USG TV hangt

 firewall {
     all-ping enable
     broadcast-ping disable
     group {
         address-group authorized_guests {
             description "authorized guests MAC addresses"
         }
         address-group guest_allow_addresses {
             description "allow addresses for guests"
         }
         address-group guest_allow_dns_servers {
             description "allow dns servers for guests"
         }
         address-group guest_portal_address {
             description "guest portal address"
         }
         address-group guest_restricted_addresses {
             address 192.168.0.0/16
             address 172.16.0.0/12
             address 10.0.0.0/8
             description "restricted addresses for guests"
         }
         address-group unifi_controller_addresses {
             address 192.168.2.254
             description "unifi addresses"
         }
         address-group voip_sip_server_addresses {
             description "VOIP SIP server addresses"
         }
         network-group captive_portal_subnets {
             description "captive portal subnets"
         }
         network-group corporate_network {
             description "corporate subnets"
             network 192.168.2.0/24
             network 192.168.4.0/24
         }
         network-group guest_allow_subnets {
             description "allow subnets for guests"
         }
         network-group guest_network {
             description "guest subnets"
             network 192.168.5.0/24
         }
         network-group guest_restricted_subnets {
             description "restricted subnets for guests"
         }
         network-group remote_user_vpn_network {
             description "remote user vpn subnets"
         }
         network-group voip_network {
             description "voip subnets"
         }
         port-group S2012 {
             description customized
             port 5050
             port 6791
             port 9898
         }
         port-group guest_portal_ports {
             description "guest portal ports"
         }
         port-group guest_portal_redirector_ports {
             description "guest portal redirector ports"
             port 39080
         }
         port-group unifi_controller_ports-tcp {
             description "unifi tcp ports"
             port 8080
         }
         port-group unifi_controller_ports-udp {
             description "unifi udp ports"
             port 3478
         }
         port-group voip_sip_server_ports {
             description "voip sip server udp ports"
             port 5060
             port 10000-10100
         }
     }
     ipv6-name WANv6_IN {
         default-action drop
         description "WAN inbound traffic forwarded to LAN"
         rule 10 {
             action accept
             description "Allow established/related sessions"
             state {
                 established enable
                 related enable
             }
         }
         rule 20 {
             action drop
             description "Drop invalid state"
             state {
                 invalid enable
             }
         }
     }
     ipv6-name WANv6_LOCAL {
         default-action drop
         description "WAN inbound traffic to the router"
         rule 10 {
             action accept
             description "Allow established/related sessions"
             state {
                 established enable
                 related enable
             }
         }
         rule 20 {
             action drop
             description "Drop invalid state"
             state {
                 invalid enable
             }
         }
         rule 30 {
             action accept
             description "Allow IPv6 icmp"
             protocol ipv6-icmp
         }
         rule 40 {
             action accept
             description "allow dhcpv6"
             destination {
                 port 546
             }
             protocol udp
             source {
                 port 547
             }
         }
     }
     ipv6-receive-redirects disable
     ipv6-src-route disable
     ip-src-route disable
     log-martians enable
     name AUTHORIZED_GUESTS {
         default-action drop
         description "authorization check packets from guest network"
     }
     name GUEST_IN {
         default-action accept
         description "packets from guest network"
         rule 3001 {
             action accept
             description "allow DNS packets to external name servers"
             destination {
                 port 53
             }
             protocol udp
         }
         rule 3002 {
             action accept
             description "allow packets to captive portal"
             destination {
                 group {
                     network-group captive_portal_subnets
                 }
                 port 443
             }
             protocol tcp
         }
         rule 3003 {
             action accept
             description "allow packets to allow subnets"
             destination {
                 group {
                     address-group guest_allow_addresses
                 }
             }
         }
         rule 3004 {
             action drop
             description "drop packets to restricted subnets"
             destination {
                 group {
                     address-group guest_restricted_addresses
                 }
             }
         }
         rule 3005 {
             action drop
             description "drop packets to intranet"
             destination {
                 group {
                     network-group corporate_network
                 }
             }
         }
         rule 3006 {
             action drop
             description "drop packets to voip"
             destination {
                 group {
                     network-group voip_network
                 }
             }
         }
         rule 3007 {
             action drop
             description "drop packets to remote user"
             destination {
                 group {
                     network-group remote_user_vpn_network
                 }
             }
         }
         rule 3008 {
             action drop
             description "authorized guests white list"
             destination {
                 group {
                     address-group authorized_guests
                 }
             }
         }
         rule 6001 {
             action accept
             description "accounting defined network 192.168.5.0/24"
             source {
                 address 192.168.5.0/24
             }
         }
     }
     name GUEST_LOCAL {
         default-action drop
         description "packets from guest network to gateway"
         rule 3001 {
             action accept
             description "allow DNS"
             destination {
                 port 53
             }
             protocol udp
         }
         rule 3002 {
             action accept
             description "allow ICMP"
             protocol icmp
         }
     }
     name GUEST_OUT {
         default-action accept
         description "packets forward to guest network"
         rule 6001 {
             action accept
             description "accounting defined network 192.168.5.0/24"
             destination {
                 address 192.168.5.0/24
             }
         }
     }
     name LAN_IN {
         default-action accept
         description "packets from intranet"
         rule 3001 {
             action accept
             description "packets from unifi to voip"
             destination {
                 group {
                     network-group voip_network
                 }
             }
             source {
                 group {
                     address-group unifi_controller_addresses
                 }
             }
         }
         rule 3002 {
             action drop
             description "packets from intranet to voip"
             destination {
                 group {
                     network-group voip_network
                 }
             }
         }
         rule 6001 {
             action accept
             description "accounting defined network 192.168.2.0/24"
             source {
                 address 192.168.2.0/24
             }
         }
         rule 6002 {
             action accept
             description "accounting defined network 192.168.4.0/24"
             source {
                 address 192.168.4.0/24
             }
         }
     }
     name LAN_LOCAL {
         default-action accept
         description "packets from intranet to gateway"
     }
     name LAN_OUT {
         default-action accept
         description "packets forward to intranet"
         rule 6001 {
             action accept
             description "accounting defined network 192.168.2.0/24"
             destination {
                 address 192.168.2.0/24
             }
         }
         rule 6002 {
             action accept
             description "accounting defined network 192.168.4.0/24"
             destination {
                 address 192.168.4.0/24
             }
         }
     }
     name VOIP_IN {
         default-action accept
         description "packets from voip to intranet"
         rule 3001 {
             action accept
             description "icmp to unifi"
             destination {
                 group {
                     address-group unifi_controller_addresses
                 }
             }
             protocol icmp
         }
         rule 3002 {
             action accept
             description "inform to unifi"
             destination {
                 group {
                     address-group unifi_controller_addresses
                     port-group unifi_controller_ports-tcp
                 }
             }
             protocol tcp
         }
         rule 3003 {
             action accept
             description "stun to unifi"
             destination {
                 group {
                     address-group unifi_controller_addresses
                     port-group unifi_controller_ports-udp
                 }
             }
             protocol udp
         }
         rule 3004 {
             action accept
             description "allow established/related sessions"
             destination {
                 group {
                     address-group unifi_controller_addresses
                 }
             }
             state {
                 established enable
                 invalid disable
                 new disable
                 related enable
             }
         }
         rule 3005 {
             action drop
             description "drop invalid state"
             destination {
                 group {
                     address-group unifi_controller_addresses
                 }
             }
             state {
                 established disable
                 invalid enable
                 new disable
                 related disable
             }
         }
         rule 3006 {
             action drop
             description "drop VoIP to LAN traffic"
             destination {
                 group {
                     network-group corporate_network
                 }
             }
         }
         rule 3007 {
             action drop
             description "drop VoIP to GUEST traffic"
             destination {
                 group {
                     network-group guest_network
                 }
             }
         }
         rule 3008 {
             action drop
             description "drop VoIP to REMOTE USER traffic"
             destination {
                 group {
                     network-group remote_user_vpn_network
                 }
             }
         }
     }
     name VOIP_LOCAL {
         default-action drop
         description "packets from voip to gateway"
         rule 3001 {
             action accept
             description "allow DNS"
             destination {
                 port 53
             }
             protocol udp
         }
         rule 3002 {
             action accept
             description "allow ICMP"
             protocol icmp
         }
         rule 3003 {
             action accept
             description "allow established/related sessions"
             state {
                 established enable
                 invalid disable
                 new disable
                 related enable
             }
         }
         rule 3004 {
             action drop
             description "drop invalid state"
             state {
                 established disable
                 invalid enable
                 new disable
                 related disable
             }
         }
     }
     name VOIP_OUT {
         default-action accept
         description "packets forward to voip"
     }
     name WAN_IN {
         default-action drop
         description "packets from internet to intranet"
         rule 3001 {
             action accept
             description "allow established/related sessions"
             state {
                 established enable
                 invalid disable
                 new disable
                 related enable
             }
         }
         rule 3002 {
             action drop
             description "drop invalid state"
             state {
                 established disable
                 invalid enable
                 new disable
                 related disable
             }
         }
         rule 3003 {
             action accept
             description "PortForward [Couchpotato]"
             destination {
                 address 192.168.2.254
                 port ***
             }
             log enable
             protocol tcp_udp
         }
         rule 3004 {
             action accept
             description "PortForward [unifi]"
             destination {
                 address 192.168.2.254
                 port ***
             }
             log enable
             protocol tcp_udp
         }
         rule 3005 {
             action accept
             description "PortForward [NZBGet]"
             destination {
                 address 192.168.2.254
                 port ***
             }
             log enable
             protocol tcp_udp
         }
         rule 3006 {
             action accept
             description "PortForward [NAS]"
             destination {
                 address 192.168.2.10
                 port ***
             }
             log enable
             protocol tcp_udp
         }
         rule 3007 {
             action accept
             description "PortForward [Sonarr]"
             destination {
                 address 192.168.2.254
                 port ***
             }
             log enable
             protocol tcp_udp
         }
         rule 3008 {
             action accept
             description "PortForward [PPTP]"
             destination {
                 address 192.168.2.10
                 port ***
             }
             log enable
             protocol tcp
         }
         rule 3009 {
             action accept
             description "PortForward [RDP]"
             destination {
                 address 192.168.2.254
                 port ***
             }
             log enable
             protocol tcp
         }
     }
     name WAN_LOCAL {
         default-action drop
         description "packets from internet to gateway"
         rule 3001 {
             action accept
             description "allow established/related sessions"
             state {
                 established enable
                 invalid disable
                 new disable
                 related enable
             }
         }
         rule 3002 {
             action drop
             description "drop invalid state"
             state {
                 established disable
                 invalid enable
                 new disable
                 related disable
             }
         }
         rule 3003 {
             action accept
             description "allow ICMP"
             protocol icmp
         }
     }
     options {
         mss-clamp {
             interface-type pppoe
             interface-type pptp
             mss 1412
         }
     }
     receive-redirects disable
     send-redirects enable
     source-validation disable
     syn-cookies enable
 }
 interfaces {
     ethernet eth0 {
         address 192.168.2.1/24
         description "eth0 - LAN"
         duplex auto
         firewall {
             in {
                 name LAN_IN
             }
             local {
                 name LAN_LOCAL
             }
             out {
                 name LAN_OUT
             }
         }
         ipv6 {
             dup-addr-detect-transmits 1
             router-advert {
                 cur-hop-limit 64
                 link-mtu 0
                 managed-flag true
                 max-interval 600
                 name-server 2a02:a440:e513:1::254
                 other-config-flag true
                 prefix ::/64 {
                     autonomous-flag true
                     on-link-flag true
                     valid-lifetime 2592000
                 }
                 radvd-options "RDNSS 2a02:a440:e513:1::254 {};"
                 reachable-time 0
                 retrans-timer 0
                 send-advert true
             }
         }
         speed auto
         vif 4 {
             address 192.168.4.1/24
             firewall {
                 in {
                     name LAN_IN
                 }
                 local {
                     name LAN_LOCAL
                 }
                 out {
                     name LAN_OUT
                 }
             }
         }
         vif 5 {
             address 192.168.5.1/24
             firewall {
                 in {
                     name GUEST_IN
                 }
                 local {
                     name GUEST_LOCAL
                 }
                 out {
                     name GUEST_OUT
                 }
             }
         }
     }
     ethernet eth1 {
         disable
     }
     ethernet eth2 {
         address dhcp
         description "eth2 - FTTH"
         dhcp-options {
             client-option "retry 60;"
             default-route-distance 1
         }
         duplex auto
         firewall {
             in {
                 name WAN_IN
             }
             local {
                 name WAN_LOCAL
             }
         }
         mtu 1512
         speed auto
         vif 4 {
             address dhcp
             description "eth2.4 - IPTV"
             dhcp-options {
                client-option {
                    "send vendor-class-identifier "IPTV_RG";",
                     "request subnet-mask, routers, rfc3442-classless-static-routes;"
                    }
                 default-route no-update
                 default-route-distance 210
                 name-server update
             }
         }
         vif 6 {
             description "eth2.6 - Internet"
             mtu 1508
             pppoe 2 {
                 dhcpv6-pd {
                     no-dns
                     pd 0 {
                         interface eth0 {
                         }
                         prefix-length /48
                     }
                     rapid-commit disable
                 }
                 firewall {
                     in {
                         ipv6-name WANv6_IN
                         name WAN_IN
                     }
                     local {
                         ipv6-name WANv6_LOCAL
                         name WAN_LOCAL
                     }
                 }
                 idle-timeout 180
                 ipv6 {
                     address {
                         autoconf
                     }
                     dup-addr-detect-transmits 1
                     enable {
                     }
                 }
                 mtu 1500
                 name-server auto
                 password kpn
                 user-id ***********@internet
             }
         }
     }
     ethernet eth3 {
         disable
         firewall {
             in {
                 name WAN_IN
             }
             local {
                 name WAN_LOCAL
             }
         }
     }
     loopback lo {
     }
 }
 port-forward {
     auto-firewall enable
     hairpin-nat enable
     lan-interface eth0.4
     lan-interface eth0
     rule 3001 {
         description Couchpotato
         forward-to {
             address 192.168.2.254
         }
         original-port ***
         protocol tcp_udp
     }
     rule 3002 {
         description unifi
         forward-to {
             address 192.168.2.254
         }
         original-port ***
         protocol tcp_udp
     }
     rule 3003 {
         description NZBGet
         forward-to {
             address 192.168.2.254
         }
         original-port ***
         protocol tcp_udp
     }
     rule 3004 {
         description NAS
         forward-to {
             address 192.168.2.10
             port ***
         }
         original-port ***
         protocol tcp_udp
     }
     rule 3005 {
         description Sonarr
         forward-to {
             address 192.168.2.254
         }
         original-port ***
         protocol tcp_udp
     }
     rule 3006 {
         description PPTP
         forward-to {
             address 192.168.2.10
         }
         original-port ***
         protocol tcp
     }
     rule 3007 {
         description RDP
         forward-to {
             address 192.168.2.254
         }
         original-port ***
         protocol tcp
     }
     wan-interface pppoe2
 }
 protocols {
     igmp-proxy {
         interface eth0.4 {
             alt-subnet 0.0.0.0/0
             role downstream
             threshold 1
         }
         interface eth2.4 {
             alt-subnet 0.0.0.0/0
             role upstream
             threshold 1
         }
     }
     static {
         interface-route6 ::/0 {
             next-hop-interface pppoe2 {
             }
         }
         route 213.75.112.0/21 {
             next-hop 10.81.96.1 {
             }
         }
     }
 }
 service {
     dhcp-server {
         disabled false
         global-parameters "option vendor-class-identifier code 60 = string;"
         global-parameters "option broadcast-address code 28 = ip-address;"
         hostfile-update disable
         shared-network-name Gast_192.168.5.0-24 {
             authoritative enable
             description vlan5
             subnet 192.168.5.0/24 {
                 default-router 192.168.5.1
                 dns-server 192.168.5.1
                 lease 86400
                 start 192.168.5.10 {
                     stop 192.168.5.250
                 }
             }
         }
         shared-network-name TV_192.168.4.0-24 {
             authoritative enable
             description vlan4
             subnet 192.168.4.0/24 {
                 default-router 192.168.4.1
                 dns-server 192.168.4.1
                 lease 86400
                 start 192.168.4.5 {
                     stop 192.168.4.250
                 }
             }
         }
     }
     dns {
         forwarding {
             cache-size 500
             except-interface eth2
             options host-record=unifi,192.168.2.254
         }
     }
     gui {
         https-port 443
     }
     lldp {
         interface eth2 {
             disable
         }
         interface eth3 {
             disable
         }
     }
     nat {
         rule 5000 {
             description IPTV
             destination {
                 address 213.75.112.0/21
             }
             log disable
             outbound-interface eth2.4
             protocol all
             type masquerade
         }
         rule 5010 {
             description "KPN Internet"
             log disable
             outbound-interface pppoe2
             protocol all
             type masquerade
         }
         rule 6001 {
             description "MASQ corporate_network to WAN"
             disable
             log disable
             outbound-interface eth2
             protocol all
             source {
                 group {
                     network-group corporate_network
                 }
             }
             type masquerade
         }
         rule 6002 {
             description "MASQ voip_network to WAN"
             disable
             log disable
             outbound-interface eth2
             protocol all
             source {
                 group {
                     network-group voip_network
                 }
             }
             type masquerade
         }
         rule 6003 {
             description "MASQ remote_user_vpn_network to WAN"
             disable
             log disable
             outbound-interface eth2
             protocol all
             source {
                 group {
                     network-group remote_user_vpn_network
                 }
             }
             type masquerade
         }
         rule 6004 {
             description "MASQ guest_network to WAN"
             disable
             log disable
             outbound-interface eth2
             protocol all
             source {
                 group {
                     network-group guest_network
                 }
             }
             type masquerade
         }
     }
     ssh {
         port 22
         protocol-version v2
     }
 }
 system {
     host-name USG-Pro
     login {
         user wouter {
             authentication {
                 encrypted-password *****
             }
             level admin
         }
     }
     name-server 8.8.8.8
     name-server 8.8.4.4
     name-server 2001:4860:4860::8888
     name-server 2001:4860:4860::8844
     ntp {
         server 0.ubnt.pool.ntp.org {
         }
     }
     offload {
         ipsec enable
         ipv4 {
             forwarding enable
             pppoe enable
             vlan enable
         }
         ipv6 {
             forwarding enable
             vlan enable
         }
     }
     static-host-mapping {
         host-name setup.ubnt.com {
             alias setup
             inet 192.168.2.1
         }
     }
     syslog {
         global {
             facility all {
                 level notice
             }
             facility protocols {
                 level debug
             }
         }
     }
     time-zone Europe/Brussels
     traffic-analysis {
         dpi enable
     }
 }
 unifi {
     mgmt {
         cfgversion 5d3095f8e5cd3a6a
     }
 }
[edit]