4d7709ddf6
Copy the most important test cases from OpenBSD's corresponding src/regress/sbin/pfctl, those that run pfctl on a test input file and check correctness of its output. We have also added some new tests using the same format. The tests consist of a collection of input files (pf*.in) and corresponding output files (pf*.ok). We run pfctl -nv on the input files and check that the output matches the output files. If any discrepancy is discovered during future development in the source tree, we know that a regression bug has been introduced into the tree. Submitted by: paggas Sponsored by: Google, Inc (GSoC 2017) Differential Revision: https://reviews.freebsd.org/D11322
18 lines
744 B
Plaintext
18 lines
744 B
Plaintext
#match out on tun1000000 from 10.0.0.0/24 to any \
|
|
# nat-to { 10.0.1.1, 10.0.1.2 } round-robin sticky-address
|
|
#match in on tun1000000 from any to 10.0.1.1 \
|
|
# rdr-to { 10.0.0.0/24 } sticky-address random
|
|
#match in on tun1000000 from any to 10.0.1.2 \
|
|
# rdr-to { 10.0.0.1, 10.0.0.2 } sticky-address
|
|
|
|
pass in proto tcp from any to any port 22 \
|
|
keep state (source-track)
|
|
pass in proto tcp from any to any port 25 \
|
|
keep state (source-track global)
|
|
pass in proto tcp from any to any port 80 \
|
|
keep state (source-track rule, max-src-nodes 1000, max-src-states 3)
|
|
pass in proto tcp from any to any port 123 \
|
|
keep state (source-track, max-src-nodes 1000)
|
|
pass in proto tcp from any to any port 321 \
|
|
keep state (source-track, max-src-states 3)
|