This commit was generated by cvs2svn to compensate for changes in r95421,

which included commits to RCS files with non-trunk default branches.

21 files changed, 310 insertions, 0 deletions

diff --git a/contrib/ipfilter/test/expected/f17 b/contrib/ipfilter/test/expected/f17
new file mode 100644
index 0000000..99eee84
--- /dev/null
+++ b/contrib/ipfilter/test/expected/f17
@@ -0,0 +1,10 @@
+pass
+block return-rst
+pass
+pass
+pass
+pass
+pass
+pass
+pass
+--------
diff --git a/contrib/ipfilter/test/expected/in1 b/contrib/ipfilter/test/expected/in1
new file mode 100644
index 0000000..f3d0777
--- /dev/null
+++ b/contrib/ipfilter/test/expected/in1
@@ -0,0 +1,24 @@
+map le0 0.0.0.0/0 -> 0.0.0.0/32
+map le0 0.0.0.1/32 -> 0.0.0.1/32
+map le0 128.0.0.0/1 -> 0.0.0.0/0
+map le0 10.0.0.0/8 -> 1.2.3.0/24
+map le0 10.0.0.0/8 -> 1.2.3.0/24
+map le0 192.168.0.0/16 -> range 203.1.1.23-203.1.3.45
+map ppp0 192.168.0.0/16 -> 0.0.0.0/32 portmap tcp 10000:19999
+map ppp0 192.168.0.0/16 -> 0.0.0.0/32 portmap udp 20000:29999
+map ppp0 192.168.0.0/16 -> 0.0.0.0/32 portmap tcp/udp 30000:39999
+map ppp0 192.168.0.0/16 -> 0.0.0.0/32 portmap auto
+map ppp0 192.168.0.0/16 -> 0.0.0.0/32 portmap auto
+map ppp0 192.168.0.0/16 -> 0.0.0.0/32 portmap auto
+map ppp0 192.168.0.0/16 -> 0.0.0.0/32 proxy port ftp ftp/tcp
+map ppp0 192.168.0.0/16 -> 0.0.0.0/32 proxy port 1010 ftp/tcp
+map le0 0.0.0.0/0 -> 0.0.0.0/32 frag
+map le0 192.168.0.0/16 -> range 203.1.1.23-203.1.3.45 frag
+map ppp0 192.168.0.0/16 -> 0.0.0.0/32 portmap tcp 10000:19999 frag
+map ppp0 192.168.0.0/16 -> 0.0.0.0/32 proxy port ftp ftp/tcp frag
+map le0 0.0.0.0/0 -> 0.0.0.0/32 age 10/10
+map le0 192.168.0.0/16 -> range 203.1.1.23-203.1.3.45 age 10/20
+map ppp0 192.168.0.0/16 -> 0.0.0.0/32 portmap tcp 10000:19999 age 30/30
+map le0 0.0.0.0/0 -> 0.0.0.0/32 frag age 10/10
+map le0 192.168.0.0/16 -> range 203.1.1.23-203.1.3.45 frag age 10/20
+map ppp0 192.168.0.0/16 -> 0.0.0.0/32 portmap tcp 10000:19999 frag age 30/30
diff --git a/contrib/ipfilter/test/expected/in2 b/contrib/ipfilter/test/expected/in2
new file mode 100644
index 0000000..ebe747b
--- /dev/null
+++ b/contrib/ipfilter/test/expected/in2
@@ -0,0 +1,22 @@
+rdr le0 0.0.0.0/0 port 0 -> 1.1.1.1 port 0 tcp
+rdr le0 0.0.0.0/0 port 0 -> 1.1.1.1 port 0 ip
+rdr le0 0.0.0.0/0 port 80 -> 1.1.1.1 port 80 tcp
+rdr le0 0.0.0.0/0 port 0 -> 1.1.1.1 port 0 ip
+rdr le0 0.0.0.0/0 port 80 -> 1.1.1.1 port 80 tcp
+rdr le0 0.0.0.0/0 port 80 -> 1.1.1.1 port 80 udp
+rdr le0 0.0.0.0/0 port 80 -> 1.1.1.1 port 80 tcp/udp
+rdr le0 0.0.0.0/0 port 0 -> 1.1.1.1 port 0 icmp
+rdr le0 0.0.0.0/0 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp
+rdr le0 0.0.0.0/0 port 80 -> 1.1.1.1 port 80 tcp round-robin
+rdr le0 0.0.0.0/0 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp round-robin
+rdr le0 0.0.0.0/0 port 0 -> 1.1.1.1 port 0 ip frag
+rdr le0 0.0.0.0/0 port 0 -> 1.1.1.1 port 0 icmp frag
+rdr le0 0.0.0.0/0 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp frag
+rdr le0 0.0.0.0/0 port 80 -> 1.1.1.1 port 80 tcp round-robin frag
+rdr le0 0.0.0.0/0 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp round-robin frag
+rdr le0 0.0.0.0/0 port 0 -> 1.1.1.1 port 0 ip frag age 10/10
+rdr le0 0.0.0.0/0 port 0 -> 1.1.1.1 port 0 ip frag age 10/20
+rdr le0 0.0.0.0/0 port 0 -> 1.1.1.1 port 0 icmp frag age 10/10
+rdr le0 0.0.0.0/0 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp frag age 20/20
+rdr le0 0.0.0.0/0 port 80 -> 1.1.1.1 port 80 tcp round-robin frag age 30/30
+rdr le0 0.0.0.0/0 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp round-robin frag age 40/40
diff --git a/contrib/ipfilter/test/expected/in3 b/contrib/ipfilter/test/expected/in3
new file mode 100644
index 0000000..b8a85bf
--- /dev/null
+++ b/contrib/ipfilter/test/expected/in3
@@ -0,0 +1,5 @@
+bimap le0 0.0.0.0/0 -> 0.0.0.0/32
+bimap le0 0.0.0.1/32 -> 0.0.0.1/32
+bimap le0 128.0.0.0/1 -> 0.0.0.0/0
+bimap le0 10.0.0.0/8 -> 1.2.3.0/24
+bimap le0 10.0.5.0/24 -> 1.2.3.0/24
diff --git a/contrib/ipfilter/test/expected/in4 b/contrib/ipfilter/test/expected/in4
new file mode 100644
index 0000000..ac8dce1
--- /dev/null
+++ b/contrib/ipfilter/test/expected/in4
@@ -0,0 +1,5 @@
+map-block le0 10.0.0.0/24 -> 203.1.1.0/24 ports 0
+map-block le0 10.0.0.0/24 -> 203.1.1.0/24 ports 0
+map-block le0 10.0.0.0/24 -> 203.1.1.0/24 ports 256
+map-block le0 10.0.0.0/24 -> 203.1.1.0/24 ports auto
+map-block le0 10.0.0.0/16 -> 203.1.1.0/24 ports auto
diff --git a/contrib/ipfilter/test/expected/ipv6.1 b/contrib/ipfilter/test/expected/ipv6.1
new file mode 100644
index 0000000..abc0e87
--- /dev/null
+++ b/contrib/ipfilter/test/expected/ipv6.1
@@ -0,0 +1,3 @@
+pass
+pass
+--------
diff --git a/contrib/ipfilter/test/expected/ipv6.2 b/contrib/ipfilter/test/expected/ipv6.2
new file mode 100644
index 0000000..ba1581b
--- /dev/null
+++ b/contrib/ipfilter/test/expected/ipv6.2
@@ -0,0 +1,15 @@
+nomatch
+block
+nomatch
+block
+--------
+block
+nomatch
+block
+nomatch
+--------
+pass
+pass
+pass
+pass
+--------
diff --git a/contrib/ipfilter/test/expected/ni4 b/contrib/ipfilter/test/expected/ni4
new file mode 100644
index 0000000..f5b0ec9
--- /dev/null
+++ b/contrib/ipfilter/test/expected/ni4
@@ -0,0 +1,4 @@
+4500 003c 4706 4000 ff06 28aa 0606 0606 0404 0404 9c40 0050 0000 0001 0000 0000 a002 16d0 849a 0000 0204 05b4 0402 080a 0047 fbb0 0000 0000 0103 0300 
+4500 0038 809a 0000 ff01 3323 0303 0303 0202 0202 0303 acab 0000 0000 4500 003c 4706 4000 ff06 28aa 0202 0202 0404 0404 5000 0050 0000 0001 
+4500 0058 809a 0000 ff01 3303 0303 0303 0202 0202 0303 0937 0000 0000 4500 003c 4706 4000 ff06 28aa 0202 0202 0404 0404 5000 0050 0000 0001 0000 0000 a002 16d0 d8e2 0000 0204 05b4 0402 080a 0047 fbb0 0000 0000 0103 0300 
+-------------------------------
diff --git a/contrib/ipfilter/test/input/f17 b/contrib/ipfilter/test/input/f17
new file mode 100644
index 0000000..7ab1aab
--- /dev/null
+++ b/contrib/ipfilter/test/input/f17
@@ -0,0 +1,61 @@
+# (1.1.1.1,54076,seq=0xbfd08989) -> (2.2.2.2,25,seq=0) SYN
+[out,ppp0]
+4500 003c 8262 0000 4006 8417 0101 0101
+0202 0202 d33c 0019 bfd0 8989 0000 0000
+a002 4000 6190 0000 0204 05b4 0103 0300
+0101 080a 008e 17f7 0000 0000
+
+# (2.2.2.2,25,seq=0x40203436) -> (1.1.1.1,54076,seq=0xbfdfcbc9) ACK
+[in,ppp0]
+4500 003c 8262 0000 1106 b317 0202 0202
+0101 0101 0019 d33c 4020 3436 bfdf cbc9
+5010 4000 fb0c 0000 0204 0584 0103 0300
+0101 080a 008e 17f7 0000 0000
+
+# (1.1.1.1,54076,seq=0xbfd08989) -> (2.2.2.2,25,seq=0x0) SYN
+[out,ppp0]
+4500 003c 8265 0000 4006 8414 0101 0101
+0202 0202 d33c 0019 bfd0 8989 0000 0000
+a002 4000 6185 0000 0204 05b4 0103 0300
+0101 080a 008e 1802 0000 0000
+
+# (2.2.2.2,25,seq=0xed674d4e) -> (1.1.1.1,54076,seq=0xbfd0898a) SYN-ACK
+[in,ppp0]
+4500 002c 7442 4000 2906 6947 0202 0202
+0101 0101 0019 d33c ed67 4d4e bfd0 898a
+6012 2118 ab84 0000 0204 0584
+
+#
+# (2.2.2.2,25,seq=0xbfd0898a) -> (1.1.1.1,54076,seq=0xed674d4e) ACK
+[out,ppp0]
+4500 002c 8262 0000 4006 8417 0101 0101
+0202 0202 d33c 0019 bfd0 898a ed67 4d4e
+5010 4000 6190 0000 0000
+
+# (1.1.1.1,54076,seq=0xcfd08989) -> (2.2.2.2,25,seq=0x0) SYN
+[out,ppp0]
+4500 003c 8265 0000 4006 8414 0101 0101
+0202 0202 d33c 0019 cfd0 8989 0000 0000
+a002 4000 6185 0000 0204 05b4 0103 0300
+0101 080a 008e 1802 0000 0000
+
+# (1.1.1.1,54076,seq=0xcfd08989) -> (2.2.2.2,25,seq=0x0) SYN
+[out,ppp0]
+4500 003c 8266 0000 4006 8413 0101 0101
+0202 0202 d33c 0019 cfd0 8989 0000 0000
+a002 4000 6185 0000 0204 05b4 0103 0300
+0101 080a 008e 1802 0000 0000
+
+# (2.2.2.2,25,seq=0xed674d4e) -> (1.1.1.1,54076,seq=0xcfd0898a) SYN-ACK
+[in,ppp0]
+4500 002c 7442 4000 2906 6947 0202 0202
+0101 0101 0019 d33c ed67 4d4e cfd0 898a
+6012 2118 ab84 0000 0204 0584
+
+#
+# (2.2.2.2,25,seq=0xcfd0898a) -> (1.1.1.1,54076,seq=0xed674d4e) ACK
+[out,ppp0]
+4500 002c 8262 0000 4006 8417 0101 0101
+0202 0202 d33c 0019 cfd0 898a ed67 4d4e
+5010 4000 6190 0000 0000
+
diff --git a/contrib/ipfilter/test/input/ipv6.2 b/contrib/ipfilter/test/input/ipv6.2
new file mode 100644
index 0000000..8cc2d17
--- /dev/null
+++ b/contrib/ipfilter/test/input/ipv6.2
@@ -0,0 +1,26 @@
+[out,de0]
+6000 0000 0020 3aff ef00 0000 0000 0000
+0000 0000 0001 0013 ff02 0000 0000 0000
+0000 0001 ff01 000b 8700 ea32 0000 0000
+ef00 0000 0000 0000 0000 0000 0001 000b
+0101 0048 5487 5c6f
+
+[in,de0]
+6000 0000 0020 3aff ef00 0000 0000 0000
+0000 0000 0001 000b ef00 0000 0000 0000
+0000 0000 0001 0013 8800 5322 6000 0000
+ef00 0000 0000 0000 0000 0000 0001 000b
+0201 0800 2071 cce1
+
+[out,de0]
+6000 0000 0010 3a40 ef00 0000 0000 0000
+0000 0000 0001 0013 ef00 0000 0000 0000
+0000 0000 0001 000b 8000 3210 06ff 0002
+9ec3 3c3c 8a82 0300
+
+[in,de0]
+6000 0000 0010 3aff ef00 0000 0000 0000
+0000 0000 0001 000b ef00 0000 0000 0000
+0000 0000 0001 0013 8100 3110 06ff 0002
+9ec3 3c3c 8a82 0300
+
diff --git a/contrib/ipfilter/test/input/ni4 b/contrib/ipfilter/test/input/ni4
new file mode 100644
index 0000000..445d7c8
--- /dev/null
+++ b/contrib/ipfilter/test/input/ni4
@@ -0,0 +1,10 @@
+#v tos len id   off  ttl p sum  src       dst
+# ICMP dest unreachable with 64 bits in payload (in reply to a TCP packet
+# going out)
+[out,df0] 45 00 00 3c 47 06 40 00 ff 06 28 aa 02 02 02 02 04 04 04 04 50 00 00 50 00 00 00 01 00 00 00 00 a0 02 16 d0 d8 e2 00 00 02 04 05 b4 04 02 08 0a 00 47 fb b0 00 00 00 00 01 03 03 00 
+
+[in,df0] 45 00 00 38 80 9a 00 00 ff 01 33 23 03 03 03 03 01 01 01 01 03 03 60 6b 00 00 00 00 45 00 00 3c 47 06 40 00 ff 06 20 a2 06 06 06 06 04 04 04 04 9c 40 00 50 00 00 00 01
+
+# ICMP dest unreachable with whole packet in payload (40 bytes = 320 bits)
+[in,df0] 45 00 00 58 80 9a 00 00 ff 01 33 03 03 03 03 03 01 01 01 01 03 03 11 3f 00 00 00 00 45 00 00 3c 47 06 40 00 ff 06 20 a2 06 06 06 06 04 04 04 04 9c 40 00 50 00 00 00 01 00 00 00 00 a0 02 16 d0 84 9a 00 00 02 04 05 b4 04 02 08 0a 00 47 fb b0 00 00 00 00 01 03 03 00
+
diff --git a/contrib/ipfilter/test/intest b/contrib/ipfilter/test/intest
new file mode 100755
index 0000000..98241fc
--- /dev/null
+++ b/contrib/ipfilter/test/intest
@@ -0,0 +1,21 @@
+#!/bin/sh
+if [ -f /usr/ucb/touch ] ; then
+	TOUCH=/usr/ucb/touch
+else
+	if [ -f /usr/bin/touch ] ; then
+		TOUCH=/usr/bin/touch
+	else
+		if [ -f /bin/touch ] ; then
+			TOUCH=/bin/touch
+		fi
+	fi
+fi
+echo "$1...";
+/bin/cp /dev/null results/$1
+../ipnat -nvf regress/$1 2>/dev/null > results/$1
+cmp expected/$1 results/$1
+status=$?
+if [ $status = 0 ] ; then
+	$TOUCH $1
+fi
+exit $status
diff --git a/contrib/ipfilter/test/mhtest b/contrib/ipfilter/test/mhtest
new file mode 100755
index 0000000..52a0027
--- /dev/null
+++ b/contrib/ipfilter/test/mhtest
@@ -0,0 +1,36 @@
+#!/bin/sh
+# multiple rules at the same time
+
+if [ -f /usr/ucb/touch ] ; then
+	TOUCH=/usr/ucb/touch
+else
+	if [ -f /usr/bin/touch ] ; then
+		TOUCH=/usr/bin/touch
+	else
+		if [ -f /bin/touch ] ; then
+			TOUCH=/bin/touch
+		fi
+	fi
+fi
+echo "$1...";
+
+/bin/cp /dev/null results/$1
+
+../ipftest -br regress/$1 -Hi input/$1 > results/$1
+if [ $? -ne 0 ] ; then
+	exit 1
+fi
+echo "--------" >> results/$1
+
+cmp expected/$1 results/$1
+status=$?
+if [ $status -ne 0 ] ; then
+	exit $status
+fi
+cmp expected/$1 results/$1
+status=$?
+if [ $status -ne 0 ] ; then
+	exit $status
+fi
+$TOUCH $1
+exit 0
diff --git a/contrib/ipfilter/test/regress/f17 b/contrib/ipfilter/test/regress/f17
new file mode 100644
index 0000000..9a75ae3
--- /dev/null
+++ b/contrib/ipfilter/test/regress/f17
@@ -0,0 +1,4 @@
+block in all
+block out all
+pass out quick on ppp0 proto tcp all flags S keep state
+block return-rst in quick proto tcp all
diff --git a/contrib/ipfilter/test/regress/in1 b/contrib/ipfilter/test/regress/in1
new file mode 100644
index 0000000..6f3b063
--- /dev/null
+++ b/contrib/ipfilter/test/regress/in1
@@ -0,0 +1,24 @@
+map le0 0/0 -> 0/32
+map le0 1/32 -> 1/32
+map le0 128.0.0.0/1 -> 0/0
+map le0 10.0.0.0/8 -> 1.2.3.0/24
+map le0 10.0.0.5/8 -> 1.2.3.4/24
+map le0 192.168.0.0/16 -> range 203.1.1.23-203.1.3.45
+map ppp0 192.168.0.0/16 -> 0/32 portmap tcp 10000:19999
+map ppp0 192.168.0.0/16 -> 0/32 portmap udp 20000:29999
+map ppp0 192.168.0.0/16 -> 0/32 portmap tcp/udp 30000:39999
+map ppp0 192.168.0.0/16 -> 0/32 portmap tcp auto
+map ppp0 192.168.0.0/16 -> 0/32 portmap udp auto
+map ppp0 192.168.0.0/16 -> 0/32 portmap tcp/udp auto
+map ppp0 192.168.0.0/16 -> 0/32 proxy port ftp ftp/tcp
+map ppp0 192.168.0.0/16 -> 0/32 proxy port 1010 ftp/tcp
+map le0 0/0 -> 0/32 frag
+map le0 192.168.0.0/16 -> range 203.1.1.23-203.1.3.45 frag
+map ppp0 192.168.0.0/16 -> 0/32 portmap tcp 10000:19999 frag
+map ppp0 192.168.0.0/16 -> 0/32 proxy port ftp ftp/tcp frag
+map le0 0/0 -> 0/32 age 10
+map le0 192.168.0.0/16 -> range 203.1.1.23-203.1.3.45 age 10/20
+map ppp0 192.168.0.0/16 -> 0/32 portmap tcp 10000:19999 age 30
+map le0 0/0 -> 0/32 frag age 10
+map le0 192.168.0.0/16 -> range 203.1.1.23-203.1.3.45 frag age 10/20
+map ppp0 192.168.0.0/16 -> 0/32 portmap tcp 10000:19999 frag age 30
diff --git a/contrib/ipfilter/test/regress/in2 b/contrib/ipfilter/test/regress/in2
new file mode 100644
index 0000000..33151f0
--- /dev/null
+++ b/contrib/ipfilter/test/regress/in2
@@ -0,0 +1,22 @@
+rdr le0 0/0 port 0 -> 1.1.1.1 port 0
+rdr le0 0/0 port 0 -> 1.1.1.1 port 0 ip
+rdr le0 0/0 port 80 -> 1.1.1.1 port 80
+rdr le0 0/0 port 80 -> 1.1.1.1 port 80 ip
+rdr le0 0/0 port 80 -> 1.1.1.1 port 80 tcp
+rdr le0 0/0 port 80 -> 1.1.1.1 port 80 udp
+rdr le0 0/0 port 80 -> 1.1.1.1 port 80 tcp/udp
+rdr le0 0/0 port 80 -> 1.1.1.1 port 80 icmp
+rdr le0 0/0 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp
+rdr le0 0/0 port 80 -> 1.1.1.1 port 80 tcp round-robin
+rdr le0 0/0 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp round-robin
+rdr le0 0/0 port 0 -> 1.1.1.1 port 0 ip frag
+rdr le0 0/0 port 80 -> 1.1.1.1 port 80 icmp frag
+rdr le0 0/0 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp frag
+rdr le0 0/0 port 80 -> 1.1.1.1 port 80 tcp round-robin frag
+rdr le0 0/0 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp round-robin frag
+rdr le0 0/0 port 0 -> 1.1.1.1 port 0 ip frag age 10
+rdr le0 0/0 port 0 -> 1.1.1.1 port 0 ip frag age 10/20
+rdr le0 0/0 port 80 -> 1.1.1.1 port 80 icmp frag age 10
+rdr le0 0/0 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp frag age 20
+rdr le0 0/0 port 80 -> 1.1.1.1 port 80 tcp round-robin frag age 30
+rdr le0 0/0 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp round-robin frag age 40
diff --git a/contrib/ipfilter/test/regress/in3 b/contrib/ipfilter/test/regress/in3
new file mode 100644
index 0000000..d8016b6
--- /dev/null
+++ b/contrib/ipfilter/test/regress/in3
@@ -0,0 +1,5 @@
+bimap le0 0/0 -> 0/32
+bimap le0 1/32 -> 1/32
+bimap le0 128.0.0.0/1 -> 0/0
+bimap le0 10.0.0.0/8 -> 1.2.3.0/24
+bimap le0 10.0.5.6/24 -> 1.2.3.4/24
diff --git a/contrib/ipfilter/test/regress/in4 b/contrib/ipfilter/test/regress/in4
new file mode 100644
index 0000000..46bbd81
--- /dev/null
+++ b/contrib/ipfilter/test/regress/in4
@@ -0,0 +1,5 @@
+map-block le0 10.0.0.0/24 -> 203.1.1.0/24
+map-block le0 10.0.0.0/24 -> 203.1.1.0/24 ports 0
+map-block le0 10.0.0.0/24 -> 203.1.1.0/24 ports 256
+map-block le0 10.0.0.0/24 -> 203.1.1.0/24 ports auto
+map-block le0 10.0.0.0/16 -> 203.1.1.0/24 ports auto
diff --git a/contrib/ipfilter/test/regress/ipv6.2 b/contrib/ipfilter/test/regress/ipv6.2
new file mode 100644
index 0000000..814dfd6
--- /dev/null
+++ b/contrib/ipfilter/test/regress/ipv6.2
@@ -0,0 +1,3 @@
+block in all
+block out all
+pass out proto 58 all keep state
diff --git a/contrib/ipfilter/test/regress/ni4.ipf b/contrib/ipfilter/test/regress/ni4.ipf
new file mode 100644
index 0000000..c7e5797
--- /dev/null
+++ b/contrib/ipfilter/test/regress/ni4.ipf
@@ -0,0 +1,4 @@
+block in all
+block out all
+pass out proto udp from any to any keep state
+pass out proto tcp from any to any flags S keep state
diff --git a/contrib/ipfilter/test/regress/ni4.nat b/contrib/ipfilter/test/regress/ni4.nat
new file mode 100644
index 0000000..6eefdc2
--- /dev/null
+++ b/contrib/ipfilter/test/regress/ni4.nat
@@ -0,0 +1 @@
+map df0 2.2.2.2/32 -> 6.6.6.6/32 portmap tcp/udp 40000:60000