Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- firewall {
- all-ping enable
- broadcast-ping disable
- group {
- network-group LocalNetworks {
- description ""
- network 10.0.0.0/8
- network 172.16.0.0/12
- network 192.168.0.0/16
- }
- port-group UnwantedPorts {
- description ""
- port smtp
- port 67-68
- port 135-139
- port 213
- port 389
- port 445
- port 464
- }
- }
- ipv6-receive-redirects disable
- ipv6-src-route disable
- ip-src-route disable
- log-martians enable
- name WAN_IN {
- default-action drop
- description "WAN to Internal"
- enable-default-log
- rule 1 {
- action accept
- description "Allow established/related"
- log enable
- protocol all
- state {
- established enable
- invalid disable
- new disable
- related enable
- }
- }
- rule 2 {
- action drop
- description "Drop invalid state"
- log enable
- protocol all
- state {
- established disable
- invalid enable
- new disable
- related disable
- }
- }
- }
- name WAN_LOCAL {
- default-action drop
- description "WAN to router"
- enable-default-log
- rule 1 {
- action accept
- description "Allow established/related"
- log disable
- protocol all
- state {
- established enable
- invalid disable
- new disable
- related enable
- }
- }
- rule 2 {
- action drop
- description "Drop invalid state"
- log disable
- protocol all
- state {
- established disable
- invalid enable
- new disable
- related disable
- }
- }
- }
- name WAN_OUT {
- default-action accept
- enable-default-log
- rule 1 {
- action accept
- description "Allow SMTP to KPN"
- destination {
- address 213.75.63.13
- port 25
- }
- log disable
- protocol tcp
- source {
- address 192.168.2.0/24
- }
- }
- rule 2 {
- action drop
- description "Block unwanted outgoing traffic"
- destination {
- group {
- port-group UnwantedPorts
- }
- }
- log enable
- protocol tcp_udp
- }
- rule 3 {
- action drop
- description "Block private IP-spaces from entering WAN"
- destination {
- group {
- network-group LocalNetworks
- }
- }
- log enable
- protocol all
- }
- }
- options {
- }
- receive-redirects disable
- send-redirects enable
- source-validation disable
- syn-cookies enable
- }
- interfaces {
- bridge br0 {
- aging 300
- bridged-conntrack disable
- description "br0 - Telefonie"
- hello-time 2
- max-age 20
- priority 32768
- promiscuous disable
- stp false
- }
- ethernet eth0 {
- description "eth0 - FTTH"
- duplex auto
- mtu 1512
- speed auto
- vif 4 {
- address dhcp
- description "VLAN 0.4 - IPTV"
- dhcp-options {
- client-option "send vendor-class-identifier "IPTV_RG";"
- client-option "request subnet-mask, routers, rfc3442-classless-static-routes;"
- default-route no-update
- default-route-distance 254
- name-server no-update
- }
- }
- vif 6 {
- description "VLAN 0.6 - Internet"
- firewall {
- }
- mtu 1508
- pppoe 0 {
- default-route auto
- firewall {
- in {
- name WAN_IN
- }
- local {
- name WAN_LOCAL
- }
- out {
- name WAN_OUT
- }
- }
- idle-timeout 180
- mtu 1500
- name-server auto
- password kpn
- user-id xx-xx-xx-xx-xx-xx@internet
- }
- }
- vif 7 {
- bridge-group {
- bridge br0
- }
- description "VLAN 0.7 - Telefonie"
- }
- }
- ethernet eth1 {
- address 192.168.2.1/24
- description "eth1 - Internet & IPTV"
- duplex auto
- speed auto
- }
- ethernet eth2 {
- bridge-group {
- bridge br0
- }
- description "eth2 - ExperiaBox"
- duplex auto
- speed auto
- }
- loopback lo {
- }
- }
- protocols {
- igmp-proxy {
- interface eth0.4 {
- alt-subnet 10.16.12.0/16
- alt-subnet 213.75.0.0/16
- role upstream
- threshold 1
- }
- interface eth1 {
- role downstream
- threshold 1
- }
- }
- }
- service {
- dhcp-server {
- disabled false
- global-parameters "option vendor-class-identifier code 60 = string;"
- global-parameters "option broadcast-address code 28 = ip-address;"
- hostfile-update disable
- shared-network-name LAN {
- authoritative enable
- subnet 192.168.2.0/24 {
- default-router 192.168.2.1
- dns-server 208.67.222.123
- dns-server 208.67.220.123
- lease 86400
- start 192.168.2.20 {
- stop 192.168.2.254
- }
- static-mapping AP1 {
- ip-address 192.168.2.2
- mac-address xx-xx-xx-xx-xx-xx
- }
- subnet-parameters "option vendor-class-identifier "IPTV_RG";"
- subnet-parameters "option broadcast-address 192.168.2.255;"
- }
- }
- }
- dns {
- forwarding {
- cache-size 150
- listen-on eth1
- name-server 208.67.222.222
- name-server 208.67.220.220
- options listen-address=192.168.2.1
- }
- }
- gui {
- https-port 443
- }
- nat {
- rule 5000 {
- description IPTV
- destination {
- address 10.16.0.0/16
- }
- log disable
- outbound-interface eth0.4
- protocol all
- source {
- }
- type masquerade
- }
- rule 5001 {
- description IPTV
- destination {
- address 213.75.112.0/21
- }
- log disable
- outbound-interface eth0.4
- protocol all
- source {
- }
- type masquerade
- }
- rule 5002 {
- description "KPN Internet"
- log enable
- outbound-interface pppoe0
- protocol all
- source {
- address 192.168.2.0/24
- }
- type masquerade
- }
- }
- ssh {
- port 22
- protocol-version v2
- }
- }
- system {
- host-name ubnt
- login {
- user ubnt {
- authentication {
- encrypted-password xxxxxxxxxxxxxxxxx
- plaintext-password ""
- }
- full-name Admin
- level admin
- }
- }
- ntp {
- server 0.ubnt.pool.ntp.org {
- }
- server 1.ubnt.pool.ntp.org {
- }
- server 2.ubnt.pool.ntp.org {
- }
- server 3.ubnt.pool.ntp.org {
- }
- }
- offload {
- ipv4 {
- forwarding enable
- pppoe enable
- vlan enable
- }
- }
- syslog {
- global {
- facility all {
- level notice
- }
- facility protocols {
- level debug
- }
- }
- }
- time-zone UTC
- traffic-analysis {
- dpi enable
- export enable
- }
- }
- /* Warning: Do not remove the following line. */
- /* === vyatta-config-version: "config-management@1:conntrack@1:cron@1:dhcp-relay@1:dhcp-server@4:firewall@5:ipsec@4:nat@3:qos@1:quagga@2:system@4:ubnt-pptp@1:ubnt-util@1:vrrp@1:webgui@1:webproxy@1:zone-policy@1" === */
- /* Release version: v1.7.0.4783374.150622.1534 */
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement