Advertisement
Guest User

Untitled

a guest
Feb 27th, 2018
56
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 28.58 KB | None | 0 0
  1. firewall {
  2. all-ping enable
  3. broadcast-ping disable
  4. group {
  5. network-group Camera_Network {
  6. network 10.0.40.0/24
  7. }
  8. network-group Guest_network {
  9. description ""
  10. network 10.0.30.0/24
  11. }
  12. network-group Private_Networks {
  13. description ""
  14. network 10.0.5.0/24
  15. network 10.0.10.0/24
  16. network 10.0.20.0/24
  17. }
  18. }
  19. ipv6-name Guest_in_v6 {
  20. default-action accept
  21. description "IPv6 Guest internet access"
  22. rule 1 {
  23. action accept
  24. description "Allow established/related"
  25. log disable
  26. protocol all
  27. state {
  28. established enable
  29. related enable
  30. }
  31. }
  32. rule 2 {
  33. action drop
  34. description "Drop invalid"
  35. log enable
  36. protocol all
  37. state {
  38. invalid enable
  39. }
  40. }
  41. }
  42. ipv6-name Guest_local_v6 {
  43. default-action accept
  44. description "IPv6 Guest to router"
  45. rule 1 {
  46. action accept
  47. description "Allow established/related"
  48. log disable
  49. protocol all
  50. state {
  51. established enable
  52. related enable
  53. }
  54. }
  55. rule 2 {
  56. action drop
  57. description "Drop invalid"
  58. log enable
  59. protocol all
  60. state {
  61. invalid enable
  62. }
  63. }
  64. }
  65. ipv6-name LAN_in_v6 {
  66. default-action accept
  67. description "IPv6 LAN to other networks"
  68. rule 1 {
  69. action accept
  70. description "Allow established/related"
  71. log disable
  72. protocol all
  73. state {
  74. established enable
  75. related enable
  76. }
  77. }
  78. rule 2 {
  79. action drop
  80. description "Drop invalid"
  81. log enable
  82. protocol all
  83. state {
  84. invalid enable
  85. }
  86. }
  87. }
  88. ipv6-name LAN_local_v6 {
  89. default-action accept
  90. description "IPv6 LAN to router"
  91. rule 1 {
  92. action accept
  93. description "Allow established/enable"
  94. log disable
  95. protocol all
  96. state {
  97. established enable
  98. related enable
  99. }
  100. }
  101. rule 2 {
  102. action drop
  103. description "Drop invalid"
  104. log enable
  105. protocol all
  106. state {
  107. invalid enable
  108. }
  109. }
  110. }
  111. ipv6-name WAN_in_v6 {
  112. default-action drop
  113. description "IPv6 Internet to internal networks"
  114. enable-default-log
  115. rule 1 {
  116. action accept
  117. description "Allow established/related"
  118. log disable
  119. protocol all
  120. state {
  121. established enable
  122. related enable
  123. }
  124. }
  125. rule 2 {
  126. action drop
  127. description "Drop invalid"
  128. log enable
  129. protocol all
  130. state {
  131. invalid enable
  132. }
  133. }
  134. rule 5 {
  135. action accept
  136. description "Limit ICMPv6"
  137. limit {
  138. burst 3
  139. rate 50/minute
  140. }
  141. log disable
  142. protocol ipv6-icmp
  143. }
  144. }
  145. ipv6-name WAN_local_v6 {
  146. default-action drop
  147. description "IPv6 Internet to router"
  148. enable-default-log
  149. rule 1 {
  150. action accept
  151. description "Allow established/related"
  152. log disable
  153. protocol all
  154. state {
  155. established enable
  156. related enable
  157. }
  158. }
  159. rule 2 {
  160. action drop
  161. description "Drop invalid"
  162. log enable
  163. protocol all
  164. state {
  165. invalid enable
  166. }
  167. }
  168. rule 5 {
  169. action accept
  170. description "Limit ICMPv6"
  171. limit {
  172. burst 3
  173. rate 50/minute
  174. }
  175. log disable
  176. protocol ipv6-icmp
  177. }
  178. rule 10 {
  179. action accept
  180. description "Allow DHCPv6"
  181. destination {
  182. port 546
  183. }
  184. log disable
  185. protocol udp
  186. source {
  187. port 547
  188. }
  189. }
  190. }
  191. ipv6-receive-redirects disable
  192. ipv6-src-route disable
  193. ip-src-route disable
  194. log-martians enable
  195. name Camera_In {
  196. default-action drop
  197. description ""
  198. rule 10 {
  199. action accept
  200. description "Allow established/related"
  201. log disable
  202. protocol all
  203. state {
  204. established enable
  205. invalid disable
  206. new disable
  207. related enable
  208. }
  209. }
  210. rule 20 {
  211. action drop
  212. description "Block access to Guest"
  213. destination {
  214. group {
  215. network-group Guest_network
  216. }
  217. }
  218. log disable
  219. protocol all
  220. }
  221. rule 30 {
  222. action drop
  223. description "Block private networks"
  224. destination {
  225. group {
  226. network-group Private_Networks
  227. }
  228. }
  229. log disable
  230. protocol all
  231. }
  232. rule 40 {
  233. action accept
  234. description "Allow NTP"
  235. destination {
  236. port 123
  237. }
  238. log disable
  239. protocol tcp_udp
  240. source {
  241. port 123
  242. }
  243. }
  244. rule 50 {
  245. action accept
  246. description "Allow DNS"
  247. destination {
  248. port 53
  249. }
  250. log disable
  251. protocol udp
  252. }
  253. }
  254. name Camera_local {
  255. default-action accept
  256. description ""
  257. rule 1 {
  258. action accept
  259. description "Allow established/related"
  260. log disable
  261. protocol all
  262. state {
  263. established enable
  264. invalid disable
  265. new disable
  266. related enable
  267. }
  268. }
  269. rule 2 {
  270. action drop
  271. description "Drop invalid"
  272. log disable
  273. protocol all
  274. state {
  275. established disable
  276. invalid enable
  277. new disable
  278. related disable
  279. }
  280. }
  281. rule 3 {
  282. action drop
  283. description "Drop access to Private network gateways"
  284. destination {
  285. group {
  286. network-group Private_Networks
  287. }
  288. }
  289. log disable
  290. protocol all
  291. }
  292. rule 4 {
  293. action drop
  294. description "Drop access to Guest Gateway"
  295. destination {
  296. group {
  297. network-group Guest_network
  298. }
  299. }
  300. log disable
  301. protocol all
  302. }
  303. }
  304. name Devices_in {
  305. default-action accept
  306. description ""
  307. rule 1 {
  308. action accept
  309. description "Allow established/related"
  310. log disable
  311. protocol all
  312. state {
  313. established enable
  314. invalid disable
  315. new disable
  316. related enable
  317. }
  318. }
  319. rule 2 {
  320. action drop
  321. description "Drop invalid"
  322. log disable
  323. protocol all
  324. state {
  325. established disable
  326. invalid enable
  327. new disable
  328. related disable
  329. }
  330. }
  331. }
  332. name Devices_local {
  333. default-action accept
  334. description ""
  335. rule 1 {
  336. action accept
  337. description "Allow established/related"
  338. log disable
  339. protocol all
  340. state {
  341. established enable
  342. invalid disable
  343. new disable
  344. related enable
  345. }
  346. }
  347. rule 2 {
  348. action drop
  349. description "Drop invalid"
  350. log disable
  351. protocol all
  352. state {
  353. established disable
  354. invalid enable
  355. new disable
  356. related disable
  357. }
  358. }
  359. }
  360. name Guest_in {
  361. default-action accept
  362. description "Guest internet access"
  363. rule 10 {
  364. action accept
  365. description "Allow established/related"
  366. log disable
  367. protocol all
  368. state {
  369. established enable
  370. related enable
  371. }
  372. }
  373. rule 40 {
  374. action drop
  375. description "Block access to Cameras"
  376. destination {
  377. group {
  378. network-group Camera_Network
  379. }
  380. }
  381. log enable
  382. protocol all
  383. }
  384. rule 61 {
  385. action drop
  386. description "Block access to private networks"
  387. destination {
  388. group {
  389. network-group Private_Networks
  390. }
  391. }
  392. log disable
  393. protocol all
  394. }
  395. }
  396. name Guest_local {
  397. default-action accept
  398. description "Guest to Router"
  399. rule 1 {
  400. action accept
  401. description "Allow established/related"
  402. log disable
  403. protocol all
  404. state {
  405. established enable
  406. related enable
  407. }
  408. }
  409. rule 2 {
  410. action drop
  411. description "Drop invalid"
  412. log enable
  413. protocol all
  414. state {
  415. invalid enable
  416. }
  417. }
  418. rule 3 {
  419. action drop
  420. description "Drop access to Private networks"
  421. destination {
  422. group {
  423. network-group Private_Networks
  424. }
  425. }
  426. log disable
  427. protocol all
  428. }
  429. rule 4 {
  430. action drop
  431. description "Drop access to cameras"
  432. destination {
  433. group {
  434. network-group Camera_Network
  435. }
  436. }
  437. log disable
  438. protocol all
  439. }
  440. }
  441. name Management_in {
  442. default-action accept
  443. description ""
  444. rule 1 {
  445. action accept
  446. description "Allow established/related"
  447. log disable
  448. protocol all
  449. state {
  450. established enable
  451. invalid disable
  452. new disable
  453. related enable
  454. }
  455. }
  456. rule 3 {
  457. action drop
  458. description "Drop invalid"
  459. log disable
  460. protocol all
  461. state {
  462. established disable
  463. invalid enable
  464. new disable
  465. related disable
  466. }
  467. }
  468. }
  469. name Management_local {
  470. default-action accept
  471. description ""
  472. rule 1 {
  473. action accept
  474. description "Allow established/related"
  475. log disable
  476. protocol all
  477. state {
  478. established enable
  479. invalid disable
  480. new disable
  481. related enable
  482. }
  483. }
  484. rule 2 {
  485. action drop
  486. description "Drop invalid"
  487. log disable
  488. protocol all
  489. state {
  490. established disable
  491. invalid enable
  492. new disable
  493. related disable
  494. }
  495. }
  496. }
  497. name Server_In {
  498. default-action accept
  499. description ""
  500. rule 1 {
  501. action accept
  502. description "Allow established/related"
  503. log disable
  504. protocol all
  505. state {
  506. established enable
  507. invalid disable
  508. new disable
  509. related enable
  510. }
  511. }
  512. rule 2 {
  513. action drop
  514. description "Drop invalid"
  515. log disable
  516. protocol all
  517. state {
  518. established disable
  519. invalid enable
  520. new disable
  521. related disable
  522. }
  523. }
  524. }
  525. name Server_local {
  526. default-action accept
  527. description ""
  528. rule 1 {
  529. action accept
  530. description "Allow established/related"
  531. log disable
  532. protocol all
  533. state {
  534. established enable
  535. invalid disable
  536. new disable
  537. related enable
  538. }
  539. }
  540. rule 2 {
  541. action drop
  542. description "Drop invalid"
  543. log disable
  544. protocol all
  545. state {
  546. established disable
  547. invalid enable
  548. new disable
  549. related disable
  550. }
  551. }
  552. }
  553. name WAN_in {
  554. default-action drop
  555. description "Internet to internal networks"
  556. enable-default-log
  557. rule 1 {
  558. action accept
  559. description "Allow established/related"
  560. log disable
  561. protocol all
  562. state {
  563. established enable
  564. related enable
  565. }
  566. }
  567. rule 2 {
  568. action drop
  569. description "Drop invalid"
  570. log enable
  571. protocol all
  572. state {
  573. invalid enable
  574. }
  575. }
  576. rule 3 {
  577. action accept
  578. description "Allow Plex"
  579. destination {
  580. address 10.0.10.55
  581. port 32400
  582. }
  583. log disable
  584. protocol tcp_udp
  585. source {
  586. port 32400
  587. }
  588. }
  589. }
  590. name WAN_local {
  591. default-action drop
  592. description "Internet to router"
  593. enable-default-log
  594. rule 1 {
  595. action accept
  596. description "Allow established/related"
  597. log disable
  598. protocol all
  599. state {
  600. established enable
  601. related enable
  602. }
  603. }
  604. rule 5 {
  605. action drop
  606. description "Drop invalid"
  607. log enable
  608. protocol all
  609. state {
  610. invalid enable
  611. }
  612. }
  613. rule 10 {
  614. action accept
  615. description "Limit ICMP"
  616. limit {
  617. burst 3
  618. rate 30/minute
  619. }
  620. log enable
  621. protocol icmp
  622. }
  623. }
  624. name WAN_out {
  625. default-action accept
  626. description "Traffic to internet"
  627. rule 1 {
  628. action accept
  629. description "Allow established/related"
  630. log disable
  631. protocol all
  632. state {
  633. established enable
  634. related enable
  635. }
  636. }
  637. rule 10 {
  638. action drop
  639. description "Block SMTP port 25"
  640. destination {
  641. port 25
  642. }
  643. log enable
  644. protocol tcp
  645. }
  646. }
  647. receive-redirects disable
  648. send-redirects enable
  649. source-validation disable
  650. syn-cookies enable
  651. }
  652. interfaces {
  653. ethernet eth0 {
  654. address 192.168.2.125/24
  655. description eth0_Maintenance
  656. duplex auto
  657. speed auto
  658. }
  659. ethernet eth1 {
  660. description eth1_GFiberJack
  661. duplex auto
  662. speed auto
  663. vif 2 {
  664. address dhcp
  665. description Google_Fiber
  666. dhcp-options {
  667. default-route update
  668. default-route-distance 210
  669. name-server update
  670. }
  671. dhcpv6-pd {
  672. pd 1 {
  673. interface eth2.5 {
  674. host-address ::1
  675. prefix-id :5
  676. service slaac
  677. }
  678. interface eth2.10 {
  679. host-address ::1
  680. prefix-id :10
  681. service slaac
  682. }
  683. interface eth2.20 {
  684. host-address ::1
  685. prefix-id :20
  686. service slaac
  687. }
  688. interface eth2.30 {
  689. host-address ::1
  690. prefix-id :30
  691. service slaac
  692. }
  693. interface eth2.40 {
  694. host-address ::1
  695. prefix-id :40
  696. service slaac
  697. }
  698. prefix-length /56
  699. }
  700. rapid-commit enable
  701. }
  702. egress-qos 0:2
  703. firewall {
  704. in {
  705. ipv6-name WAN_in_v6
  706. name WAN_in
  707. }
  708. local {
  709. ipv6-name WAN_local_v6
  710. name WAN_local
  711. }
  712. out {
  713. name WAN_out
  714. }
  715. }
  716. ipv6 {
  717. address {
  718. autoconf
  719. }
  720. dup-addr-detect-transmits 1
  721. }
  722. }
  723. }
  724. ethernet eth2 {
  725. duplex auto
  726. speed auto
  727. vif 5 {
  728. address 10.0.5.1/24
  729. description Private_Maintenance
  730. firewall {
  731. in {
  732. ipv6-name LAN_in_v6
  733. name Management_in
  734. }
  735. local {
  736. ipv6-name LAN_local_v6
  737. name Management_local
  738. }
  739. }
  740. ipv6 {
  741. dup-addr-detect-transmits 1
  742. router-advert {
  743. cur-hop-limit 64
  744. link-mtu 0
  745. managed-flag false
  746. max-interval 600
  747. other-config-flag false
  748. prefix ::/64 {
  749. autonomous-flag true
  750. on-link-flag true
  751. valid-lifetime 2592000
  752. }
  753. radvd-options "RDNSS fe80::<REDACTED> {};"
  754. reachable-time 0
  755. retrans-timer 0
  756. send-advert true
  757. }
  758. }
  759. }
  760. vif 10 {
  761. address 10.0.10.1/24
  762. description Private_Servers
  763. firewall {
  764. in {
  765. ipv6-name LAN_in_v6
  766. name Server_In
  767. }
  768. local {
  769. ipv6-name LAN_local_v6
  770. name Server_local
  771. }
  772. }
  773. ipv6 {
  774. dup-addr-detect-transmits 1
  775. router-advert {
  776. cur-hop-limit 64
  777. link-mtu 0
  778. managed-flag false
  779. max-interval 600
  780. other-config-flag false
  781. prefix ::/64 {
  782. autonomous-flag true
  783. on-link-flag true
  784. valid-lifetime 2592000
  785. }
  786. radvd-options "RDNSS fe80::<REDACTED> {};"
  787. reachable-time 0
  788. retrans-timer 0
  789. send-advert true
  790. }
  791. }
  792. }
  793. vif 20 {
  794. address 10.0.20.1/24
  795. description Private_Devices
  796. firewall {
  797. in {
  798. ipv6-name LAN_in_v6
  799. name Devices_in
  800. }
  801. local {
  802. ipv6-name LAN_local_v6
  803. name Devices_local
  804. }
  805. }
  806. ipv6 {
  807. dup-addr-detect-transmits 1
  808. router-advert {
  809. cur-hop-limit 64
  810. link-mtu 0
  811. managed-flag false
  812. max-interval 600
  813. other-config-flag false
  814. prefix ::/64 {
  815. autonomous-flag true
  816. on-link-flag true
  817. valid-lifetime 2592000
  818. }
  819. radvd-options "RDNSS fe80::<REDACTED> {};"
  820. reachable-time 0
  821. retrans-timer 0
  822. send-advert true
  823. }
  824. }
  825. }
  826. vif 30 {
  827. address 10.0.30.1/24
  828. description Guest
  829. firewall {
  830. in {
  831. ipv6-name Guest_in_v6
  832. name Guest_in
  833. }
  834. local {
  835. ipv6-name Guest_local_v6
  836. name Guest_local
  837. }
  838. }
  839. }
  840. vif 40 {
  841. address 10.0.40.1/24
  842. description Private_Cameras
  843. firewall {
  844. in {
  845. name Camera_In
  846. }
  847. local {
  848. name Camera_local
  849. }
  850. }
  851. ipv6 {
  852. dup-addr-detect-transmits 1
  853. router-advert {
  854. cur-hop-limit 64
  855. link-mtu 0
  856. managed-flag false
  857. max-interval 600
  858. other-config-flag false
  859. prefix ::/64 {
  860. autonomous-flag true
  861. on-link-flag true
  862. valid-lifetime 2592000
  863. }
  864. radvd-options "RDNSS fe80::<REDACTED> {};"
  865. reachable-time 0
  866. retrans-timer 0
  867. send-advert true
  868. }
  869. }
  870. }
  871. }
  872. loopback lo {
  873. }
  874. }
  875. port-forward {
  876. auto-firewall enable
  877. hairpin-nat enable
  878. lan-interface eth2.5
  879. lan-interface eth2.10
  880. lan-interface eth2.20
  881. lan-interface eth2.30
  882. lan-interface eth2.40
  883. rule 1 {
  884. description "Plex Server"
  885. forward-to {
  886. address 10.0.10.55
  887. port 32400
  888. }
  889. original-port 32400
  890. protocol tcp_udp
  891. }
  892. rule 2 {
  893. description "mqqt owntracks"
  894. forward-to {
  895. address 10.0.10.52
  896. port 18883
  897. }
  898. original-port 18883
  899. protocol tcp_udp
  900. }
  901. rule 6 {
  902. description guacamole
  903. forward-to {
  904. address 10.0.10.57
  905. port 8080
  906. }
  907. original-port 8080
  908. protocol tcp_udp
  909. }
  910. wan-interface eth1.2
  911. }
  912. service {
  913. dhcp-server {
  914. disabled false
  915. hostfile-update enable
  916. shared-network-name DHCP_Guest {
  917. authoritative disable
  918. subnet 10.0.30.0/24 {
  919. default-router 10.0.30.1
  920. dns-server 8.8.8.8
  921. dns-server 8.8.4.4
  922. lease 86400
  923. start 10.0.30.100 {
  924. stop 10.0.30.199
  925. }
  926. }
  927. }
  928. shared-network-name DHCP_Maintenance {
  929. authoritative disable
  930. subnet 10.0.5.0/24 {
  931. default-router 10.0.5.1
  932. dns-server 10.0.10.58
  933. dns-server 10.0.10.60
  934. lease 86400
  935. start 10.0.5.100 {
  936. stop 10.0.5.199
  937. }
  938. }
  939. }
  940. shared-network-name DHCP_Private_Cameras {
  941. authoritative disable
  942. subnet 10.0.40.0/24 {
  943. default-router 10.0.40.1
  944. dns-server 8.8.8.8
  945. dns-server 8.8.4.4
  946. lease 86400
  947. start 10.0.40.100 {
  948. stop 10.0.40.199
  949. }
  950. }
  951. }
  952. shared-network-name DHCP_Private_Devices {
  953. authoritative disable
  954. subnet 10.0.20.0/24 {
  955. default-router 10.0.20.1
  956. dns-server 10.0.10.58
  957. dns-server 10.0.10.60
  958. lease 86400
  959. start 10.0.20.100 {
  960. stop 10.0.20.199
  961. }
  962. }
  963. }
  964. shared-network-name DHCP_Private_Server {
  965. authoritative disable
  966. subnet 10.0.10.0/24 {
  967. default-router 10.0.10.1
  968. dns-server 10.0.10.58
  969. dns-server 10.0.10.60
  970. lease 86400
  971. start 10.0.10.100 {
  972. stop 10.0.10.199
  973. }
  974. }
  975. }
  976. use-dnsmasq disable
  977. }
  978. dns {
  979. dynamic {
  980. interface eth1.2 {
  981. service custom {
  982. host-name <REDACTED>
  983. login <REDACTED>
  984. password <REDACTED>
  985. protocol <REDACTED>
  986. server <REDACTED>
  987. }
  988. }
  989. }
  990. forwarding {
  991. cache-size 500
  992. listen-on eth2
  993. name-server 2001:4860:4860::8888
  994. name-server 2001:4860:4860::8844
  995. name-server 8.8.8.8
  996. name-server 8.8.4.4
  997. }
  998. }
  999. gui {
  1000. http-port 80
  1001. https-port 443
  1002. older-ciphers enable
  1003. }
  1004. nat {
  1005. rule 5000 {
  1006. description "Masquerade to WAN"
  1007. log disable
  1008. outbound-interface eth1.2
  1009. protocol all
  1010. type masquerade
  1011. }
  1012. }
  1013. snmp {
  1014. community <REDACTED> {
  1015. authorization ro
  1016. }
  1017. contact <REDACTED>
  1018. location <REDACTED>
  1019. }
  1020. ssh {
  1021. port 22
  1022. protocol-version v2
  1023. }
  1024. unms {
  1025. connection wss://<REDACTED>
  1026. }
  1027. }
  1028. system {
  1029. conntrack {
  1030. expect-table-size 4096
  1031. hash-size 4096
  1032. table-size 32768
  1033. tcp {
  1034. half-open-connections 512
  1035. loose disable
  1036. max-retrans 3
  1037. }
  1038. }
  1039. host-name ubnt
  1040. login {
  1041. user gx1400 {
  1042. authentication {
  1043. encrypted-password <REDACTED>
  1044. plaintext-password ""
  1045. }
  1046. level admin
  1047. }
  1048. }
  1049. name-server 2001:4860:4860::8888
  1050. name-server 2001:4860:4860::8844
  1051. name-server 8.8.8.8
  1052. name-server 8.8.4.4
  1053. ntp {
  1054. server 0.ubnt.pool.ntp.org {
  1055. }
  1056. server 1.ubnt.pool.ntp.org {
  1057. }
  1058. server 2.ubnt.pool.ntp.org {
  1059. }
  1060. server 3.ubnt.pool.ntp.org {
  1061. }
  1062. }
  1063. offload {
  1064. hwnat disable
  1065. ipsec enable
  1066. ipv4 {
  1067. forwarding enable
  1068. vlan enable
  1069. }
  1070. ipv6 {
  1071. forwarding enable
  1072. vlan enable
  1073. }
  1074. }
  1075. syslog {
  1076. global {
  1077. facility all {
  1078. level notice
  1079. }
  1080. facility protocols {
  1081. level debug
  1082. }
  1083. }
  1084. }
  1085. time-zone <REDACTED>
  1086. }
  1087.  
  1088.  
  1089. /* Warning: Do not remove the following line. */
  1090. /* === vyatta-config-version: "config-management@1:conntrack@1:cron@1:dhcp-relay@1:dhcp-server@4:firewall@5:ipsec@5:nat@3:qos@1:quagga@2:system@4:ubnt-pptp@1:ubnt-unms@1:ubnt-util@1:vrrp@1:webgui@1:webproxy@1:zone-policy@1" === */
  1091. /* Release version: v1.9.7+hotfix.4.5024004.171005.0403 */
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement