API tools faq
paste
HellStorm666

edgerouter

HellStorm666
Feb 17th, 2016
526
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 16.36 KB | None | 0 0
raw download clone embed print report
  1. firewall {
  2. all-ping enable
  3. broadcast-ping disable
  4. group {
  5. network-group BOGONS {
  6. description "Invalid WAN networks"
  7. network 10.0.0.0/8
  8. network 100.64.0.0/10
  9. network 127.0.0.0/8
  10. network 169.254.0.0/16
  11. network 172.16.0.0/12
  12. network 192.0.0.0/24
  13. network 192.0.2.0/24
  14. network 192.168.0.0/16
  15. network 198.18.0.0/15
  16. network 198.51.100.0/24
  17. network 203.0.113.0/24
  18. network 224.0.0.0/3
  19. }
  20. }
  21. ipv6-name WANv6_IN {
  22. default-action drop
  23. description "WAN inbound traffic forwarded to LAN"
  24. rule 10 {
  25. action accept
  26. description "Allow established/related sessions"
  27. state {
  28. established enable
  29. related enable
  30. }
  31. }
  32. rule 20 {
  33. action drop
  34. description "Drop invalid state"
  35. state {
  36. invalid enable
  37. }
  38. }
  39. }
  40. ipv6-name WANv6_LOCAL {
  41. default-action drop
  42. description "WAN inbound traffic to the router"
  43. rule 10 {
  44. action accept
  45. description "Allow established/related sessions"
  46. state {
  47. established enable
  48. related enable
  49. }
  50. }
  51. rule 20 {
  52. action drop
  53. description "Drop invalid state"
  54. state {
  55. invalid enable
  56. }
  57. }
  58. rule 30 {
  59. action accept
  60. description "Allow IPv6 ICMP"
  61. protocol ipv6-icmp
  62. }
  63. rule 40 {
  64. action accept
  65. description "allow dhcpv6"
  66. destination {
  67. port 546
  68. }
  69. protocol udp
  70. source {
  71. port 547
  72. }
  73. }
  74. }
  75. ipv6-receive-redirects disable
  76. ipv6-src-route disable
  77. ip-src-route disable
  78. log-martians enable
  79. modify pppoe-out {
  80. }
  81. name WAN_IN {
  82. default-action drop
  83. description "WAN to internal"
  84. enable-default-log
  85. rule 1 {
  86. action accept
  87. description "Allow established/related"
  88. log disable
  89. protocol all
  90. state {
  91. established enable
  92. related enable
  93. }
  94. }
  95. rule 3 {
  96. action drop
  97. description "Drop invalid state"
  98. log disable
  99. protocol all
  100. state {
  101. invalid enable
  102. }
  103. }
  104. rule 4 {
  105. action drop
  106. description "drop BOGON source"
  107. log disable
  108. protocol all
  109. source {
  110. group {
  111. network-group BOGONS
  112. }
  113. }
  114. }
  115. }
  116. name WAN_LOCAL {
  117. default-action drop
  118. description "WAN to router"
  119. enable-default-log
  120. rule 10 {
  121. action accept
  122. description "Allow established/related"
  123. log disable
  124. protocol all
  125. state {
  126. established enable
  127. invalid disable
  128. new disable
  129. related enable
  130. }
  131. }
  132. rule 20 {
  133. action drop
  134. description "Drop invalid"
  135. log disable
  136. protocol all
  137. state {
  138. established disable
  139. invalid enable
  140. new disable
  141. related disable
  142. }
  143. }
  144. }
  145. options {
  146. mss-clamp {
  147. interface-type pppoe
  148. interface-type pptp
  149. interface-type tun
  150. interface-type vti
  151. mss 1412
  152. }
  153. }
  154. receive-redirects disable
  155. send-redirects enable
  156. source-validation disable
  157. syn-cookies enable
  158. }
  159. interfaces {
  160. ethernet eth0 {
  161. description WAN
  162. duplex auto
  163. mtu 1532
  164. poe {
  165. output off
  166. }
  167. speed auto
  168. vif 4 {
  169. address dhcp
  170. description "KPN TV"
  171. dhcp-options {
  172. client-option "send vendor-class-identifier "IPTV_RG";"
  173. client-option "request subnet-mask, routers, rfc3442-classless-static-routes;"
  174. default-route update
  175. default-route-distance 210
  176. name-server update
  177. }
  178. mtu 1500
  179. }
  180. vif 6 {
  181. description "KPN Internet"
  182. mtu 1516
  183. pppoe 0 {
  184. default-route auto
  185. dhcpv6-pd {
  186. no-dns
  187. pd 0 {
  188. interface switch0 {
  189. prefix-id :1
  190. service slaac
  191. }
  192. prefix-length /48
  193. }
  194. rapid-commit disable
  195. }
  196. firewall {
  197. in {
  198. ipv6-name WANv6_IN
  199. }
  200. local {
  201. ipv6-name WANv6_LOCAL
  202. }
  203. }
  204. idle-timeout 180
  205. ipv6 {
  206. address {
  207. autoconf
  208. }
  209. dup-addr-detect-transmits 1
  210. enable {
  211. }
  212. }
  213. mtu 1500
  214. name-server auto
  215. password ppp
  216. user-id **masked**@internet
  217. }
  218. }
  219. }
  220. ethernet eth1 {
  221. address 192.168.1.1/24
  222. description Local
  223. duplex auto
  224. poe {
  225. output off
  226. }
  227. speed auto
  228. }
  229. ethernet eth2 {
  230. description "Local 2"
  231. duplex auto
  232. poe {
  233. output off
  234. }
  235. speed auto
  236. }
  237. ethernet eth3 {
  238. description UAP-AC-LR
  239. duplex auto
  240. poe {
  241. output 24v
  242. }
  243. speed auto
  244. }
  245. ethernet eth4 {
  246. description UAP-AC-Lite
  247. duplex auto
  248. poe {
  249. output 24v
  250. }
  251. speed auto
  252. }
  253. loopback lo {
  254. }
  255. switch switch0 {
  256. address 192.168.2.1/24
  257. address **masked**:1::1/64
  258. description "Local 2"
  259. firewall {
  260. out {
  261. }
  262. }
  263. ipv6 {
  264. dup-addr-detect-transmits 1
  265. router-advert {
  266. cur-hop-limit 64
  267. link-mtu 0
  268. managed-flag false
  269. max-interval 600
  270. name-server 2620:0:ccc::2
  271. name-server 2001:4860:4860::8888
  272. other-config-flag false
  273. prefix ::/64 {
  274. autonomous-flag true
  275. on-link-flag true
  276. valid-lifetime 2592000
  277. }
  278. radvd-options "RDNSS 2620:0:ccc::2 2001:4860:4860::8888 {};"
  279. reachable-time 0
  280. retrans-timer 0
  281. send-advert true
  282. }
  283. }
  284. mtu 1500
  285. switch-port {
  286. interface eth2
  287. interface eth3
  288. interface eth4
  289. }
  290. }
  291. }
  292. port-forward {
  293. auto-firewall enable
  294. hairpin-nat enable
  295. lan-interface switch0
  296. rule 1 {
  297. description "VPN PPTP"
  298. forward-to {
  299. address 192.168.2.10
  300. }
  301. original-port 1723
  302. protocol tcp_udp
  303. }
  304. rule 2 {
  305. description Nzbget
  306. forward-to {
  307. address 192.168.2.10
  308. }
  309. original-port 6791
  310. protocol tcp
  311. }
  312. rule 3 {
  313. description Sonarr
  314. forward-to {
  315. address 192.168.2.10
  316. }
  317. original-port 9898,8989
  318. protocol tcp
  319. }
  320. rule 4 {
  321. description Transmission
  322. forward-to {
  323. address 192.168.2.10
  324. }
  325. original-port 9091
  326. protocol tcp
  327. }
  328. rule 5 {
  329. description "Couch potato "
  330. forward-to {
  331. address 192.168.2.10
  332. }
  333. original-port 8082
  334. protocol tcp
  335. }
  336. rule 6 {
  337. description Headphones
  338. forward-to {
  339. address 192.168.2.10
  340. }
  341. original-port 8181
  342. protocol tcp
  343. }
  344. rule 7 {
  345. description Synology
  346. forward-to {
  347. address 192.168.2.10
  348. }
  349. original-port 5001
  350. protocol tcp
  351. }
  352. rule 8 {
  353. description "Ftp sftp"
  354. forward-to {
  355. address 192.168.2.10
  356. }
  357. original-port 55536-55543
  358. protocol tcp_udp
  359. }
  360. rule 9 {
  361. description "L2TP/IPsec VPN"
  362. forward-to {
  363. address 192.168.2.10
  364. }
  365. original-port 1701,500,4500
  366. protocol tcp_udp
  367. }
  368. rule 10 {
  369. description "SFTP SSH"
  370. forward-to {
  371. address 192.168.2.10
  372. port 22
  373. }
  374. original-port 2222
  375. protocol tcp_udp
  376. }
  377. rule 11 {
  378. description FTP
  379. forward-to {
  380. address 192.168.2.10
  381. port 21
  382. }
  383. original-port 2221
  384. protocol tcp_udp
  385. }
  386. rule 12 {
  387. description Xbox
  388. forward-to {
  389. address 192.168.2.23
  390. }
  391. original-port 53,88,500,3074,3544,4500
  392. protocol tcp_udp
  393. }
  394. wan-interface pppoe0
  395. }
  396. protocols {
  397. igmp-proxy {
  398. interface eth0.4 {
  399. alt-subnet 0.0.0.0/0
  400. role upstream
  401. threshold 1
  402. }
  403. interface eth1 {
  404. alt-subnet 0.0.0.0/0
  405. role downstream
  406. threshold 1
  407. }
  408. }
  409. static {
  410. interface-route 0.0.0.0/0 {
  411. next-hop-interface pppoe0 {
  412. }
  413. }
  414. interface-route6 ::/0 {
  415. next-hop-interface pppoe0 {
  416. }
  417. }
  418. route 213.75.112.0/21 {
  419. next-hop 10.88.60.1 {
  420. }
  421. }
  422. }
  423. }
  424. service {
  425. dhcp-server {
  426. disabled false
  427. global-parameters "option vendor-class-identifier code 60 = string;"
  428. global-parameters "option broadcast-address code 28 = ip-address;"
  429. hostfile-update disable
  430. shared-network-name LAN1 {
  431. authoritative disable
  432. subnet 192.168.1.0/24 {
  433. default-router 192.168.1.1
  434. dns-server 192.168.1.1
  435. lease 86400
  436. start 192.168.1.38 {
  437. stop 192.168.1.243
  438. }
  439. subnet-parameters "option vendor-class-identifier "IPTV_RG ";"
  440. subnet-parameters "option broadcast-address 192.168.1.255;"
  441. }
  442. }
  443. shared-network-name LAN2 {
  444. authoritative disable
  445. subnet 192.168.2.0/24 {
  446. default-router 192.168.2.1
  447. dns-server 192.168.2.10
  448. dns-server 192.168.2.1
  449. domain-name thuis
  450. lease 86400
  451. start 192.168.2.50 {
  452. stop 192.168.2.250
  453. }
  454. static-mapping CamVoor {
  455. ip-address 192.168.2.11
  456. mac-address 00:12:13:17:4b:18
  457. }
  458. **Lading static maps**
  459. unifi-controller 192.168.2.5
  460. }
  461. }
  462. }
  463. dns {
  464. forwarding {
  465. cache-size 0
  466. listen-on switch0
  467. name-server 208.67.222.222
  468. name-server 208.67.220.220
  469. name-server 8.8.8.8
  470. name-server 2620:0:ccc::2
  471. name-server 2620:0:ccd::2
  472. options localise-queries
  473. options listen-address=192.168.1.1
  474. options listen-address=192.168.2.1
  475. }
  476. }
  477. gui {
  478. https-port 443
  479. listen-address 192.168.1.1
  480. listen-address 192.168.2.1
  481. listen-address **masked**:1::1
  482. }
  483. lldp {
  484. interface eth2 {
  485. location {
  486. civic-based {
  487. ca-type 0 {
  488. ca-value dutch
  489. }
  490. ca-type 3 {
  491. ca-value **masked**
  492. }
  493. ca-type 6 {
  494. ca-value **masked**
  495. }
  496. ca-type 19 {
  497. ca-value **masked**
  498. }
  499. ca-type 24 {
  500. ca-value **masked**
  501. }
  502. country-code NL
  503. }
  504. }
  505. }
  506. legacy-protocols {
  507. cdp
  508. edp
  509. fdp
  510. sonmp
  511. }
  512. management-address 192.168.2.1
  513. }
  514. nat {
  515. rule 5008 {
  516. description ITV
  517. destination {
  518. address 10.142.64.0/18
  519. }
  520. log disable
  521. outbound-interface eth0.4
  522. protocol all
  523. type masquerade
  524. }
  525. rule 5009 {
  526. description ITV
  527. destination {
  528. address 213.75.112.0/21
  529. }
  530. log disable
  531. outbound-interface eth0.4
  532. protocol all
  533. type masquerade
  534. }
  535. rule 5010 {
  536. description "masquerade for WAN"
  537. log disable
  538. outbound-interface pppoe0
  539. protocol all
  540. type masquerade
  541. }
  542. }
  543. ssh {
  544. listen-address 192.168.1.1
  545. listen-address 192.168.2.1
  546. port 22
  547. protocol-version v2
  548. }
  549. }
  550. system {
  551. conntrack {
  552. expect-table-size 4096
  553. hash-size 4096
  554. table-size 32768
  555. tcp {
  556. half-open-connections 512
  557. loose enable
  558. max-retrans 3
  559. }
  560. }
  561. domain-name thuis
  562. host-name ubnt
  563. login {
  564. user **masked**{
  565. authentication {
  566. encrypted-password **masked**
  567. plaintext-password ""
  568. }
  569. full-name "**masked**"
  570. level admin
  571. }
  572. }
  573. name-server 2620:0:ccc::2
  574. name-server 2001:4860:4860::8888
  575. name-server 208.67.222.222
  576. name-server 8.8.8.8
  577. ntp {
  578. server 0.ubnt.pool.ntp.org {
  579. }
  580. server 1.ubnt.pool.ntp.org {
  581. }
  582. server 2.ubnt.pool.ntp.org {
  583. }
  584. server 3.ubnt.pool.ntp.org {
  585. }
  586. }
  587. offload {
  588. ipsec enable
  589. ipv4 {
  590. forwarding enable
  591. pppoe enable
  592. vlan enable
  593. }
  594. ipv6 {
  595. forwarding enable
  596. pppoe enable
  597. }
  598. }
  599. package {
  600. repository wheezy {
  601. components "main contrib non-free"
  602. distribution wheezy
  603. password ""
  604. url http://ftp.nl.debian.org/debian
  605. username ""
  606. }
  607. repository wheezy-backport {
  608. components main
  609. distribution wheezy-backports
  610. password ""
  611. url http://ftp.nl.debian.org/debian
  612. username ""
  613. }
  614. repository wheezy-security {
  615. components main
  616. distribution wheezy/updates
  617. password ""
  618. url http://security.debian.org
  619. username ""
  620. }
  621. }
  622. syslog {
  623. global {
  624. facility all {
  625. level notice
  626. }
  627. facility protocols {
  628. level debug
  629. }
  630. }
  631. host 192.168.2.10 {
  632. facility all {
  633. level warning
  634. }
  635. }
  636. }
  637. time-zone Europe/Amsterdam
  638. traffic-analysis {
  639. dpi disable
  640. export disable
  641. }
  642. }
  643.  
  644.  
  645. /* Warning: Do not remove the following line. */
  646. /* === vyatta-config-version: "config-management@1:conntrack@1:cron@1:dhcp-relay@1:dhcp-server@4:firewall@5:ipsec@4:nat@3:qos@1:quagga@2:system@4:ubnt-pptp@1:ubnt-util@1:vrrp@1:webgui@1:webproxy@1:zone-policy@1" === */
  647. /* Release version: v1.7.0.4783374.150622.1534 */
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!