66 in a filter rule to multiple targets and the second, group-map ,
67 provides a mechanism to target multiple groups from a single filter
68 line.
69
70 The group-map command can only be used with filter rules that use the
71 call command to invoke either fr_srcgrpmap or fr_dstgrpmap , to use the
72 source or destination address, respectively, for determining which
73 filter group to jump to next for continuation of filter packet
74 processing.
75
76 POOL TYPES
77 Two storage formats are provided: hash tables and tree structure. The
78 hash table is intended for use with objects all containing the same
79 netmask or a few different sized netmasks of non-overlapping address
80 space and the tree is designed for being able to support exceptions to
81 a covering mask, in addition to normal searching as you would do with a
82 table. It is not possible to use the tree data storage type with
83 group-map configuration entries.
84
85 POOL ROLES
86 When a pool is defined in the configruation file, it must have an
87 associated role. At present the only supported role is ipf. Future
88 development will see further expansion of their use by other sections
89 of IPFilter code.
90
91 EXAMPLES
92 The following examples show how the pool configuration file is used
93 with the ipf configuration file to enhance the ability for the ipf
94 configuration file to be succinct in meaning.
95
96 1 The first example shows how a filter rule makes reference to a
97 specific pool for matching of the source address.
98 pass in from pool/100 to any
99
100 The pool configuration, which matches IP addresses 1.1.1.1 and any in
101 2.2.0.0/16, except for those in 2.2.2.0/24.
102
103 table role = ipf type = tree number = 100
104 { 1.1.1.1/32; 2.2.0.0/16; !2.2.2.0/24 };
105
106 2 The following ipf.conf extract uses the
115 block out all group 2040
116
117 A ippool configuration to work with the above ipf.conf file might look
118 like this:
119
120 group-map in role = ipf number = 1010
121 { 1.1.1.1/32, group = 1020; 3.3.0.0/16, group = 1030; };
122 group-map out role = ipf number = 2010 group = 2020
123 { 2.2.2.2/32; 4.4.0.0/16; 5.0.0.0/8, group = 2040; };
124
125 FILES
126 /dev/iplookup
127 /etc/ippool.conf
128 /etc/hosts
129
130 SEE ALSO
131 ippool(1M), hosts(4), ipf(4), ipf(1M), ipnat(1M), ipfilter(5)
132
133
134
135 April 9, 2016 IPPOOL(4)
|
66 in a filter rule to multiple targets and the second, group-map ,
67 provides a mechanism to target multiple groups from a single filter
68 line.
69
70 The group-map command can only be used with filter rules that use the
71 call command to invoke either fr_srcgrpmap or fr_dstgrpmap , to use the
72 source or destination address, respectively, for determining which
73 filter group to jump to next for continuation of filter packet
74 processing.
75
76 POOL TYPES
77 Two storage formats are provided: hash tables and tree structure. The
78 hash table is intended for use with objects all containing the same
79 netmask or a few different sized netmasks of non-overlapping address
80 space and the tree is designed for being able to support exceptions to
81 a covering mask, in addition to normal searching as you would do with a
82 table. It is not possible to use the tree data storage type with
83 group-map configuration entries.
84
85 POOL ROLES
86 When a pool is defined in the configuration file, it must have an
87 associated role. At present the only supported role is ipf. Future
88 development will see further expansion of their use by other sections
89 of IPFilter code.
90
91 EXAMPLES
92 The following examples show how the pool configuration file is used
93 with the ipf configuration file to enhance the ability for the ipf
94 configuration file to be succinct in meaning.
95
96 1 The first example shows how a filter rule makes reference to a
97 specific pool for matching of the source address.
98 pass in from pool/100 to any
99
100 The pool configuration, which matches IP addresses 1.1.1.1 and any in
101 2.2.0.0/16, except for those in 2.2.2.0/24.
102
103 table role = ipf type = tree number = 100
104 { 1.1.1.1/32; 2.2.0.0/16; !2.2.2.0/24 };
105
106 2 The following ipf.conf extract uses the
115 block out all group 2040
116
117 A ippool configuration to work with the above ipf.conf file might look
118 like this:
119
120 group-map in role = ipf number = 1010
121 { 1.1.1.1/32, group = 1020; 3.3.0.0/16, group = 1030; };
122 group-map out role = ipf number = 2010 group = 2020
123 { 2.2.2.2/32; 4.4.0.0/16; 5.0.0.0/8, group = 2040; };
124
125 FILES
126 /dev/iplookup
127 /etc/ippool.conf
128 /etc/hosts
129
130 SEE ALSO
131 ippool(1M), hosts(4), ipf(4), ipf(1M), ipnat(1M), ipfilter(5)
132
133
134
135 May 16, 2020 IPPOOL(4)
|