklist" table type tree dynamic

  3. Variables with the service names. $services_tcp = { http, https, smtp, domain, 9022 } $services_udp = { domain, ntp } $localnet = { 10.1.1.0/24 }

  4. Different forms of NAT are supported. map $ext_if dynamic 10.1.1.0/24 - $ext_if map $ext_if dynamic 10.1.1.2 port 22

  5. NPF has various extensions which are supported via custom procedures. procedure "log" { log: npflog0 }

  7. Grouping is mandatory in NPF.

  8. There must be a default group.

group "external" on $ext_if {

  1. Stateful passing of all outgoing traffic. pass stateful out final all

block in final from pass stateful in final family inet proto tcp to $ext_if port ssh apply "log" pass stateful in final proto tcp to $ext_if port $services_tcp pass stateful in final proto udp to $ext_if port $services_udp

  1. Passive FTP and traceroute pass stateful in final proto tcp to $ext_if port 49151-65535 pass stateful in final proto udp to $ext_if port 33434-33600 }

group "internal" on $int_if {

  1. Ingress filtering as per RFC 2827. block in all pass in final from $localnet pass in final from pass out final all }

group default { pass final on lo0 all block all }

References

References

  1. Rasiukevicius, Mindaugas. (2012-10-17). "Introducing NPF in NetBSD 6.0".

::callout[type=info title="Wikipedia Source"] This article was imported from Wikipedia and is available under the Creative Commons Attribution-ShareAlike 4.0 License. Content has been adapted to SurfDoc format. Original contributors can be found on the article history page. ::

bsd-softwarenetbsdfirewall-software