API tools faq
paste
Guest User

EdgeRouter Lite config for KPN - no nonsense

a guest
Aug 20th, 2016
281
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.95 KB | None | 0 0
raw download clone embed print report
  1. firewall {
  2. all-ping enable
  3. broadcast-ping disable
  4. group {
  5. network-group LocalNetworks {
  6. description ""
  7. network 10.0.0.0/8
  8. network 172.16.0.0/12
  9. network 192.168.0.0/16
  10. }
  11. port-group UnwantedPorts {
  12. description ""
  13. port smtp
  14. port 67-68
  15. port 135-139
  16. port 213
  17. port 389
  18. port 445
  19. port 464
  20. }
  21. }
  22. ipv6-receive-redirects disable
  23. ipv6-src-route disable
  24. ip-src-route disable
  25. log-martians enable
  26. name WAN_IN {
  27. default-action drop
  28. description "WAN to Internal"
  29. enable-default-log
  30. rule 1 {
  31. action accept
  32. description "Allow established/related"
  33. log enable
  34. protocol all
  35. state {
  36. established enable
  37. invalid disable
  38. new disable
  39. related enable
  40. }
  41. }
  42. rule 2 {
  43. action drop
  44. description "Drop invalid state"
  45. log enable
  46. protocol all
  47. state {
  48. established disable
  49. invalid enable
  50. new disable
  51. related disable
  52. }
  53. }
  54. }
  55. name WAN_LOCAL {
  56. default-action drop
  57. description "WAN to router"
  58. enable-default-log
  59. rule 1 {
  60. action accept
  61. description "Allow established/related"
  62. log disable
  63. protocol all
  64. state {
  65. established enable
  66. invalid disable
  67. new disable
  68. related enable
  69. }
  70. }
  71. rule 2 {
  72. action drop
  73. description "Drop invalid state"
  74. log disable
  75. protocol all
  76. state {
  77. established disable
  78. invalid enable
  79. new disable
  80. related disable
  81. }
  82. }
  83. }
  84. name WAN_OUT {
  85. default-action accept
  86. enable-default-log
  87. rule 1 {
  88. action accept
  89. description "Allow SMTP to KPN"
  90. destination {
  91. address 213.75.63.13
  92. port 25
  93. }
  94. log disable
  95. protocol tcp
  96. source {
  97. address 192.168.2.0/24
  98. }
  99. }
  100. rule 2 {
  101. action drop
  102. description "Block unwanted outgoing traffic"
  103. destination {
  104. group {
  105. port-group UnwantedPorts
  106. }
  107. }
  108. log enable
  109. protocol tcp_udp
  110. }
  111. rule 3 {
  112. action drop
  113. description "Block private IP-spaces from entering WAN"
  114. destination {
  115. group {
  116. network-group LocalNetworks
  117. }
  118. }
  119. log enable
  120. protocol all
  121. }
  122. }
  123. options {
  124. mss-clamp {
  125. interface-type pppoe
  126. mss 1412
  127. }
  128. }
  129. receive-redirects disable
  130. send-redirects enable
  131. source-validation disable
  132. syn-cookies enable
  133. }
  134. interfaces {
  135. bridge br0 {
  136. aging 300
  137. bridged-conntrack disable
  138. description "br0 - ExperiaBox"
  139. hello-time 2
  140. max-age 20
  141. priority 32768
  142. promiscuous disable
  143. stp false
  144. }
  145. ethernet eth0 {
  146. duplex auto
  147. speed auto
  148. vif 4 {
  149. bridge-group {
  150. bridge br0
  151. }
  152. description "VLAN 0.4 - IPTV"
  153. }
  154. vif 6 {
  155. description "VLAN 0.6 - Internet"
  156. firewall {
  157. }
  158. pppoe 0 {
  159. default-route auto
  160. firewall {
  161. in {
  162. name WAN_IN
  163. }
  164. local {
  165. name WAN_LOCAL
  166. }
  167. out {
  168. name WAN_OUT
  169. }
  170. }
  171. mtu 1492
  172. name-server auto
  173. password kpn
  174. user-id ma-ca-dr-es-00-11@internet
  175. }
  176. }
  177. vif 7 {
  178. bridge-group {
  179. bridge br0
  180. }
  181. description "VLAN 0.7 - Telefonie"
  182. }
  183. }
  184. ethernet eth1 {
  185. address 192.168.2.1/24
  186. description "eth1 - Internet"
  187. duplex auto
  188. speed auto
  189. }
  190. ethernet eth2 {
  191. bridge-group {
  192. bridge br0
  193. }
  194. description "eth2 - ExperiaBox"
  195. duplex auto
  196. speed auto
  197. }
  198. loopback lo {
  199. }
  200. }
  201. service {
  202. dhcp-server {
  203. disabled false
  204. hostfile-update disable
  205. shared-network-name LAN {
  206. authoritative disable
  207. subnet 192.168.2.0/24 {
  208. default-router 192.168.2.1
  209. dns-server 208.67.222.123
  210. dns-server 208.67.220.123
  211. lease 86400
  212. start 192.168.2.20 {
  213. stop 192.168.2.220
  214. }
  215. }
  216. }
  217. }
  218. dns {
  219. forwarding {
  220. cache-size 150
  221. listen-on br0
  222. }
  223. }
  224. gui {
  225. https-port 443
  226. }
  227. nat {
  228. rule 5010 {
  229. description "KPN Internet"
  230. log enable
  231. outbound-interface pppoe0
  232. protocol all
  233. source {
  234. address 192.168.2.0/24
  235. }
  236. type masquerade
  237. }
  238. }
  239. ssh {
  240. port 22
  241. protocol-version v2
  242. }
  243. }
  244. system {
  245. host-name ubnt
  246. login {
  247. user ubnt {
  248. authentication {
  249. encrypted-password $1$zKNoUbAo$gomzUbYvgyUMcD436Wo66.
  250. }
  251. level admin
  252. }
  253. }
  254. ntp {
  255. server 0.ubnt.pool.ntp.org {
  256. }
  257. server 1.ubnt.pool.ntp.org {
  258. }
  259. server 2.ubnt.pool.ntp.org {
  260. }
  261. server 3.ubnt.pool.ntp.org {
  262. }
  263. }
  264. offload {
  265. ipv4 {
  266. pppoe enable
  267. vlan enable
  268. }
  269. }
  270. syslog {
  271. global {
  272. facility all {
  273. level notice
  274. }
  275. facility protocols {
  276. level debug
  277. }
  278. }
  279. }
  280. time-zone UTC
  281. traffic-analysis {
  282. dpi enable
  283. export enable
  284. }
  285. }
  286.  
  287. /* Warning: Do not remove the following line. */
  288. /* === vyatta-config-version: "config-management@1:conntrack@1:cron@1:dhcp-relay@1:dhcp-server@4:firewall@5:ipsec@5:nat@3:qos@1:quagga@2:system@4:ubnt-pptp@1:ubnt-util@1:vrrp@1:webgui@1:webproxy@1:zone-policy@1" === */
  289. /* Release version: v1.8.0.4853089.160219.1607 */
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!