Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- firewall {
- all-ping enable
- broadcast-ping disable
- group {
- address-group EXT1_to_KPN {
- address 192.168.9.0/27
- description EXT1_to_KPN
- }
- address-group EXT2_to_Ziggo {
- address 192.168.10.0/27
- description EXT2_to_Ziggo
- }
- network-group BOGONS {
- description "Invalid WAN Networks"
- network 10.0.0.0/8
- network 100.64.0.0/10
- network 127.0.0.0/8
- network 169.254.0.0/16
- network 172.16.0.0/12
- network 192.0.0.0/24
- network 192.0.2.0/24
- network 192.168.0.0/16
- network 198.18.0.0/15
- network 198.51.100.0/24
- network 203.0.113.0/24
- network 224.0.0.0/3
- }
- network-group DOM_IoT_LAN_NETWORKS {
- description "Domotica IoT LAN Network"
- network 192.168.8.0/27
- }
- network-group LAN_NETWORKS {
- description "LAN Networks"
- network 192.168.2.0/24
- network 192.168.1.0/24
- }
- network-group LAN_NETWORKS_EXT {
- description "Lan Network External"
- network 192.168.10.0/27
- network 192.168.9.0/27
- }
- network-group WEATHER_LAN_NETWORKS {
- description "Weather Network"
- network 192.168.12.0/27
- }
- network-group WLAN_GUEST_NETWORKS {
- description "WLAN Guest Networks"
- network 192.168.11.0/27
- }
- }
- ipv6-receive-redirects disable
- ipv6-src-route disable
- ip-src-route disable
- log-martians enable
- modify SOURCE_ROUTE {
- rule 10 {
- action modify
- description "Traffic from EXT1 to KPN ETH2"
- modify {
- table 11
- }
- source {
- address 192.168.9.1/27
- }
- }
- rule 20 {
- action modify
- description "Traffic from EXT2 to Ziggo ETH0"
- modify {
- table 12
- }
- source {
- address 192.168.10.1/27
- }
- }
- }
- name DOM_IoT_LAN_PROTECT_IN {
- default-action accept
- rule 10 {
- action accept
- description "Accept Established/Related"
- protocol all
- state {
- established enable
- related enable
- }
- }
- rule 20 {
- action drop
- description "Drop LAN_NETWORKS"
- destination {
- group {
- network-group LAN_NETWORKS
- }
- }
- log disable
- protocol all
- }
- rule 30 {
- action drop
- description "Drop WEATHER_NETWORKS"
- destination {
- group {
- network-group WEATHER_LAN_NETWORKS
- }
- }
- log disable
- protocol all
- }
- rule 40 {
- action drop
- description "Drop LAN_NETWORKS_EXT"
- destination {
- group {
- network-group LAN_NETWORKS_EXT
- }
- }
- log disable
- protocol all
- }
- rule 41 {
- action drop
- description "Drop WLAN_GUEST_NETWORKS"
- destination {
- group {
- network-group WLAN_GUEST_NETWORKS
- }
- }
- log disable
- protocol all
- }
- }
- name DOM_IoT_LAN_PROTECT_LOCAL {
- default-action drop
- rule 10 {
- action accept
- description "Accept DNS"
- destination {
- port 53
- }
- protocol udp
- }
- rule 20 {
- action accept
- description "Accept DHCP"
- destination {
- port 67
- }
- protocol udp
- }
- }
- name EXT1_LAN_PROTECT_IN {
- default-action accept
- rule 10 {
- action accept
- description "Accept Established/Related"
- protocol all
- state {
- established enable
- related enable
- }
- }
- rule 20 {
- action drop
- description "Drop LAN_NETWORKS"
- destination {
- group {
- network-group LAN_NETWORKS
- }
- }
- protocol all
- }
- rule 30 {
- action drop
- description "Drop WEATHER_NETWORKS"
- destination {
- group {
- network-group WEATHER_LAN_NETWORKS
- }
- }
- log disable
- protocol all
- }
- rule 40 {
- action drop
- description "Drop WLAN_GUEST_NETWORKS"
- destination {
- group {
- network-group WLAN_GUEST_NETWORKS
- }
- }
- log disable
- protocol all
- }
- rule 41 {
- action drop
- description "Drop DOMOTICA_LAN_NETWORKS"
- destination {
- group {
- network-group DOM_IoT_LAN_NETWORKS
- }
- }
- log disable
- protocol all
- }
- }
- name EXT1_LAN_PROTECT_LOCAL {
- default-action drop
- rule 10 {
- action accept
- description "Accept DNS"
- destination {
- port 53
- }
- protocol udp
- }
- rule 20 {
- action accept
- description "Accept DHCP"
- destination {
- port 67
- }
- protocol udp
- }
- }
- name EXT2_LAN_PROTECT_IN {
- default-action accept
- rule 10 {
- action accept
- description "Accept Established/Related"
- protocol all
- state {
- established enable
- related enable
- }
- }
- rule 20 {
- action drop
- description "Drop LAN_NETWORKS"
- destination {
- group {
- network-group LAN_NETWORKS
- }
- }
- protocol all
- }
- rule 30 {
- action drop
- description "Drop WEATHER_NETWORKS"
- destination {
- group {
- network-group WEATHER_LAN_NETWORKS
- }
- }
- log disable
- protocol all
- }
- rule 40 {
- action drop
- description "Drop WLAN_GUEST_NETWORKS"
- destination {
- group {
- network-group WLAN_GUEST_NETWORKS
- }
- }
- log disable
- protocol all
- }
- rule 41 {
- action drop
- description "Drop DOMOTICA_LAN_NETWORKS"
- destination {
- group {
- network-group DOM_IoT_LAN_NETWORKS
- }
- }
- log disable
- protocol all
- }
- }
- name EXT2_LAN_PROTECT_LOCAL {
- default-action drop
- rule 10 {
- action accept
- description "Accept DNS"
- destination {
- port 53
- }
- protocol udp
- }
- rule 20 {
- action accept
- description "Accept DHCP"
- destination {
- port 67
- }
- protocol udp
- }
- }
- name WAN_IN {
- default-action drop
- description "WAN to internal LANs"
- enable-default-log
- rule 10 {
- action accept
- description "Allow established/related"
- log disable
- protocol all
- state {
- established enable
- related enable
- }
- }
- rule 40 {
- action drop
- description "Drop invalid state"
- log disable
- protocol all
- state {
- invalid enable
- }
- }
- rule 50 {
- action drop
- description "Drop BOGON source"
- log disable
- protocol all
- source {
- group {
- network-group BOGONS
- }
- }
- }
- }
- name WAN_LOCAL {
- default-action drop
- description "WAN to router"
- enable-default-log
- rule 2 {
- action accept
- description "Allow established/related"
- log disable
- protocol all
- state {
- established enable
- related enable
- }
- }
- rule 3 {
- action drop
- description "Drop invalid state"
- log disable
- protocol all
- state {
- invalid enable
- }
- }
- rule 4 {
- action drop
- description "Drop BOGON source"
- log enable
- protocol all
- source {
- group {
- network-group BOGONS
- }
- }
- }
- }
- name WAN_OUT {
- default-action accept
- description "Out to WAN"
- enable-default-log
- rule 10 {
- action drop
- description Block
- log enable
- protocol all
- source {
- address 192.168.1.14
- }
- }
- }
- name WEATHER_LAN_PROTECT_IN {
- default-action accept
- rule 10 {
- action accept
- description "Accept Established/Related"
- protocol all
- state {
- established enable
- related enable
- }
- }
- rule 20 {
- action accept
- description "PiAware to Domoticz"
- destination {
- address 192.168.1.12
- port 8081
- }
- log enable
- protocol tcp
- source {
- address 192.168.12.6
- }
- }
- rule 30 {
- action accept
- description "RainSensor to Domoticz"
- destination {
- address 192.168.1.12
- port 8081
- }
- log enable
- protocol tcp
- source {
- address 192.168.12.9
- }
- }
- rule 40 {
- action drop
- description "Drop LAN_NETWORKS"
- destination {
- group {
- network-group LAN_NETWORKS
- }
- }
- log enable
- protocol all
- }
- rule 50 {
- action drop
- description Drop_EXT_NETWORKS
- destination {
- group {
- network-group LAN_NETWORKS_EXT
- }
- }
- log disable
- protocol all
- }
- rule 60 {
- action drop
- description "Drop WLAN_GUEST_NETWORKS"
- destination {
- group {
- network-group WLAN_GUEST_NETWORKS
- }
- }
- log disable
- protocol all
- }
- rule 61 {
- action drop
- description "Drop DOMOTICA_LAN_NETWORKS"
- destination {
- group {
- network-group DOM_IoT_LAN_NETWORKS
- }
- }
- log disable
- protocol all
- }
- }
- name WEATHER_LAN_PROTECT_LOCAL {
- default-action drop
- rule 10 {
- action accept
- description "Accept DNS"
- destination {
- port 53
- }
- protocol udp
- }
- rule 20 {
- action accept
- description "Accept DHCP"
- destination {
- port 67
- }
- protocol udp
- }
- }
- name WLAN_GUEST_PROTECT_IN {
- default-action accept
- rule 10 {
- action accept
- description "Accept Established/Related"
- protocol all
- state {
- established enable
- related enable
- }
- }
- rule 20 {
- action drop
- description "Drop LAN_NETWORKS"
- destination {
- group {
- network-group LAN_NETWORKS
- }
- }
- log disable
- protocol all
- }
- rule 30 {
- action drop
- description "Drop WEATHER_NETWORKS"
- destination {
- group {
- network-group WEATHER_LAN_NETWORKS
- }
- }
- log disable
- protocol all
- }
- rule 40 {
- action drop
- description "Drop LAN_NETWORKS_EXT"
- destination {
- group {
- network-group LAN_NETWORKS_EXT
- }
- }
- log disable
- protocol all
- }
- rule 41 {
- action drop
- description "Drop DOMOTICA_LAN_NETWORKS"
- destination {
- group {
- network-group DOM_IoT_LAN_NETWORKS
- }
- }
- log disable
- protocol all
- }
- }
- name WLAN_GUEST_PROTECT_LOCAL {
- default-action drop
- rule 10 {
- action accept
- description "Accept DNS"
- destination {
- port 53
- }
- protocol udp
- }
- rule 20 {
- action accept
- description "Accept DHCP"
- destination {
- port 67
- }
- protocol udp
- }
- }
- receive-redirects disable
- send-redirects enable
- source-validation disable
- syn-cookies enable
- }
- interfaces {
- ethernet eth0 {
- address dhcp
- description Ziggo
- dhcp-options {
- default-route update
- default-route-distance 220
- name-server update
- }
- duplex auto
- firewall {
- in {
- name WAN_IN
- }
- local {
- name WAN_LOCAL
- }
- out {
- name WAN_OUT
- }
- }
- speed auto
- }
- ethernet eth1 {
- address 192.168.1.1/24
- description LAN
- duplex auto
- firewall {
- in {
- }
- }
- speed auto
- vif 2 {
- address 192.168.2.1/24
- description MLT_HomeLan
- mtu 1500
- }
- vif 8 {
- address 192.168.8.1/27
- description MLT_Domotica_IoT
- firewall {
- in {
- name DOM_IoT_LAN_PROTECT_IN
- }
- local {
- name DOM_IoT_LAN_PROTECT_LOCAL
- }
- }
- }
- vif 9 {
- address 192.168.9.1/27
- description MLT_HomeLan_Ext1
- firewall {
- in {
- modify SOURCE_ROUTE
- name EXT1_LAN_PROTECT_IN
- }
- local {
- name EXT1_LAN_PROTECT_LOCAL
- }
- }
- }
- vif 10 {
- address 192.168.10.1/27
- description MLT_HomeLan_Ext2
- firewall {
- in {
- modify SOURCE_ROUTE
- name EXT2_LAN_PROTECT_IN
- }
- local {
- name EXT2_LAN_PROTECT_LOCAL
- }
- }
- }
- vif 11 {
- address 192.168.11.1/27
- description MLT_HomeLan_WLAN_Guest
- firewall {
- in {
- name WLAN_GUEST_PROTECT_IN
- }
- local {
- name WLAN_GUEST_PROTECT_LOCAL
- }
- }
- mtu 1500
- }
- vif 12 {
- address 192.168.12.1/27
- description MLT_HomeLan_Weather
- firewall {
- in {
- name WEATHER_LAN_PROTECT_IN
- }
- local {
- name WEATHER_LAN_PROTECT_LOCAL
- }
- }
- }
- }
- ethernet eth2 {
- description "KPN Glas"
- duplex auto
- mtu 1512
- speed auto
- vif 4 {
- address dhcp
- description KPN_IPTV
- dhcp-options {
- client-option "send vendor-class-identifier "IPTV_RG";"
- client-option "request subnet-mask, routers, rfc3442-classless-static-routes;"
- default-route no-update
- default-route-distance 210
- name-server update
- }
- mtu 1508
- }
- vif 6 {
- description "KPN Glas VLAN6"
- mtu 1508
- pppoe 0 {
- default-route auto
- firewall {
- in {
- name WAN_IN
- }
- local {
- name WAN_LOCAL
- }
- }
- idle-timeout 180
- mtu 1500
- name-server auto
- password ***************
- user-**********
- }
- }
- }
- loopback lo {
- }
- }
- port-forward {
- auto-firewall enable
- hairpin-nat enable
- lan-interface eth1
- wan-interface pppoe0
- }
- protocols {
- igmp-proxy {
- interface eth1 {
- alt-subnet 0.0.0.0/0
- role downstream
- threshold 1
- }
- interface eth2.4 {
- alt-subnet 213.75.0.0/16
- alt-subnet 10.16.0.0/16
- alt-subnet 217.166.0.0/16
- alt-subnet 0.0.0.0/0
- role upstream
- threshold 1
- }
- }
- static {
- interface-route 0.0.0.0/0 {
- next-hop-interface pppoe0 {
- }
- }
- table 11 {
- interface-route 0.0.0.0/0 {
- next-hop-interface pppoe0 {
- }
- }
- }
- table 12 {
- route 0.0.0.0/0 {
- blackhole {
- distance 250
- }
- next-hop 217.120.2.1 {
- }
- }
- }
- }
- }
- service {
- dhcp-server {
- disabled false
- global-parameters "option vendor-class-identifier code 60 = string;"
- global-parameters "option broadcast-address code 28 = ip-address;"
- hostfile-update disable
- shared-network-name LAN {
- authoritative enable
- subnet 192.168.1.0/24 {
- default-router 192.168.1.1
- dns-server 192.168.1.1
- dns-server 8.8.4.4
- domain-name mmprod.nl
- lease 86400
- start 192.168.1.150 {
- stop 192.168.1.200
- }
- static-mapping #### {
- ip-address 192.168.1.xxx
- mac-address xxxxxxxxxxxx
- }
- }
- shared-network-name MLT_Domotica {
- authoritative disable
- subnet 192.168.8.0/27 {
- default-router 192.168.8.1
- dns-server 192.168.8.1
- dns-server 8.8.4.4
- lease 86400
- start 192.168.8.2 {
- stop 192.168.8.29
- }
- }
- }
- shared-network-name MLT_HomeLan {
- authoritative disable
- subnet 192.168.2.0/24 {
- default-router 192.168.2.1
- dns-server 192.168.2.1
- dns-server 8.8.4.4
- domain-name mmprod.nl
- lease 86400
- start 192.168.2.50 {
- stop 192.168.2.100
- }
- }
- shared-network-name MLT_HomeLan_Ext1 {
- authoritative disable
- subnet 192.168.9.0/27 {
- default-router 192.168.9.1
- dns-server 192.168.9.1
- dns-server 8.8.4.4
- lease 86400
- start 192.168.9.2 {
- stop 192.168.9.29
- }
- static-mapping RIPE_Atlas_KPN {
- ip-address 192.168.9.3
- mac-address 18:d6:c7:f3:1c:ca
- }
- }
- }
- shared-network-name MLT_HomeLan_Ext2 {
- authoritative disable
- subnet 192.168.10.0/27 {
- default-router 192.168.10.1
- dns-server 192.168.10.1
- dns-server 8.8.4.4
- lease 86400
- start 192.168.10.2 {
- stop 192.168.10.29
- }
- static-mapping RIPE_Atlas_Ziggo {
- ip-address 192.168.10.2
- mac-address f4:f2:6d:5d:97:12
- }
- }
- }
- shared-network-name MLT_HomeLan_WLAN {
- authoritative disable
- subnet 192.168.3.0/24 {
- default-router 192.168.3.1
- dns-server 192.168.3.1
- dns-server 8.8.4.4
- domain-name mmprod.nl
- lease 86400
- start 192.168.3.100 {
- stop 192.168.3.150
- }
- }
- shared-network-name MLT_HomeLan_WLAN_Guest {
- authoritative disable
- subnet 192.168.11.0/27 {
- default-router 192.168.11.1
- dns-server 192.168.11.1
- dns-server 8.8.8.8
- lease 86400
- start 192.168.11.2 {
- stop 192.168.11.29
- }
- static-mapping ###### {
- ip-address 192.168.11.xxxx
- mac-address xxxxxx
- }
- }
- }
- shared-network-name MLT_HomeLan_Weather_IoT {
- authoritative disable
- subnet 192.168.12.0/24 {
- default-router 192.168.12.1
- dns-server 192.168.12.1
- dns-server 8.8.4.4
- lease 86400
- start 192.168.12.2 {
- stop 192.168.12.40
- }
- static-mapping ###### {
- ip-address 192.168.12.xxxx
- mac-address xxxxxx
- }
- }
- static-arp disable
- use-dnsmasq disable
- }
- dns {
- forwarding {
- cache-size 150
- listen-on eth1
- listen-on eth2
- listen-on eth1.2
- listen-on eth1.10
- listen-on eth1.11
- listen-on eth1.12
- name-server 8.8.8.8
- name-server 8.8.4.4
- }
- }
- gui {
- http-port 80
- https-port 443
- listen-address 192.168.1.1
- listen-address 192.168.2.1
- older-ciphers enable
- }
- nat {
- rule 5000 {
- description Ziggo
- log enable
- outbound-interface eth0
- protocol all
- source {
- group {
- address-group EXT2_to_Ziggo
- }
- }
- type masquerade
- }
- rule 5001 {
- description "KPN Glas"
- log disable
- outbound-interface pppoe0
- protocol all
- source {
- group {
- }
- }
- type masquerade
- }
- rule 5002 {
- description KPN_IPTV
- destination {
- address 213.75.112.0/21
- }
- log disable
- outbound-interface eth2.4
- protocol all
- type masquerade
- }
- rule 5003 {
- description KPN_IPTV
- destination {
- address 10.16.0.0/16
- }
- log disable
- outbound-interface eth2.4
- protocol all
- type masquerade
- }
- }
- ssh {
- listen-address 192.168.1.1
- listen-address 192.168.2.1
- port 22
- protocol-version v2
- }
- ubnt-discover {
- disable
- }
- }
- system {
- conntrack {
- expect-table-size 2048
- hash-size 32768
- modules {
- sip {
- disable
- }
- }
- table-size 262144
- }
- host-name mainrouter
- login {
- user XXXX {
- authentication {
- encrypted-password ???????
- }
- level admin
- }
- }
- name-server 127.0.0.1
- ntp {
- server 0.pool.ntp.org {
- }
- server 1.pool.ntp.org {
- }
- }
- offload {
- hwnat disable
- ipv4 {
- forwarding enable
- pppoe enable
- vlan enable
- }
- }
- static-host-mapping {
- host-name ##### {
- inet 192.168.1.1
- }
- }
- syslog {
- global {
- facility all {
- level notice
- }
- facility protocols {
- level debug
- }
- }
- }
- time-zone Europe/Amsterdam
- traffic-analysis {
- dpi enable
- export enable
- }
- }
- /* Warning: Do not remove the following line. */
- /* === vyatta-config-version: "config-management@1:conntrack@1:cron@1:dhcp-relay@1:dhcp-server@4:firewall@5:ipsec@5:nat@3:qos@1:quagga@2:suspend@1:system@4:ubnt-pptp@1:ubnt-udapi-server@1:ubnt-unms@1:ubnt-util@1:vrrp@1:vyatta-netflow@1:webgui@1:webproxy@1:zone-policy@1" === */
- /* Release version: v2.0.8-hotfix.1.5278088.200305.1640 */
Add Comment
Please, Sign In to add comment