SRX-config

security {
    screen {
        ids-option untrust-screen {
		...
	}
    }
    nat {
        source {
            rule-set trust-to-untrust {
                from zone trust;
                to zone untrust;
                rule source-nat-rule {
                    match {
                        source-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
        }
        destination {
            pool Server2 {
                address 10.0.0.19/32;
            }
            pool Server1 {
                address 10.0.0.18/32;
            }
            rule-set untrust-to-trust {
                from zone untrust;
                rule server2-external {
                    match {
                        destination-address 0.0.0.0/0;
                        destination-port {
                            443;
                            55395;
                            26833;
                        }
                    }
                    then {
                        destination-nat {
                            pool {
                                Server2;
                            }
                        }
                    }
                }
                rule server1-external {
                    match {
                        destination-address 0.0.0.0/0;
                        destination-port {
                            26733;
                        }
                    }
                    then {
                        destination-nat {
                            pool {
                                Server1;
                            }
                        }
                    }
                }
            }
        }
    }
    policies {
        from-zone trust to-zone trust {
            policy trust-to-trust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone untrust {
            policy trust-to-untrust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone untrust to-zone trust {
            policy external-server2 {
                description "SSH Access to Server2";
                match {
                    source-address any;
                    destination-address Server2;
                    application SSH-DNAT-SERVER2;
                }
                then {
                    permit;
                }
            }
            policy external-server1 {
                description "SSH Access to Server1";
                match {
                    source-address any;
                    destination-address Server1;
                    application SSH-DNAT-SERVER1;
                }
                then {
                    permit;
                }
            }
        }
    }
    zones {
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                irb.3;
                irb.4;
            }
        }
	security-zone untrust {
            screen untrust-screen;
            interfaces {
                irb.2 {
                    host-inbound-traffic {
                        system-services {
                            dhcp;
                            ssh;
                            snmp;
                            ping;
                            bootp;
                            ike;
                            https;
                        }
                    }
                }
            }
        }
    }
}
interfaces {
    ge-0/0/0 {
        description ISP;
        unit 0 {
            family ethernet-switching {
                interface-mode access;
                vlan {
                    members 2;
                }
            }
        }
    }
    ge-0/0/1 {
        description Server1;
        unit 0 {
            family ethernet-switching {
                interface-mode access;
                vlan {
                    members 3;
                }
            }
        }
    }
    ge-0/0/2 {
        description Server2;
        unit 0 {
            family ethernet-switching {
                interface-mode access;
                vlan {
                    members 3;
                }
            }
        }
    }
    ge-0/0/3 {
        description WiFi;
        unit 0 {
            family ethernet-switching {
                interface-mode access;
                vlan {
                    members 4;
                }
            }
        }
    }
    ge-0/0/4 {
    	....
    }
    ge-0/0/5 {
	....
    }
    ge-0/0/6 {
        description "Inactive Interface";
        disable;
    }
    ge-0/0/7 {
        description "Inactive Interface";
        disable;
    }
    irb {
        unit 2 {
            description "ISP Network";
            family inet {
                dhcp-client {
                    retransmission-attempt 6;
                    retransmission-interval 5;
                    update-server;
                }
                filter {
                    input External;
                }
            }
        }
        unit 3 {
            description "Servers Network";
            family inet {
                no-redirects;
                address 10.0.0.17/29;
            }
        }
        unit 4 {
            description "DHCP Network";
            family inet {
                no-redirects;
                address 10.0.0.1/28;
            }
        }
    }
}
protocols {
    l2-learning {
        global-mode switching;
    }
}
firewall {
    family inet {
        filter External {
            interface-specific;
            term permit-ssh {
                from {
                    source-prefix-list {
                        Management;
                    }
                    protocol tcp;
                    destination-port ssh;
                }
                then accept;
            }
            term deny-ssh {
                from {
                    protocol tcp;
                    destination-port ssh;
                }
                then {
                    discard;
                }
            }
            term permit-snmp {
                from {
                    source-prefix-list {
                        SNMP;
                    }
                    protocol udp;
                    destination-port snmp;
                }
                then accept;
            }
            term deny-snmp {
                from {
                    protocol udp;
                    destination-port snmp;
                }
                then {
                    discard;
                }
            }
            term all-else-accept {
                then accept;
            }
        }
    }
}

access {
    address-assignment {
        pool DHCPPool {
            family inet {
                network 10.0.0.0/28;
                dhcp-attributes {
                    name-server {
                        10.0.0.18;
			8.8.8.8
                    }                    }
                    router {
                        10.0.0.1;
                    }
                }
                excluded-address 10.0.0.2;
                excluded-address 10.0.0.1;
            }
        }
    }
}
vlans {
    vlan-dhcp {
        description "DHCP VLAN";
        vlan-id 4;
        l3-interface irb.4;
    }
    vlan-isp {
        description "ISP VLAN";
        vlan-id 2;
        l3-interface irb.2;
    }
    vlan-servers {
        description "Servers VLAN";
        vlan-id 3;
        l3-interface irb.3;
    }
}