VPF Tables¶

VPF tables are collections of items which allow VPF Filter Rules and VPF NAT Rules to act on groups of items in a single rule using a custom name, allowing for simpler and more descriptive rulesets. Tables also make it easy to update items in one place rather than having to edit multiple rules.

Table Types¶

VPF offers two types of tables: Prefix tables and port tables.

Each prefix table contains one or more prefix entries, which can be a single IP address or an entire subnet.

Each port table contains one or more port entries.

Note

Port tables can only be used for matching actions. For example, on NAT rules they can only match ports on packets, and they cannot be used for controlling translation.

Prefix Table Management¶

To create a new prefix table, run the vpf prefix-table <name> command in config mode, which enters config-vpf-prefix-table mode.

The following commands are available inside config-vpf-prefix-table mode:

description <text>: Adds an optional description for the table, such as an explanation of its contents or purpose.

Prefix Table Data Sources¶

VPF can load prefix data several different ways: Inline in the table configuration (default), from a comma-separated value (CSV) file, or from a MaxMind database (MMDB) file.

Inline¶

The most common way to load prefix data is to define it directly in the table configuration using the prefix command from within config-vpf-prefix-table mode.

prefix <ip-prefix> [description <text>]

Defines an IP prefix to include in this table. Each prefix is composed of an IPv4 or IPv6 address and a CIDR mask/prefix length. For example, 10.0.0.0/8 or ff00::/8.

To define a single host, use a /32 CIDR for IPv4 or a /128 prefix length for IPv6.

description <text>: Adds an optional description specific to this individual prefix.

Warning

When defining a network, use an appropriate network boundary as the starting address. For example, to define a prefix for an IPv4 network including the address 10.1.2.1/24, the prefix must be defined using the network address of that subnet, 10.1.2.0/24.

Warning

A table cannot contain overlapping prefixes. Ensure each entry is distinct and has the correct prefix length.

Comma-Separated Value (CSV) File¶

VPF can load prefix data from plain text comma-separated value (CSV) files, which can be easily created in a variety of ways or obtained from third party sources.

Compatible files must contain the prefix in the first column.

To load the data, start in config-vpf-prefix-table mode and then define both a file and a data selection:

csv file <name> [select …]

Defines the full path and name of the CSV file for VPF to load. The select expression can be defined on the same line.

csv select (s0-s9|u0-u9) (eq|ge|gt|le|lt|ne) <value>

Defines an expression to limit the prefixes VPF adds to the table out of the file. The parser can compare values from the first 10 columns using either string or unsigned integer comparisons.

(s0-s9|u0-u9)

The data type and column to match in <type><column#> notation. s denotes a string match, u denotes an unsigned 32-bit integer match. Column numbers range from 0 to 9. Column 0 is always the prefix data.

For example: s1 will use a string comparison on the value in column 1. u3 will use an unsigned integer comparison on the value in column 3.

eq <value>

Data in the column must be equal to the value.

ge <value>

Data in the column must be greater than or equal to the value.

gt <value>

Data in the column must be greater than the value.

le <value>

Data in the column must be less than or equal to the value.

lt <value>

Data in the column must be less than the value.

ne <value>

Data in the column must not be equal to the value.

Note

The file and select expression can be defined on a single line or using separate lines. However, there can be only one select expression.

For string values containing spaces, use double quotes around the value, e.g. “match this”.

Tip

Changing the table configuration will trigger an in-place reload of the database file.

If VPF fails to load new data, the existing data will remain loaded.

MaxMind Database (MMDB) File¶

VPF can load prefix data from binary MaxMind Database (MMDB) files, which can be obtained from Netgate, MaxMind, and other sources.

To load the data, start in config-vpf-prefix-table mode and then define both a file and a data selection:

mmdb file <name> [select …]

Defines the full path and name of the MMDB file for VPF to load. The select expression can be defined on the same line.

mmdb select (alpha2code|asn|city|region) (eq|ge|gt|le|lt|ne) <value>

Defines an expression to limit the prefixes VPF adds to the table out of the file. The parser can compare values from several known MMDB file formats.

alpha2code: Match a two-character ISO country code, e.g. US, CA, IE. This is useful for creating a prefix table that matches a specific country.
asn: Match a BGP autonomous system number (ASN). This is useful for creating a prefix table that matches a specific company or service provider.
city: Match a city by name.
region: Match a region (e.g. state, province) by name.
eq <value>: Data in the field must be equal to the value.
ge <value>: Data in the field must be greater than or equal to the value.
gt <value>: Data in the field must be greater than the value.
le <value>: Data in the field must be less than or equal to the value.
lt <value>: Data in the field must be less than the value.
ne <value>: Data in the field must not be equal to the value.

The database formats are hardcoded and the available comparison fields vary by database type:

ip66.mmdb from IP66, identified as Globio-Country-ASN: Contains the fields: asn, alpha2code
GeoLite2-Country.mmdb from MaxMind, identified as GeoLite2-Country: Contains the fields: asn, alpha2code, region, city
GeoLite2-City.mmdb from MaxMind, identified as GeoLite2-City: Contains the fields: alpha2code, region, city
ng_geo.mmdb from Netgate, identified as Netgate-Alpha2Code-Region-City: Contains the fields: alpha2code, region, city
ng_asn.mmdb from Netgate, identified as Netgate-ASN: Contains the field: asn

Note

The file and select expression can be defined on a single line or using separate lines. However, there can be only one select expression.

For string values containing spaces, use double quotes around the value, e.g. “match this”.

Tip

Changing the table configuration will trigger an in-place reload of the database file.

If VPF fails to load new data, the existing data will remain loaded.

Port Table Management¶

To create a new port table, run the vpf port-table <name> command in config mode, which enters config-vpf-port-table mode.

The following commands are available inside config-vpf-port-table mode:

description <text>

Adds an optional description for the table, such as an explanation of its contents or purpose.

port <number> [description <text>]

Defines a port number entry to include in the table.

description <text>: Adds an optional description specific to this individual port.

Examples¶

A prefix table to cover private network IP addresses:

tnsr(config)# vpf prefix-table PrivateNets
tnsr(config-vpf-prefix-table)# description Private IPv4 Networks
tnsr(config-vpf-prefix-table)# prefix 10.0.0.0/8
tnsr(config-vpf-prefix-table)# prefix 172.16.0.0/12
tnsr(config-vpf-prefix-table)# prefix 192.168.0.0/16
tnsr(config-vpf-prefix-table)# exit

A prefix table with multiple single IP addresses and descriptions:

tnsr(config)# vpf prefix-table ExternalNAT
tnsr(config-vpf-prefix-table)# prefix 203.0.113.230/32 description General use
tnsr(config-vpf-prefix-table)# prefix 203.0.113.231/32 description PBX
tnsr(config-vpf-prefix-table)# prefix 203.0.113.232/32 description SMTP server
tnsr(config-vpf-prefix-table)# exit

A port table to cover HTTP and HTTPS for web servers:

tnsr(config)# vpf port-table WebPorts
tnsr(config-vpf-port-table)# port 80 description HTTP
tnsr(config-vpf-port-table)# port 443 description HTTPS
tnsr(config-vpf-port-table)# exit