NPF question (again)

joany

So a friend of mine and me talked about getting a Freelancer server running..
If you dont know what Freelancer is, lets just say its a great space adventure game

Anyhow.
Freelancer is coded with DirectPlay (UDP 2300 to 2400)

I tried to read the manual how i can portforward 100 ports...
But ??
Manual says
port-opts = "port" ( port-num | port-from "-" port-to | var-name )

I tried alot of variants
But no joy

Now my firewall looks like this

$ext_if = "re2"
$int_if = "re1"
$ext_addrs = { ifaddrs($ext_if) }
$localnet = { 192.168.1.0/24 }
$falcon = { 192.168.1.14 }
$freelancerpc = { 192.168.1.14 }
$falconports = { 2934, 2935 }
$services_tcp = { http, https }
$freelancer = { 2300- 2400 }

# Allow pings.
alg "icmp"

# Perform IPv4 NAT.
map inet4($ext_if) dynamic $localnet -> inet4($ext_if)


map $ext_if dynamic $falcon port 2934 <- $ext_addrs port 2934
map $ext_if dynamic $falcon port 2935 <- $ext_addrs port 2935

map $ext_if dynamic $freelancerpc port 2300  <- $ext_addrs port 2300				
map $ext_if dynamic $freelancerpc port 2301  <- $ext_addrs port 2301	
map $ext_if dynamic $freelancerpc port 2302  <- $ext_addrs port 2302	
map $ext_if dynamic $freelancerpc port 2303  <- $ext_addrs port 2303	
map $ext_if dynamic $freelancerpc port 2304  <- $ext_addrs port 2304	
map $ext_if dynamic $freelancerpc port 2305  <- $ext_addrs port 2305	
map $ext_if dynamic $freelancerpc port 2306  <- $ext_addrs port 2306	
map $ext_if dynamic $freelancerpc port 2307  <- $ext_addrs port 2307	
map $ext_if dynamic $freelancerpc port 2308  <- $ext_addrs port 2308	
map $ext_if dynamic $freelancerpc port 2309  <- $ext_addrs port 2309	
map $ext_if dynamic $freelancerpc port 2310  <- $ext_addrs port 2310	
map $ext_if dynamic $freelancerpc port 2311  <- $ext_addrs port 2311	
map $ext_if dynamic $freelancerpc port 2312  <- $ext_addrs port 2312	
map $ext_if dynamic $freelancerpc port 2313  <- $ext_addrs port 2313	
map $ext_if dynamic $freelancerpc port 2314  <- $ext_addrs port 2314	
map $ext_if dynamic $freelancerpc port 2315  <- $ext_addrs port 2315	
map $ext_if dynamic $freelancerpc port 2316  <- $ext_addrs port 2316	
map $ext_if dynamic $freelancerpc port 2317  <- $ext_addrs port 2317	
map $ext_if dynamic $freelancerpc port 2318  <- $ext_addrs port 2318	
map $ext_if dynamic $freelancerpc port 2319  <- $ext_addrs port 2319	
map $ext_if dynamic $freelancerpc port 2320  <- $ext_addrs port 2320	
map $ext_if dynamic $freelancerpc port 2321  <- $ext_addrs port 2321	
map $ext_if dynamic $freelancerpc port 2322  <- $ext_addrs port 2322	
map $ext_if dynamic $freelancerpc port 2323  <- $ext_addrs port 2323	
map $ext_if dynamic $freelancerpc port 2324  <- $ext_addrs port 2324	
map $ext_if dynamic $freelancerpc port 2325  <- $ext_addrs port 2325	
map $ext_if dynamic $freelancerpc port 2326  <- $ext_addrs port 2326	
map $ext_if dynamic $freelancerpc port 2327  <- $ext_addrs port 2327	
map $ext_if dynamic $freelancerpc port 2328  <- $ext_addrs port 2328	
map $ext_if dynamic $freelancerpc port 2329  <- $ext_addrs port 2329	
map $ext_if dynamic $freelancerpc port 2330  <- $ext_addrs port 2330	
map $ext_if dynamic $freelancerpc port 2331  <- $ext_addrs port 2331	
map $ext_if dynamic $freelancerpc port 2332  <- $ext_addrs port 2332	
map $ext_if dynamic $freelancerpc port 2333  <- $ext_addrs port 2333	
map $ext_if dynamic $freelancerpc port 2334  <- $ext_addrs port 2334	
map $ext_if dynamic $freelancerpc port 2335  <- $ext_addrs port 2335	
map $ext_if dynamic $freelancerpc port 2336  <- $ext_addrs port 2336	
map $ext_if dynamic $freelancerpc port 2337  <- $ext_addrs port 2337	
map $ext_if dynamic $freelancerpc port 2338  <- $ext_addrs port 2338	
map $ext_if dynamic $freelancerpc port 2339  <- $ext_addrs port 2339	
map $ext_if dynamic $freelancerpc port 2340  <- $ext_addrs port 2340	
map $ext_if dynamic $freelancerpc port 2341  <- $ext_addrs port 2341	
map $ext_if dynamic $freelancerpc port 2342  <- $ext_addrs port 2342	
map $ext_if dynamic $freelancerpc port 2343  <- $ext_addrs port 2343	
map $ext_if dynamic $freelancerpc port 2344  <- $ext_addrs port 2344	
map $ext_if dynamic $freelancerpc port 2345  <- $ext_addrs port 2345	
map $ext_if dynamic $freelancerpc port 2346  <- $ext_addrs port 2346	
map $ext_if dynamic $freelancerpc port 2347  <- $ext_addrs port 2347	
map $ext_if dynamic $freelancerpc port 2348  <- $ext_addrs port 2348	
map $ext_if dynamic $freelancerpc port 2349  <- $ext_addrs port 2349	
map $ext_if dynamic $freelancerpc port 2350  <- $ext_addrs port 2350	
map $ext_if dynamic $freelancerpc port 2351  <- $ext_addrs port 2351	
map $ext_if dynamic $freelancerpc port 2352  <- $ext_addrs port 2352	
map $ext_if dynamic $freelancerpc port 2353  <- $ext_addrs port 2353	
map $ext_if dynamic $freelancerpc port 2354  <- $ext_addrs port 2354	
map $ext_if dynamic $freelancerpc port 2355  <- $ext_addrs port 2355	
map $ext_if dynamic $freelancerpc port 2356  <- $ext_addrs port 2356	
map $ext_if dynamic $freelancerpc port 2357  <- $ext_addrs port 2357	
map $ext_if dynamic $freelancerpc port 2358  <- $ext_addrs port 2358	
map $ext_if dynamic $freelancerpc port 2359  <- $ext_addrs port 2359	
map $ext_if dynamic $freelancerpc port 2360  <- $ext_addrs port 2360	
map $ext_if dynamic $freelancerpc port 2361  <- $ext_addrs port 2361	
map $ext_if dynamic $freelancerpc port 2362  <- $ext_addrs port 2362	
map $ext_if dynamic $freelancerpc port 2363  <- $ext_addrs port 2363	
map $ext_if dynamic $freelancerpc port 2364  <- $ext_addrs port 2364	
map $ext_if dynamic $freelancerpc port 2365  <- $ext_addrs port 2365	
map $ext_if dynamic $freelancerpc port 2366  <- $ext_addrs port 2366	
map $ext_if dynamic $freelancerpc port 2367  <- $ext_addrs port 2367	
map $ext_if dynamic $freelancerpc port 2368  <- $ext_addrs port 2368	
map $ext_if dynamic $freelancerpc port 2369  <- $ext_addrs port 2369	
map $ext_if dynamic $freelancerpc port 2370  <- $ext_addrs port 2370	
map $ext_if dynamic $freelancerpc port 2371  <- $ext_addrs port 2371	
map $ext_if dynamic $freelancerpc port 2372  <- $ext_addrs port 2372	
map $ext_if dynamic $freelancerpc port 2373  <- $ext_addrs port 2373	
map $ext_if dynamic $freelancerpc port 2374  <- $ext_addrs port 2374	
map $ext_if dynamic $freelancerpc port 2375  <- $ext_addrs port 2375	
map $ext_if dynamic $freelancerpc port 2376  <- $ext_addrs port 2376	
map $ext_if dynamic $freelancerpc port 2377  <- $ext_addrs port 2377	
map $ext_if dynamic $freelancerpc port 2378  <- $ext_addrs port 2378	
map $ext_if dynamic $freelancerpc port 2379  <- $ext_addrs port 2379	
map $ext_if dynamic $freelancerpc port 2380  <- $ext_addrs port 2380	
map $ext_if dynamic $freelancerpc port 2381  <- $ext_addrs port 2381	
map $ext_if dynamic $freelancerpc port 2382  <- $ext_addrs port 2382	
map $ext_if dynamic $freelancerpc port 2383  <- $ext_addrs port 2383	
map $ext_if dynamic $freelancerpc port 2384  <- $ext_addrs port 2384	
map $ext_if dynamic $freelancerpc port 2385  <- $ext_addrs port 2385	
map $ext_if dynamic $freelancerpc port 2386  <- $ext_addrs port 2386	
map $ext_if dynamic $freelancerpc port 2387  <- $ext_addrs port 2387	
map $ext_if dynamic $freelancerpc port 2388  <- $ext_addrs port 2388	
map $ext_if dynamic $freelancerpc port 2389  <- $ext_addrs port 2389	
map $ext_if dynamic $freelancerpc port 2390  <- $ext_addrs port 2390	
map $ext_if dynamic $freelancerpc port 2391  <- $ext_addrs port 2391	
map $ext_if dynamic $freelancerpc port 2392  <- $ext_addrs port 2392	
map $ext_if dynamic $freelancerpc port 2393  <- $ext_addrs port 2393	
map $ext_if dynamic $freelancerpc port 2394  <- $ext_addrs port 2394	
map $ext_if dynamic $freelancerpc port 2395  <- $ext_addrs port 2395	
map $ext_if dynamic $freelancerpc port 2396  <- $ext_addrs port 2396	
map $ext_if dynamic $freelancerpc port 2397  <- $ext_addrs port 2397	
map $ext_if dynamic $freelancerpc port 2398  <- $ext_addrs port 2398	
map $ext_if dynamic $freelancerpc port 2399  <- $ext_addrs port 2399	
map $ext_if dynamic $freelancerpc port 2400  <- $ext_addrs port 2400	




group "external" on $ext_if {

        pass stateful out final all # allt kan fara ut
        block in all #blockera per defeinition
        pass stateful in final proto tcp to $ext_addrs port $services_tcp
        pass stateful in final to $ext_addrs port 2934
        pass stateful in final to $ext_addrs port 2935
        pass stateful in final to $ext_addrs port 2300-2400




}

group "internal" on $int_if {
        # We trust the internal network.
        pass in final all
        pass out final all
}

group default {
        pass final on lo0 all
        block all
}

Is there a "better" way ?
Thx

JuvenalUrbino

Hello @joany !
Just dropping by as I missed this thread before.
Tasty firewall config you got here. Well done, I'm bookmarking this for future reference.

joany Freelancer is coded with DirectPlay (UDP 2300 to 2400)

I see you like challenges.

I tried alot of variants
But no joy

I also tried translating multiple ports without luck on NPF. But it was the few I required for RPC services (NFS), so I didn't mind adding 2-3 more rules and forget about it.

map $ext_if dynamic $freelancerpc port 2352 <- $ext_addrs port 2352

So I suppose you first tried with:

map $ext_if dynamic $freelancerpc port 2300-2400  <- $ext_addrs port 2300-2400

And it didn't work?
For it to work NPF should interpret port-from "-" port-to not as a simple range (like "from/to to any") but on a per-port basis. So in other words, NPF should alternatively parse port-ops depending on their use in the context of a static-rule or a map-seg. I think this depends on FreeBSD's libnv which NPF depends on.

This is a fantastic question for netbsd-users and tech-kern. Would you mind forwarding it to the mailing list?

joany

Thx for looking at my FW rules

I tried
map $ext_if dynamic $freelancerpc port 2300-2400 <- $ext_addrs port 2300-2400

But i got a

Reloading NPF ruleset.
/etc/npf.conf:23:0: port range is not valid

Maybe there is a bug there?
That you cant alocate a range of ports, or is the lovley direct play with its 100 ports too much :D

I have since posting my initial question changed
map $ext_if dynamic $freelancerpc port 2300 <- $ext_addrs port 2300
to
map $ext_if dynamic proto udp $freelancerpc port 2300 <- $ext_addrs port 2300

No need for TCP aperently

spreadsheat and texteditors are phenomal help bulding this

I will try to post this question @ mailing lists