API tools faq
paste
beng

Comcast IPv6 with EdgeRouter Lite

beng
Jul 11th, 2015
814
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 8.51 KB | None | 0 0
raw download clone embed print report
  1. firewall {
  2. group {
  3. network-group BOGONS {
  4. network 10.0.0.0/8
  5. network 100.64.0.0/10
  6. network 127.0.0.0/8
  7. network 169.254.0.0/16
  8. network 172.16.0.0/12
  9. network 192.0.0.0/24
  10. network 192.0.2.0/24
  11. network 192.168.0.0/16
  12. network 198.18.0.0/15
  13. network 198.51.100.0/24
  14. network 203.0.113.0/24
  15. network 224.0.0.0/4
  16. network 240.0.0.0/4
  17. }
  18. }
  19. ipv6-name WANv6_IN {
  20. default-action drop
  21. description "WAN inbound traffic forwarded to LAN"
  22. enable-default-log
  23. rule 10 {
  24. action accept
  25. description "Allow established/related sessions"
  26. state {
  27. established enable
  28. related enable
  29. }
  30. }
  31. rule 20 {
  32. action drop
  33. description "Drop invalid state"
  34. state {
  35. invalid enable
  36. }
  37. }
  38. }
  39. ipv6-name WANv6_LOCAL {
  40. default-action drop
  41. description "WAN inbound traffic to the router"
  42. enable-default-log
  43. rule 10 {
  44. action accept
  45. description "Allow established/related sessions"
  46. state {
  47. established enable
  48. related enable
  49. }
  50. }
  51. rule 20 {
  52. action drop
  53. description "Drop invalid state"
  54. state {
  55. invalid enable
  56. }
  57. }
  58. rule 30 {
  59. action accept
  60. description "Allow IPv6 icmp"
  61. protocol ipv6-icmp
  62. }
  63. rule 40 {
  64. action accept
  65. description "allow dhcpv6"
  66. destination {
  67. port 546
  68. }
  69. protocol udp
  70. source {
  71. port 547
  72. }
  73. }
  74. }
  75. name LAN_IN {
  76. default-action accept
  77. rule 1 {
  78. action drop
  79. description "drop invalid state"
  80. state {
  81. invalid enable
  82. }
  83. }
  84. }
  85. name WAN_IN {
  86. default-action drop
  87. enable-default-log
  88. rule 10 {
  89. action accept
  90. description "allow estabished"
  91. state {
  92. established enable
  93. related enable
  94. }
  95. }
  96. rule 20 {
  97. action drop
  98. description "drop invalid"
  99. state {
  100. invalid enable
  101. }
  102. }
  103. }
  104. name WAN_LOCAL {
  105. default-action drop
  106. description "To router from WAN"
  107. enable-default-log
  108. rule 10 {
  109. action accept
  110. description "allow established"
  111. state {
  112. established enable
  113. related enable
  114. }
  115. }
  116. rule 20 {
  117. action drop
  118. description "drop invalid"
  119. state {
  120. invalid enable
  121. }
  122. }
  123. rule 30 {
  124. action accept
  125. description "allow icmp"
  126. protocol icmp
  127. }
  128. rule 80 {
  129. action drop
  130. description "drop bogon source"
  131. source {
  132. group {
  133. network-group BOGONS
  134. }
  135. }
  136. }
  137. }
  138. interfaces {
  139. ethernet eth0 {
  140. address dhcp
  141. description WAN
  142. dhcp-options {
  143. name-server no-update
  144. }
  145. dhcpv6-pd {
  146. pd 0 {
  147. interface eth1 {
  148. host-address ::1
  149. prefix-id :1
  150. service slaac
  151. }
  152. interface eth2 {
  153. host-address ::1
  154. prefix-id :2
  155. service slaac
  156. }
  157. interface eth3 {
  158. host-address ::1
  159. prefix-id :3
  160. service slaac
  161. }
  162. prefix-length /60
  163. }
  164. rapid-commit enable
  165. }
  166. firewall {
  167. in {
  168. ipv6-name WANv6_IN
  169. name WAN_IN
  170. }
  171. local {
  172. ipv6-name WANv6_LOCAL
  173. name WAN_LOCAL
  174. }
  175. }
  176. }
  177. ethernet eth1 {
  178. address 172.16.1.1/24
  179. description LAN
  180. firewall {
  181. in {
  182. name LAN_IN
  183. }
  184. }
  185. }
  186. ethernet eth2 {
  187. address 172.16.2.1/24
  188. description "PoE for UAP-Pro"
  189. firewall {
  190. in {
  191. name LAN_IN
  192. }
  193. }
  194. poe {
  195. output 48v
  196. }
  197. }
  198. ethernet eth3 {
  199. address 172.16.3.1/24
  200. description "PoE for UAP-AC"
  201. firewall {
  202. in {
  203. name LAN_IN
  204. }
  205. }
  206. poe {
  207. output 48v
  208. }
  209. }
  210. ethernet eth4 {
  211. disable
  212. }
  213. switch switch0 {
  214. mtu 1500
  215. }
  216. }
  217. service {
  218. dhcp-server {
  219. disabled false
  220. hostfile-update disable
  221. shared-network-name LAN-net {
  222. authoritative enable
  223. subnet 172.16.1.0/24 {
  224. default-router 172.16.1.1
  225. dns-server 172.16.1.1
  226. lease 86400
  227. start 172.16.1.10 {
  228. stop 172.16.1.50
  229. }
  230. }
  231. }
  232. shared-network-name LAN2 {
  233. authoritative enable
  234. subnet 172.16.3.0/24 {
  235. default-router 172.16.3.1
  236. dns-server 172.16.3.1
  237. dns-server 8.8.8.8
  238. lease 86400
  239. start 172.16.3.10 {
  240. stop 172.16.3.100
  241. }
  242. }
  243. }
  244. shared-network-name UniFi {
  245. authoritative enable
  246. subnet 172.16.2.0/24 {
  247. default-router 172.16.2.1
  248. dns-server 172.16.2.1
  249. lease 86400
  250. start 172.16.2.2 {
  251. stop 172.16.2.254
  252. }
  253. }
  254. }
  255. }
  256. dns {
  257. forwarding {
  258. cache-size 150
  259. listen-on eth1
  260. listen-on eth2
  261. listen-on eth3
  262. }
  263. }
  264. gui {
  265. https-port 443
  266. }
  267. nat {
  268. rule 5000 {
  269. description "masq to WAN"
  270. outbound-interface eth0
  271. type masquerade
  272. }
  273. }
  274. ssh {
  275. }
  276. ubnt-discover {
  277. interface eth0 {
  278. disable
  279. }
  280. }
  281. }
  282. system {
  283. config-management {
  284. commit-revisions 50
  285. }
  286. host-name stig-home
  287. login {
  288. user admin {
  289. authentication {
  290. encrypted-password xxxxxxxxxxxxxxxxxxxxxxxxxxx
  291. }
  292. level admin
  293. }
  294. user oper {
  295. authentication {
  296. encrypted-password xxxxxxxxxxxxxxxxxxxxxxxxxxx
  297. }
  298. level operator
  299. }
  300. }
  301. name-server 8.8.8.8
  302. name-server 8.8.4.4
  303. ntp {
  304. server 0.vyatta.pool.ntp.org {
  305. }
  306. server 1.vyatta.pool.ntp.org {
  307. }
  308. server 2.vyatta.pool.ntp.org {
  309. }
  310. server 3.vyatta.pool.ntp.org {
  311. }
  312. }
  313. offload {
  314. ipsec enable
  315. ipv4 {
  316. forwarding enable
  317. }
  318. ipv6 {
  319. forwarding enable
  320. }
  321. }
  322. package {
  323. repository wheezy {
  324. components "main contrib non-free"
  325. description wheezy
  326. distribution wheezy
  327. url http://http.us.debian.org/debian
  328. }
  329. repository wheezy-security {
  330. components main
  331. distribution wheezy/updates
  332. url http://security.debian.org
  333. }
  334. }
  335. syslog {
  336. global {
  337. facility all {
  338. level notice
  339. }
  340. facility protocols {
  341. level debug
  342. }
  343. }
  344. }
  345. time-zone US/Pacific
  346. }
  347.  
  348. /* Warning: Do not remove the following line. */
  349. /* === vyatta-config-version: "config-management@1:conntrack@1:cron@1:dhcp-relay@1:dhcp-server@4:firewall@5:ipsec@4:nat@3:qos@1:quagga@2:system@4:ubnt-pptp@1:ubnt-util@1:vrrp@1:webgui@1:webproxy@1:zone-policy@1" === */
  350. /* Release version: v1.6.0.4716006.141031.1731 */
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!