API tools faq
paste
Guest User

Untitled

a guest
Dec 27th, 2016
180
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 30.74 KB | None | 0 0
raw download clone embed print report
  1. firewall {
  2. all-ping enable
  3. broadcast-ping disable
  4. group {
  5. address-group authorized_guests {
  6. description "authorized guests MAC addresses"
  7. }
  8. address-group guest_allow_addresses {
  9. description "allow addresses for guests"
  10. }
  11. address-group guest_allow_dns_servers {
  12. description "allow dns servers for guests"
  13. }
  14. address-group guest_portal_address {
  15. description "guest portal address"
  16. }
  17. address-group guest_restricted_addresses {
  18. address 192.168.0.0/16
  19. address 172.16.0.0/12
  20. address 10.0.0.0/8
  21. description "restricted addresses for guests"
  22. }
  23. address-group unifi_controller_addresses {
  24. address 192.168.1.6
  25. }
  26. address-group voip_sip_server_addresses {
  27. description "VOIP SIP server addresses"
  28. }
  29. network-group captive_portal_subnets {
  30. description "captive portal subnets"
  31. }
  32. network-group corporate_network {
  33. description "corporate subnets"
  34. network 192.168.1.0/24
  35. }
  36. network-group guest_allow_subnets {
  37. description "allow subnets for guests"
  38. }
  39. network-group guest_network {
  40. description "guest subnets"
  41. }
  42. network-group guest_restricted_subnets {
  43. description "restricted subnets for guests"
  44. }
  45. network-group remote_user_vpn_network {
  46. description remote_user_vpn_network
  47. network 192.168.1.0/24
  48. }
  49. network-group voip_network {
  50. description "voip subnets"
  51. }
  52. port-group guest_portal_ports {
  53. description "guest portal ports"
  54. }
  55. port-group guest_portal_redirector_ports {
  56. description "guest portal redirector ports"
  57. port 39080
  58. }
  59. port-group unifi_controller_ports-tcp {
  60. description "unifi tcp ports"
  61. port 8080
  62. }
  63. port-group unifi_controller_ports-udp {
  64. description "unifi udp ports"
  65. port 3478
  66. }
  67. port-group voip_sip_server_ports {
  68. description "voip sip server udp ports"
  69. port 5060
  70. port 10000-10100
  71. }
  72. }
  73. name AUTHORIZED_GUESTS {
  74. default-action drop
  75. description "authorization check packets from guest network"
  76. }
  77. name GUEST_IN {
  78. default-action accept
  79. description "packets from guest network"
  80. rule 3001 {
  81. action accept
  82. description "allow DNS packets to external name servers"
  83. destination {
  84. port 53
  85. }
  86. protocol udp
  87. }
  88. rule 3002 {
  89. action accept
  90. description "allow packets to captive portal"
  91. destination {
  92. group {
  93. network-group captive_portal_subnets
  94. }
  95. port 443
  96. }
  97. protocol tcp
  98. }
  99. rule 3003 {
  100. action accept
  101. description "allow packets to allow subnets"
  102. destination {
  103. group {
  104. address-group guest_allow_addresses
  105. }
  106. }
  107. }
  108. rule 3004 {
  109. action drop
  110. description "drop packets to restricted subnets"
  111. destination {
  112. group {
  113. address-group guest_restricted_addresses
  114. }
  115. }
  116. }
  117. rule 3005 {
  118. action drop
  119. description "drop packets to intranet"
  120. destination {
  121. group {
  122. network-group corporate_network
  123. }
  124. }
  125. }
  126. rule 3006 {
  127. action drop
  128. description "drop packets to voip"
  129. destination {
  130. group {
  131. network-group voip_network
  132. }
  133. }
  134. }
  135. rule 3007 {
  136. action drop
  137. description "drop packets to remote user"
  138. destination {
  139. group {
  140. network-group remote_user_vpn_network
  141. }
  142. }
  143. }
  144. rule 3008 {
  145. action drop
  146. description "authorized guests white list"
  147. destination {
  148. group {
  149. address-group authorized_guests
  150. }
  151. }
  152. }
  153. }
  154. name GUEST_LOCAL {
  155. default-action drop
  156. description "packets from guest network to gateway"
  157. rule 3001 {
  158. action accept
  159. description "allow DNS"
  160. destination {
  161. port 53
  162. }
  163. protocol udp
  164. }
  165. rule 3002 {
  166. action accept
  167. description "allow ICMP"
  168. protocol icmp
  169. }
  170. }
  171. name GUEST_OUT {
  172. default-action accept
  173. description "packets forward to guest network"
  174. }
  175. name LAN_IN {
  176. default-action accept
  177. description "packets from intranet"
  178. rule 3001 {
  179. action accept
  180. description "packets from unifi to voip"
  181. destination {
  182. group {
  183. network-group voip_network
  184. }
  185. }
  186. source {
  187. group {
  188. address-group unifi_controller_addresses
  189. }
  190. }
  191. }
  192. rule 3002 {
  193. action drop
  194. description "packets from intranet to voip"
  195. destination {
  196. group {
  197. network-group voip_network
  198. }
  199. }
  200. }
  201. rule 6001 {
  202. action accept
  203. description "accounting defined network 192.168.1.0/24"
  204. source {
  205. address 192.168.1.0/24
  206. }
  207. }
  208. }
  209. name LAN_LOCAL {
  210. default-action accept
  211. description "packets from intranet to gateway"
  212. }
  213. name LAN_OUT {
  214. default-action accept
  215. description "packets forward to intranet"
  216. rule 6001 {
  217. action accept
  218. description "accounting defined network 192.168.1.0/24"
  219. destination {
  220. address 192.168.1.0/24
  221. }
  222. }
  223. }
  224. name VOIP_IN {
  225. default-action accept
  226. description "packets from voip to intranet"
  227. rule 3001 {
  228. action accept
  229. description "icmp to unifi"
  230. destination {
  231. group {
  232. address-group unifi_controller_addresses
  233. }
  234. }
  235. protocol icmp
  236. }
  237. rule 3002 {
  238. action accept
  239. description "inform to unifi"
  240. destination {
  241. group {
  242. address-group unifi_controller_addresses
  243. port-group unifi_controller_ports-tcp
  244. }
  245. }
  246. protocol tcp
  247. }
  248. rule 3003 {
  249. action accept
  250. description "stun to unifi"
  251. destination {
  252. group {
  253. address-group unifi_controller_addresses
  254. port-group unifi_controller_ports-udp
  255. }
  256. }
  257. protocol udp
  258. }
  259. rule 3004 {
  260. action accept
  261. description "allow established/related sessions"
  262. destination {
  263. group {
  264. address-group unifi_controller_addresses
  265. }
  266. }
  267. state {
  268. established enable
  269. invalid disable
  270. new disable
  271. related enable
  272. }
  273. }
  274. rule 3005 {
  275. action drop
  276. description "drop invalid state"
  277. destination {
  278. group {
  279. address-group unifi_controller_addresses
  280. }
  281. }
  282. state {
  283. established disable
  284. invalid enable
  285. new disable
  286. related disable
  287. }
  288. }
  289. rule 3006 {
  290. action drop
  291. description "drop VoIP to LAN traffic"
  292. destination {
  293. group {
  294. network-group corporate_network
  295. }
  296. }
  297. }
  298. rule 3007 {
  299. action drop
  300. description "drop VoIP to GUEST traffic"
  301. destination {
  302. group {
  303. network-group guest_network
  304. }
  305. }
  306. }
  307. rule 3008 {
  308. action drop
  309. description "drop VoIP to REMOTE USER traffic"
  310. destination {
  311. group {
  312. network-group remote_user_vpn_network
  313. }
  314. }
  315. }
  316. }
  317. name VOIP_LOCAL {
  318. default-action drop
  319. description "packets from voip to gateway"
  320. rule 3001 {
  321. action accept
  322. description "allow DNS"
  323. destination {
  324. port 53
  325. }
  326. protocol udp
  327. }
  328. rule 3002 {
  329. action accept
  330. description "allow ICMP"
  331. protocol icmp
  332. }
  333. rule 3003 {
  334. action accept
  335. description "allow established/related sessions"
  336. state {
  337. established enable
  338. invalid disable
  339. new disable
  340. related enable
  341. }
  342. }
  343. rule 3004 {
  344. action drop
  345. description "drop invalid state"
  346. state {
  347. established disable
  348. invalid enable
  349. new disable
  350. related disable
  351. }
  352. }
  353. }
  354. name VOIP_OUT {
  355. default-action accept
  356. description "packets forward to voip"
  357. }
  358. name WAN_IN {
  359. default-action drop
  360. description "packets from internet to intranet"
  361. rule 3001 {
  362. action accept
  363. description "allow established/related sessions"
  364. state {
  365. established enable
  366. invalid disable
  367. new disable
  368. related enable
  369. }
  370. }
  371. rule 3002 {
  372. action drop
  373. description "drop invalid state"
  374. state {
  375. established disable
  376. invalid enable
  377. new disable
  378. related disable
  379. }
  380. }
  381. rule 3003 {
  382. action accept
  383. description "PortForward [Unifi Controller]"
  384. destination {
  385. address 192.168.1.6
  386. port 8443
  387. }
  388. log enable
  389. protocol tcp_udp
  390. }
  391. rule 3004 {
  392. action accept
  393. description "PortForward [test]"
  394. destination {
  395. address 192.167.1.1
  396. port 323
  397. }
  398. log enable
  399. protocol tcp_udp
  400. }
  401. }
  402. name WAN_LOCAL {
  403. default-action drop
  404. description "packets from internet to gateway"
  405. rule 20 {
  406. action accept
  407. description "VPN IKE remote VPN server"
  408. destination {
  409. port 500
  410. }
  411. log enable
  412. protocol udp
  413. }
  414. rule 21 {
  415. action accept
  416. description "VPN L2TP remote VPN server"
  417. destination {
  418. port 1701
  419. }
  420. log enable
  421. protocol udp
  422. }
  423. rule 22 {
  424. action accept
  425. description "VPN ESP remote VPN server"
  426. log enable
  427. protocol 50
  428. }
  429. rule 23 {
  430. action accept
  431. description "VPN NAT-T remote VPN server"
  432. destination {
  433. port 4500
  434. }
  435. log enable
  436. protocol udp
  437. }
  438. rule 3001 {
  439. action accept
  440. description "allow established/related sessions"
  441. state {
  442. established enable
  443. invalid disable
  444. new disable
  445. related enable
  446. }
  447. }
  448. rule 3002 {
  449. action drop
  450. description "drop invalid state"
  451. state {
  452. established disable
  453. invalid enable
  454. new disable
  455. related disable
  456. }
  457. }
  458. rule 3003 {
  459. action accept
  460. description "allow ICMP"
  461. protocol icmp
  462. }
  463. }
  464. options {
  465. mss-clamp {
  466. interface-type pppoe
  467. interface-type pptp
  468. mss 1412
  469. }
  470. }
  471. receive-redirects disable
  472. send-redirects enable
  473. syn-cookies enable
  474. }
  475. interfaces {
  476. ethernet eth0 {
  477. vif 6 {
  478. firewall {
  479. in {
  480. name WAN_IN
  481. }
  482. local {
  483. name WAN_LOCAL
  484. }
  485. }
  486. pppoe 2 {
  487. default-route none
  488. firewall {
  489. in {
  490. name WAN_IN
  491. }
  492. local {
  493. name WAN_LOCAL
  494. }
  495. }
  496. password ****************
  497. user-id xx-xx-xx-xx-xx-xx@internet
  498. }
  499. }
  500. }
  501. ethernet eth1 {
  502. address 192.168.1.1/24
  503. firewall {
  504. in {
  505. name LAN_IN
  506. }
  507. local {
  508. name LAN_LOCAL
  509. }
  510. out {
  511. name LAN_OUT
  512. }
  513. }
  514. }
  515. ethernet eth2 {
  516. disable
  517. }
  518. loopback lo {
  519. }
  520. }
  521. port-forward {
  522. auto-firewall disable
  523. hairpin-nat enable
  524. lan-interface eth1
  525. rule 3001 {
  526. description "Unifi Controller"
  527. forward-to {
  528. address 192.168.1.6
  529. }
  530. original-port 8443
  531. protocol tcp_udp
  532. }
  533. rule 3002 {
  534. description test
  535. forward-to {
  536. address 192.167.1.1
  537. }
  538. original-port 323
  539. protocol tcp_udp
  540. }
  541. wan-interface pppoe2
  542. }
  543. protocols {
  544. static {
  545. interface-route 0.0.0.0/0 {
  546. next-hop-interface pppoe2 {
  547. distance 1
  548. }
  549. }
  550. }
  551. }
  552. service {
  553. dhcp-server {
  554. disabled false
  555. hostfile-update enable
  556. shared-network-name LAN_192.168.1.0-24 {
  557. authoritative enable
  558. description vlan1
  559. subnet 192.168.1.0/24 {
  560. default-router 192.168.1.1
  561. dns-server 192.168.1.1
  562. lease 86400
  563. start 192.168.1.6 {
  564. stop 192.168.1.254
  565. }
  566. static-mapping 18-b4-30-13-f4-c1 {
  567. ip-address 192.168.1.9
  568. mac-address 18:b4:30:13:f4:c1
  569. }
  570. static-mapping 80-ea-96-e6-09-2a {
  571. ip-address 192.168.1.2
  572. mac-address 80:ea:96:e6:09:2a
  573. }
  574. static-mapping b8-27-eb-4d-b3-b1 {
  575. ip-address 192.168.1.6
  576. mac-address b8:27:eb:4d:b3:b1
  577. }
  578. }
  579. }
  580. }
  581. dns {
  582. forwarding {
  583. cache-size 500
  584. except-interface pppoe2
  585. options host-record=unifi,192.168.1.6
  586. }
  587. }
  588. gui {
  589. https-port 443
  590. }
  591. lldp {
  592. interface eth0 {
  593. disable
  594. }
  595. }
  596. nat {
  597. rule 6001 {
  598. description "MASQ corporate_network to WAN"
  599. log disable
  600. outbound-interface pppoe2
  601. protocol all
  602. source {
  603. group {
  604. network-group corporate_network
  605. }
  606. }
  607. type masquerade
  608. }
  609. rule 6002 {
  610. description "MASQ voip_network to WAN"
  611. log disable
  612. outbound-interface pppoe2
  613. :
  614. lease 86400
  615. start 192.168.1.6 {
  616. stop 192.168.1.254
  617. }
  618. static-mapping 18-b4-30-13-f4-c1 {
  619. ip-address 192.168.1.9
  620. mac-address 18:b4:30:13:f4:c1
  621. }
  622. static-mapping 80-ea-96-e6-09-2a {
  623. ip-address 192.168.1.2
  624. mac-address 80:ea:96:e6:09:2a
  625. }
  626. static-mapping b8-27-eb-4d-b3-b1 {
  627. ip-address 192.168.1.6
  628. mac-address b8:27:eb:4d:b3:b1
  629. }
  630. }
  631. }
  632. }
  633. dns {
  634. forwarding {
  635. cache-size 500
  636. except-interface pppoe2
  637. options host-record=unifi,192.168.1.6
  638. }
  639. }
  640. gui {
  641. https-port 443
  642. }
  643. lldp {
  644. interface eth0 {
  645. disable
  646. }
  647. }
  648. nat {
  649. rule 6001 {
  650. description "MASQ corporate_network to WAN"
  651. log disable
  652. outbound-interface pppoe2
  653. protocol all
  654. source {
  655. group {
  656. network-group corporate_network
  657. }
  658. }
  659. type masquerade
  660. }
  661. rule 6002 {
  662. description "MASQ voip_network to WAN"
  663. log disable
  664. outbound-interface pppoe2
  665. protocol all
  666. :
  667. lease 86400
  668. start 192.168.1.6 {
  669. stop 192.168.1.254
  670. }
  671. static-mapping 18-b4-30-13-f4-c1 {
  672. ip-address 192.168.1.9
  673. mac-address 18:b4:30:13:f4:c1
  674. }
  675. static-mapping 80-ea-96-e6-09-2a {
  676. ip-address 192.168.1.2
  677. mac-address 80:ea:96:e6:09:2a
  678. }
  679. static-mapping b8-27-eb-4d-b3-b1 {
  680. ip-address 192.168.1.6
  681. mac-address b8:27:eb:4d:b3:b1
  682. }
  683. }
  684. }
  685. }
  686. dns {
  687. forwarding {
  688. cache-size 500
  689. except-interface pppoe2
  690. options host-record=unifi,192.168.1.6
  691. }
  692. }
  693. gui {
  694. https-port 443
  695. }
  696. lldp {
  697. interface eth0 {
  698. disable
  699. }
  700. }
  701. nat {
  702. rule 6001 {
  703. description "MASQ corporate_network to WAN"
  704. log disable
  705. outbound-interface pppoe2
  706. protocol all
  707. source {
  708. group {
  709. network-group corporate_network
  710. }
  711. }
  712. type masquerade
  713. }
  714. rule 6002 {
  715. description "MASQ voip_network to WAN"
  716. log disable
  717. outbound-interface pppoe2
  718. protocol all
  719. source {
  720. group {
  721. :
  722. lease 86400
  723. start 192.168.1.6 {
  724. stop 192.168.1.254
  725. }
  726. static-mapping 18-b4-30-13-f4-c1 {
  727. ip-address 192.168.1.9
  728. mac-address 18:b4:30:13:f4:c1
  729. }
  730. static-mapping 80-ea-96-e6-09-2a {
  731. ip-address 192.168.1.2
  732. mac-address 80:ea:96:e6:09:2a
  733. }
  734. static-mapping b8-27-eb-4d-b3-b1 {
  735. ip-address 192.168.1.6
  736. mac-address b8:27:eb:4d:b3:b1
  737. }
  738. }
  739. }
  740. }
  741. dns {
  742. forwarding {
  743. cache-size 500
  744. except-interface pppoe2
  745. options host-record=unifi,192.168.1.6
  746. }
  747. }
  748. gui {
  749. https-port 443
  750. }
  751. lldp {
  752. interface eth0 {
  753. disable
  754. }
  755. }
  756. nat {
  757. rule 6001 {
  758. description "MASQ corporate_network to WAN"
  759. log disable
  760. outbound-interface pppoe2
  761. protocol all
  762. source {
  763. group {
  764. network-group corporate_network
  765. }
  766. }
  767. type masquerade
  768. }
  769. rule 6002 {
  770. description "MASQ voip_network to WAN"
  771. log disable
  772. outbound-interface pppoe2
  773. protocol all
  774. source {
  775. group {
  776. network-group voip_network
  777. }
  778. }
  779. type masquerade
  780. :
  781. lease 86400
  782. start 192.168.1.6 {
  783. stop 192.168.1.254
  784. }
  785. static-mapping 18-b4-30-13-f4-c1 {
  786. ip-address 192.168.1.9
  787. mac-address 18:b4:30:13:f4:c1
  788. }
  789. static-mapping 80-ea-96-e6-09-2a {
  790. ip-address 192.168.1.2
  791. mac-address 80:ea:96:e6:09:2a
  792. }
  793. static-mapping b8-27-eb-4d-b3-b1 {
  794. ip-address 192.168.1.6
  795. mac-address b8:27:eb:4d:b3:b1
  796. }
  797. }
  798. }
  799. }
  800. dns {
  801. forwarding {
  802. cache-size 500
  803. except-interface pppoe2
  804. options host-record=unifi,192.168.1.6
  805. }
  806. }
  807. gui {
  808. https-port 443
  809. }
  810. lldp {
  811. interface eth0 {
  812. disable
  813. }
  814. }
  815. nat {
  816. rule 6001 {
  817. description "MASQ corporate_network to WAN"
  818. log disable
  819. outbound-interface pppoe2
  820. protocol all
  821. source {
  822. group {
  823. network-group corporate_network
  824. }
  825. }
  826. type masquerade
  827. }
  828. rule 6002 {
  829. description "MASQ voip_network to WAN"
  830. log disable
  831. outbound-interface pppoe2
  832. protocol all
  833. source {
  834. group {
  835. network-group voip_network
  836. }
  837. }
  838. type masquerade
  839. }
  840. rule 6003 {
  841. description "MASQ remote_user_vpn_network to WAN"
  842. log disable
  843. outbound-interface pppoe2
  844. :
  845. lease 86400
  846. start 192.168.1.6 {
  847. stop 192.168.1.254
  848. }
  849. static-mapping 18-b4-30-13-f4-c1 {
  850. ip-address 192.168.1.9
  851. mac-address 18:b4:30:13:f4:c1
  852. }
  853. static-mapping 80-ea-96-e6-09-2a {
  854. ip-address 192.168.1.2
  855. mac-address 80:ea:96:e6:09:2a
  856. }
  857. static-mapping b8-27-eb-4d-b3-b1 {
  858. ip-address 192.168.1.6
  859. mac-address b8:27:eb:4d:b3:b1
  860. }
  861. }
  862. }
  863. }
  864. dns {
  865. forwarding {
  866. cache-size 500
  867. except-interface pppoe2
  868. options host-record=unifi,192.168.1.6
  869. }
  870. }
  871. gui {
  872. https-port 443
  873. }
  874. lldp {
  875. interface eth0 {
  876. disable
  877. }
  878. }
  879. nat {
  880. rule 6001 {
  881. description "MASQ corporate_network to WAN"
  882. log disable
  883. outbound-interface pppoe2
  884. protocol all
  885. source {
  886. group {
  887. network-group corporate_network
  888. }
  889. }
  890. type masquerade
  891. }
  892. rule 6002 {
  893. description "MASQ voip_network to WAN"
  894. log disable
  895. outbound-interface pppoe2
  896. protocol all
  897. source {
  898. group {
  899. network-group voip_network
  900. }
  901. }
  902. type masquerade
  903. }
  904. rule 6003 {
  905. description "MASQ remote_user_vpn_network to WAN"
  906. log disable
  907. outbound-interface pppoe2
  908. protocol all
  909. source {
  910. group {
  911. :
  912. lease 86400
  913. start 192.168.1.6 {
  914. stop 192.168.1.254
  915. }
  916. static-mapping 18-b4-30-13-f4-c1 {
  917. ip-address 192.168.1.9
  918. mac-address 18:b4:30:13:f4:c1
  919. }
  920. static-mapping 80-ea-96-e6-09-2a {
  921. ip-address 192.168.1.2
  922. mac-address 80:ea:96:e6:09:2a
  923. }
  924. static-mapping b8-27-eb-4d-b3-b1 {
  925. ip-address 192.168.1.6
  926. mac-address b8:27:eb:4d:b3:b1
  927. }
  928. }
  929. }
  930. }
  931. dns {
  932. forwarding {
  933. cache-size 500
  934. except-interface pppoe2
  935. options host-record=unifi,192.168.1.6
  936. }
  937. }
  938. gui {
  939. https-port 443
  940. }
  941. lldp {
  942. interface eth0 {
  943. disable
  944. }
  945. }
  946. nat {
  947. rule 6001 {
  948. description "MASQ corporate_network to WAN"
  949. log disable
  950. outbound-interface pppoe2
  951. protocol all
  952. source {
  953. group {
  954. network-group corporate_network
  955. }
  956. }
  957. type masquerade
  958. }
  959. rule 6002 {
  960. description "MASQ voip_network to WAN"
  961. log disable
  962. outbound-interface pppoe2
  963. protocol all
  964. source {
  965. group {
  966. network-group voip_network
  967. }
  968. }
  969. type masquerade
  970. }
  971. rule 6003 {
  972. description "MASQ remote_user_vpn_network to WAN"
  973. log disable
  974. outbound-interface pppoe2
  975. protocol all
  976. source {
  977. group {
  978. network-group remote_user_vpn_network
  979. :
  980. lease 86400
  981. start 192.168.1.6 {
  982. stop 192.168.1.254
  983. }
  984. static-mapping 18-b4-30-13-f4-c1 {
  985. ip-address 192.168.1.9
  986. mac-address 18:b4:30:13:f4:c1
  987. }
  988. static-mapping 80-ea-96-e6-09-2a {
  989. ip-address 192.168.1.2
  990. mac-address 80:ea:96:e6:09:2a
  991. }
  992. static-mapping b8-27-eb-4d-b3-b1 {
  993. ip-address 192.168.1.6
  994. mac-address b8:27:eb:4d:b3:b1
  995. }
  996. }
  997. }
  998. }
  999. dns {
  1000. forwarding {
  1001. cache-size 500
  1002. except-interface pppoe2
  1003. options host-record=unifi,192.168.1.6
  1004. }
  1005. }
  1006. gui {
  1007. https-port 443
  1008. }
  1009. lldp {
  1010. interface eth0 {
  1011. disable
  1012. }
  1013. }
  1014. nat {
  1015. rule 6001 {
  1016. description "MASQ corporate_network to WAN"
  1017. log disable
  1018. outbound-interface pppoe2
  1019. protocol all
  1020. source {
  1021. group {
  1022. network-group corporate_network
  1023. }
  1024. }
  1025. type masquerade
  1026. }
  1027. rule 6002 {
  1028. description "MASQ voip_network to WAN"
  1029. log disable
  1030. outbound-interface pppoe2
  1031. protocol all
  1032. source {
  1033. group {
  1034. network-group voip_network
  1035. }
  1036. }
  1037. type masquerade
  1038. }
  1039. rule 6003 {
  1040. description "MASQ remote_user_vpn_network to WAN"
  1041. log disable
  1042. outbound-interface pppoe2
  1043. protocol all
  1044. source {
  1045. group {
  1046. network-group remote_user_vpn_network
  1047. }
  1048. }
  1049. type masquerade
  1050. }
  1051. rule 6004 {
  1052. description "MASQ guest_network to WAN"
  1053. log disable
  1054. outbound-interface pppoe2
  1055. protocol all
  1056. source {
  1057. group {
  1058. network-group guest_network
  1059. }
  1060. }
  1061. type masquerade
  1062. }
  1063. }
  1064. ssh {
  1065. port 22
  1066. protocol-version v2
  1067. }
  1068. }
  1069. system {
  1070. host-name UniFiSecurityGateway
  1071. login {
  1072. user user {
  1073. authentication {
  1074. encrypted-password ****************
  1075. }
  1076. level admin
  1077. }
  1078. }
  1079. ntp {
  1080. server 0.ubnt.pool.ntp.org {
  1081. }
  1082. }
  1083. offload {
  1084. ipsec enable
  1085. ipv4 {
  1086. forwarding enable
  1087. pppoe enable
  1088. vlan enable
  1089. }
  1090. ipv6 {
  1091. forwarding enable
  1092. vlan enable
  1093. }
  1094. }
  1095. static-host-mapping {
  1096. host-name setup.ubnt.com {
  1097. alias setup
  1098. inet 192.168.1.1
  1099. }
  1100. }
  1101. syslog {
  1102. global {
  1103. facility all {
  1104. level notice
  1105. }
  1106. facility protocols {
  1107. level debug
  1108. }
  1109. }
  1110. }
  1111. time-zone Europe/Amsterdam
  1112. traffic-analysis {
  1113. dpi enable
  1114. }
  1115. }
  1116. unifi {
  1117. mgmt {
  1118. cfgversion 9937241b96ea73bc
  1119. }
  1120. }
  1121. vpn {
  1122. ipsec {
  1123. auto-firewall-nat-exclude enable
  1124. ipsec-interfaces {
  1125. interface pppoe0
  1126. }
  1127. nat-networks {
  1128. allowed-network 0.0.0.0/0 {
  1129. }
  1130. }
  1131. nat-traversal enable
  1132. }
  1133. l2tp {
  1134. remote-access {
  1135. authentication {
  1136. local-users {
  1137. username user {
  1138. password ****************
  1139. }
  1140. }
  1141. mode local
  1142. }
  1143. client-ip-pool {
  1144. start 192.168.1.100
  1145. stop 192.168.1.150
  1146. }
  1147. dns-servers {
  1148. server-1 8.8.4.4
  1149. server-2 8.8.8.8
  1150. }
  1151. ipsec-settings {
  1152. authentication {
  1153. mode pre-shared-secret
  1154. pre-shared-secret ****************
  1155. }
  1156. ike-lifetime 3600
  1157. }
  1158. outside-address xxx.xx.xx.xx
  1159. }
  1160. }
  1161. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!