<?xml version="1.0"?>
<opnsense>
  <theme>opnsense</theme>
  <sysctl>
    <item>
      <descr>Disable the pf ftp proxy handler.</descr>
      <tunable>debug.pfftpproxy</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Increase UFS read-ahead speeds to match the state of hard drives and NCQ.</descr>
      <tunable>vfs.read_max</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Set the ephemeral port range to be lower.</descr>
      <tunable>net.inet.ip.portrange.first</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Drop packets to closed TCP ports without returning a RST</descr>
      <tunable>net.inet.tcp.blackhole</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Do not send ICMP port unreachable messages for closed UDP ports</descr>
      <tunable>net.inet.udp.blackhole</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Randomize the ID field in IP packets (default is 0: sequential IP IDs)</descr>
      <tunable>net.inet.ip.random_id</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>
        Source routing is another way for an attacker to try to reach non-routable addresses behind your box.
        It can also be used to probe for information about your internal networks. These functions come enabled
        as part of the standard FreeBSD core system.
      </descr>
      <tunable>net.inet.ip.sourceroute</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>
        Source routing is another way for an attacker to try to reach non-routable addresses behind your box.
        It can also be used to probe for information about your internal networks. These functions come enabled
        as part of the standard FreeBSD core system.
      </descr>
      <tunable>net.inet.ip.accept_sourceroute</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>
        This option turns off the logging of redirect packets because there is no limit and this could fill
        up your logs consuming your whole hard drive.
      </descr>
      <tunable>net.inet.icmp.log_redirect</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Drop SYN-FIN packets (breaks RFC1379, but nobody uses it anyway)</descr>
      <tunable>net.inet.tcp.drop_synfin</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Enable sending IPv6 redirects</descr>
      <tunable>net.inet6.ip6.redirect</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Enable privacy settings for IPv6 (RFC 4941)</descr>
      <tunable>net.inet6.ip6.use_tempaddr</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Prefer privacy addresses and use them over the normal addresses</descr>
      <tunable>net.inet6.ip6.prefer_tempaddr</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Generate SYN cookies for outbound SYN-ACK packets</descr>
      <tunable>net.inet.tcp.syncookies</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Maximum incoming/outgoing TCP datagram size (receive)</descr>
      <tunable>net.inet.tcp.recvspace</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Maximum incoming/outgoing TCP datagram size (send)</descr>
      <tunable>net.inet.tcp.sendspace</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Do not delay ACK to try and piggyback it onto a data packet</descr>
      <tunable>net.inet.tcp.delayed_ack</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Maximum outgoing UDP datagram size</descr>
      <tunable>net.inet.udp.maxdgram</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Handling of non-IP packets which are not passed to pfil (see if_bridge(4))</descr>
      <tunable>net.link.bridge.pfil_onlyip</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Set to 1 to additionally filter on the physical interface for locally destined packets</descr>
      <tunable>net.link.bridge.pfil_local_phys</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Set to 0 to disable filtering on the incoming and outgoing member interfaces.</descr>
      <tunable>net.link.bridge.pfil_member</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Set to 1 to enable filtering on the bridge interface</descr>
      <tunable>net.link.bridge.pfil_bridge</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Allow unprivileged access to tap(4) device nodes</descr>
      <tunable>net.link.tap.user_open</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Randomize PID's (see src/sys/kern/kern_fork.c: sysctl_kern_randompid())</descr>
      <tunable>kern.randompid</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Maximum size of the IP input queue</descr>
      <tunable>net.inet.ip.intr_queue_maxlen</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Disable CTRL+ALT+Delete reboot from keyboard.</descr>
      <tunable>hw.syscons.kbd_reboot</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Enable TCP extended debugging</descr>
      <tunable>net.inet.tcp.log_debug</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Set ICMP Limits</descr>
      <tunable>net.inet.icmp.icmplim</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>TCP Offload Engine</descr>
      <tunable>net.inet.tcp.tso</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>UDP Checksums</descr>
      <tunable>net.inet.udp.checksum</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Maximum socket buffer size</descr>
      <tunable>kern.ipc.maxsockbuf</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Page Table Isolation (Meltdown mitigation, requires reboot.)</descr>
      <tunable>vm.pmap.pti</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Disable Indirect Branch Restricted Speculation (Spectre V2 mitigation)</descr>
      <tunable>hw.ibrs_disable</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Hide processes running as other groups</descr>
      <tunable>security.bsd.see_other_gids</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Hide processes running as other users</descr>
      <tunable>security.bsd.see_other_uids</tunable>
      <value>default</value>
    </item>
    <item>
      <descr>Enable/disable sending of ICMP redirects in response to IP packets for which a better,
        and for the sender directly reachable, route and next hop is known.
      </descr>
      <tunable>net.inet.ip.redirect</tunable>
      <value>0</value>
    </item>
    <item>
      <descr>
        Redirect attacks are the purposeful mass-issuing of ICMP type 5 packets. In a normal network, redirects
        to the end stations should not be required. This option enables the NIC to drop all inbound ICMP redirect
        packets without returning a response.
      </descr>
      <tunable>net.inet.icmp.drop_redirect</tunable>
      <value>1</value>
    </item>
  </sysctl>
  <system>
    <optimization>normal</optimization>
    <hostname>OPNsense</hostname>
    <domain>domain</domain>
    <dnsallowoverride>on</dnsallowoverride>
    <group>
      <name>admins</name>
      <description>System Administrators</description>
      <scope>system</scope>
      <gid>1999</gid>
      <member>0</member>
      <member>2000</member>
      <priv>page-all</priv>
    </group>
    <user>
      <name>root</name>
      <descr>System Administrator</descr>
      <scope>system</scope>
      <groupname>admins</groupname>
      <password>$2y$10$ZC.BQupAO7n2klHD8iP/duOsY3QP5CcTnVlI/hXYl7KRCfXW2/kZC</password>
      <uid>0</uid>
    </user>
    <user>
      <password>$2y$10$P6jwlgU6SdaCdAAaUHqeB.hqvNjUk16CMR7.5asMjsoGB3Z6TWO3G</password>
      <scope>user</scope>
      <name>admin</name>
      <descr/>
      <expires/>
      <authorizedkeys/>
      <ipsecpsk/>
      <otp_seed/>
      <email>myemail</email>
      <uid>2000</uid>
    </user>
    <nextuid>2001</nextuid>
    <nextgid>2000</nextgid>
    <timezone>America/Chicago</timezone>
    <timeservers>0.opnsense.pool.ntp.org 1.opnsense.pool.ntp.org 2.opnsense.pool.ntp.org 3.opnsense.pool.ntp.org</timeservers>
    <webgui>
      <protocol>https</protocol>
      <ssl-certref>5dc6480491d59</ssl-certref>
    </webgui>
    <disablenatreflection>yes</disablenatreflection>
    <usevirtualterminal>1</usevirtualterminal>
    <disableconsolemenu/>
    <disablevlanhwfilter>2</disablevlanhwfilter>
    <disablechecksumoffloading>1</disablechecksumoffloading>
    <disablesegmentationoffloading>1</disablesegmentationoffloading>
    <disablelargereceiveoffloading>1</disablelargereceiveoffloading>
    <ipv6allow/>
    <powerd_ac_mode>hadp</powerd_ac_mode>
    <powerd_battery_mode>hadp</powerd_battery_mode>
    <powerd_normal_mode>hadp</powerd_normal_mode>
    <bogons>
      <interval>monthly</interval>
    </bogons>
    <kill_states/>
    <backupcount>60</backupcount>
    <crypto_hardware>aesni</crypto_hardware>
    <pf_share_forward>1</pf_share_forward>
    <lb_use_sticky>1</lb_use_sticky>
    <ssh>
      <group>admins</group>
    </ssh>
    <backup>
      <nextcloud version="1.0.0">
        <enabled>0</enabled>
        <url/>
        <user/>
        <password/>
        <password_encryption/>
        <backupdir>OPNsense-Backup</backupdir>
      </nextcloud>
    </backup>
    <language>en_US</language>
    <dnsserver>1.1.1.1</dnsserver>
    <dnsserver>8.8.4.4</dnsserver>
  </system>
  <interfaces>
    <lan>
      <if>re0</if>
      <descr>LAN</descr>
      <enable>1</enable>
      <lock>1</lock>
      <spoofmac/>
      <ipaddr>172.20.100.254</ipaddr>
      <subnet>24</subnet>
      <ipaddrv6>track6</ipaddrv6>
      <track6-interface>wan</track6-interface>
      <track6-prefix-id>0</track6-prefix-id>
    </lan>
    <wan>
      <if>em0</if>
      <descr/>
      <enable>1</enable>
      <lock>1</lock>
      <blockpriv>on</blockpriv>
      <blockbogons>on</blockbogons>
      <ipaddr>dhcp</ipaddr>
      <alias-address/>
      <alias-subnet>32</alias-subnet>
      <dhcprejectfrom/>
      <adv_dhcp_pt_timeout/>
      <adv_dhcp_pt_retry/>
      <adv_dhcp_pt_select_timeout/>
      <adv_dhcp_pt_reboot/>
      <adv_dhcp_pt_backoff_cutoff/>
      <adv_dhcp_pt_initial_interval/>
      <adv_dhcp_pt_values>SavedCfg</adv_dhcp_pt_values>
      <adv_dhcp_send_options/>
      <adv_dhcp_request_options/>
      <adv_dhcp_required_options/>
      <adv_dhcp_option_modifiers/>
      <adv_dhcp_config_advanced/>
      <adv_dhcp_config_file_override/>
      <adv_dhcp_config_file_override_path/>
      <ipaddrv6>dhcp6</ipaddrv6>
      <dhcp6-ia-pd-len>0</dhcp6-ia-pd-len>
      <adv_dhcp6_interface_statement_send_options/>
      <adv_dhcp6_interface_statement_request_options/>
      <adv_dhcp6_interface_statement_information_only_enable/>
      <adv_dhcp6_interface_statement_script/>
      <adv_dhcp6_id_assoc_statement_address_enable/>
      <adv_dhcp6_id_assoc_statement_address/>
      <adv_dhcp6_id_assoc_statement_address_id/>
      <adv_dhcp6_id_assoc_statement_address_pltime/>
      <adv_dhcp6_id_assoc_statement_address_vltime/>
      <adv_dhcp6_id_assoc_statement_prefix_enable/>
      <adv_dhcp6_id_assoc_statement_prefix/>
      <adv_dhcp6_id_assoc_statement_prefix_id/>
      <adv_dhcp6_id_assoc_statement_prefix_pltime/>
      <adv_dhcp6_id_assoc_statement_prefix_vltime/>
      <adv_dhcp6_prefix_interface_statement_sla_len/>
      <adv_dhcp6_authentication_statement_authname/>
      <adv_dhcp6_authentication_statement_protocol/>
      <adv_dhcp6_authentication_statement_algorithm/>
      <adv_dhcp6_authentication_statement_rdm/>
      <adv_dhcp6_key_info_statement_keyname/>
      <adv_dhcp6_key_info_statement_realm/>
      <adv_dhcp6_key_info_statement_keyid/>
      <adv_dhcp6_key_info_statement_secret/>
      <adv_dhcp6_key_info_statement_expire/>
      <adv_dhcp6_config_advanced/>
      <adv_dhcp6_config_file_override/>
      <adv_dhcp6_config_file_override_path/>
    </wan>
    <opt1>
      <if>ue0</if>
      <descr>GUIConsole</descr>
      <enable>1</enable>
      <spoofmac/>
      <ipaddr>192.168.10.1</ipaddr>
      <subnet>24</subnet>
    </opt1>
    <opt2>
      <if>re0_vlan100</if>
      <descr>VLAN100</descr>
      <spoofmac/>
      <ipaddr>172.20.100.254</ipaddr>
      <subnet>32</subnet>
    </opt2>
    <opt3>
      <if>re0_vlan200</if>
      <descr>VLAN200</descr>
      <spoofmac/>
    </opt3>
    <opt4>
      <if>re0_vlan10</if>
      <descr>VLAN10</descr>
      <enable>1</enable>
      <spoofmac/>
      <ipaddr>172.20.10.254</ipaddr>
      <subnet>24</subnet>
    </opt4>
    <opt5>
      <if>re0_vlan20</if>
      <descr>VLAN20</descr>
      <enable>1</enable>
      <spoofmac/>
      <ipaddr>172.20.20.254</ipaddr>
      <subnet>32</subnet>
    </opt5>
  </interfaces>
  <dhcpd>
    <lan>
      <range>
        <from>172.20.100.150</from>
        <to>172.20.100.190</to>
      </range>
      <enable>1</enable>
    </lan>
    <opt1>
      <enable>1</enable>
      <range>
        <from>192.168.10.5</from>
        <to>192.168.10.20</to>
      </range>
    </opt1>
    <opt4>
      <enable>1</enable>
      <ddnsdomainalgorithm>hmac-md5</ddnsdomainalgorithm>
      <numberoptions>
        <item/>
      </numberoptions>
      <range>
        <from>172.20.10.1</from>
        <to>172.20.10.100</to>
      </range>
      <winsserver/>
      <dnsserver/>
      <ntpserver/>
    </opt4>
  </dhcpd>
  <unbound>
    <enable>on</enable>
    <domainoverrides/>
  </unbound>
  <snmpd>
    <syslocation/>
    <syscontact/>
    <rocommunity>public</rocommunity>
  </snmpd>
  <syslog>
    <reverse/>
  </syslog>
  <filter>
    <rule>
      <type>pass</type>
      <ipprotocol>inet</ipprotocol>
      <descr>Default allow LAN to any rule</descr>
      <interface>lan</interface>
      <source>
        <network>lan</network>
      </source>
      <destination>
        <any/>
      </destination>
    </rule>
    <rule>
      <type>pass</type>
      <ipprotocol>inet6</ipprotocol>
      <descr>Default allow LAN IPv6 to any rule</descr>
      <interface>lan</interface>
      <source>
        <network>lan</network>
      </source>
      <destination>
        <any/>
      </destination>
    </rule>
    <rule>
      <type>pass</type>
      <interface>opt2</interface>
      <ipprotocol>inet</ipprotocol>
      <statetype>keep state</statetype>
      <source>
        <any>1</any>
      </source>
      <destination>
        <any>1</any>
      </destination>
      <updated>
        <username>[email protected]</username>
        <time>1573311825.5039</time>
        <description>/firewall_rules_edit.php made changes</description>
      </updated>
      <created>
        <username>[email protected]</username>
        <time>1573311825.5039</time>
        <description>/firewall_rules_edit.php made changes</description>
      </created>
    </rule>
    <rule>
      <type>pass</type>
      <interface>opt2</interface>
      <ipprotocol>inet6</ipprotocol>
      <statetype>keep state</statetype>
      <source>
        <any>1</any>
      </source>
      <destination>
        <any>1</any>
      </destination>
      <updated>
        <username>[email protected]</username>
        <time>1573311903.2664</time>
        <description>/firewall_rules_edit.php made changes</description>
      </updated>
      <created>
        <username>[email protected]</username>
        <time>1573311903.2664</time>
        <description>/firewall_rules_edit.php made changes</description>
      </created>
    </rule>
  </filter>
  <rrd>
    <enable/>
  </rrd>
  <load_balancer>
    <monitor_type>
      <name>ICMP</name>
      <type>icmp</type>
      <descr>ICMP</descr>
      <options/>
    </monitor_type>
    <monitor_type>
      <name>TCP</name>
      <type>tcp</type>
      <descr>Generic TCP</descr>
      <options/>
    </monitor_type>
    <monitor_type>
      <name>HTTP</name>
      <type>http</type>
      <descr>Generic HTTP</descr>
      <options>
        <path>/</path>
        <host/>
        <code>200</code>
      </options>
    </monitor_type>
    <monitor_type>
      <name>HTTPS</name>
      <type>https</type>
      <descr>Generic HTTPS</descr>
      <options>
        <path>/</path>
        <host/>
        <code>200</code>
      </options>
    </monitor_type>
    <monitor_type>
      <name>SMTP</name>
      <type>send</type>
      <descr>Generic SMTP</descr>
      <options>
        <send/>
        <expect>220 *</expect>
      </options>
    </monitor_type>
  </load_balancer>
  <ntpd>
    <prefer>0.opnsense.pool.ntp.org</prefer>
  </ntpd>
  <widgets>
    <sequence>system_information-container:00000000-col3:show,services_status-container:00000001-col4:show,gateways-container:00000002-col4:show,interface_list-container:00000003-col4:show</sequence>
    <column_count>2</column_count>
  </widgets>
  <revision>
    <username>[email protected]</username>
    <time>1573314321.8641</time>
    <description>/interfaces.php made changes</description>
  </revision>
  <OPNsense>
    <Firewall>
      <Alias version="1.0.0">
        <aliases/>
      </Alias>
    </Firewall>
    <OpenVPNExport version="0.0.1">
      <servers/>
    </OpenVPNExport>
    <captiveportal version="1.0.0">
      <zones/>
      <templates/>
    </captiveportal>
    <cron version="1.0.1">
      <jobs/>
    </cron>
    <TrafficShaper version="1.0.3">
      <pipes/>
      <queues/>
      <rules/>
    </TrafficShaper>
    <Syslog version="1.0.0">
      <general>
        <enabled>1</enabled>
      </general>
      <destinations/>
    </Syslog>
    <IDS version="1.0.3">
      <rules/>
      <userDefinedRules/>
      <files/>
      <fileTags/>
      <general>
        <enabled>0</enabled>
        <ips>0</ips>
        <promisc>0</promisc>
        <interfaces>wan</interfaces>
        <homenet>192.168.0.0/16,10.0.0.0/8,172.16.0.0/12</homenet>
        <defaultPacketSize/>
        <UpdateCron/>
        <AlertLogrotate>W0D23</AlertLogrotate>
        <AlertSaveLogs>4</AlertSaveLogs>
        <MPMAlgo>ac</MPMAlgo>
        <syslog>0</syslog>
        <syslog_eve>0</syslog_eve>
        <LogPayload>0</LogPayload>
      </general>
    </IDS>
    <proxy version="1.0.3">
      <general>
        <enabled>0</enabled>
        <icpPort/>
        <logging>
          <enable>
            <accessLog>1</accessLog>
            <storeLog>1</storeLog>
          </enable>
          <ignoreLogACL/>
          <target/>
        </logging>
        <alternateDNSservers/>
        <dnsV4First>0</dnsV4First>
        <forwardedForHandling>on</forwardedForHandling>
        <uriWhitespaceHandling>strip</uriWhitespaceHandling>
        <useViaHeader>1</useViaHeader>
        <suppressVersion>0</suppressVersion>
        <VisibleEmail>[email protected]</VisibleEmail>
        <VisibleHostname/>
        <cache>
          <local>
            <enabled>0</enabled>
            <directory>/var/squid/cache</directory>
            <cache_mem>256</cache_mem>
            <maximum_object_size/>
            <size>100</size>
            <l1>16</l1>
            <l2>256</l2>
            <cache_linux_packages>0</cache_linux_packages>
            <cache_windows_updates>0</cache_windows_updates>
          </local>
        </cache>
        <traffic>
          <enabled>0</enabled>
          <maxDownloadSize>2048</maxDownloadSize>
          <maxUploadSize>1024</maxUploadSize>
          <OverallBandwidthTrotteling>1024</OverallBandwidthTrotteling>
          <perHostTrotteling>256</perHostTrotteling>
        </traffic>
        <parentproxy>
          <enabled>0</enabled>
          <host/>
          <enableauth>0</enableauth>
          <user>username</user>
          <password>password</password>
          <port/>
          <localdomains/>
          <localips/>
        </parentproxy>
      </general>
      <forward>
        <interfaces>lan</interfaces>
        <port>3128</port>
        <sslbumpport>3129</sslbumpport>
        <sslbump>0</sslbump>
        <sslurlonly>0</sslurlonly>
        <sslcertificate/>
        <sslnobumpsites/>
        <ssl_crtd_storage_max_size>4</ssl_crtd_storage_max_size>
        <sslcrtd_children>5</sslcrtd_children>
        <snmp_enable>0</snmp_enable>
        <snmp_port>3401</snmp_port>
        <snmp_password>public</snmp_password>
        <ftpInterfaces/>
        <ftpPort>2121</ftpPort>
        <ftpTransparentMode>0</ftpTransparentMode>
        <addACLforInterfaceSubnets>1</addACLforInterfaceSubnets>
        <transparentMode>0</transparentMode>
        <acl>
          <allowedSubnets/>
          <unrestricted/>
          <bannedHosts/>
          <whiteList/>
          <blackList/>
          <browser/>
          <mimeType/>
          <safePorts>80:http,21:ftp,443:https,70:gopher,210:wais,1025-65535:unregistered ports,280:http-mgmt,488:gss-http,591:filemaker,777:multiling http</safePorts>
          <sslPorts>443:https</sslPorts>
          <remoteACLs>
            <blacklists/>
            <UpdateCron/>
          </remoteACLs>
        </acl>
        <icap>
          <enable>0</enable>
          <RequestURL>icap://[::1]:1344/avscan</RequestURL>
          <ResponseURL>icap://[::1]:1344/avscan</ResponseURL>
          <SendClientIP>1</SendClientIP>
          <SendUsername>0</SendUsername>
          <EncodeUsername>0</EncodeUsername>
          <UsernameHeader>X-Username</UsernameHeader>
          <EnablePreview>1</EnablePreview>
          <PreviewSize>1024</PreviewSize>
          <OptionsTTL>60</OptionsTTL>
          <exclude/>
        </icap>
        <authentication>
          <method/>
          <authEnforceGroup/>
          <realm>OPNsense proxy authentication</realm>
          <credentialsttl>2</credentialsttl>
          <children>5</children>
        </authentication>
      </forward>
      <pac/>
    </proxy>
    <openconnect>
      <general version="1.0.1">
        <enabled>0</enabled>
        <server>server</server>
        <user>user</user>
        <password>password</password>
        <servercert/>
        <hash>sha256</hash>
        <group/>
        <clientcertificate/>
      </general>
    </openconnect>
    <netsnmp>
      <user version="1.0.1">
        <users/>
      </user>
      <general version="1.0.1">
        <enabled>0</enabled>
        <community/>
        <syslocation/>
        <syscontact/>
        <l3visibility>0</l3visibility>
        <listen/>
      </general>
    </netsnmp>
    <AcmeClient version="1.6.0">
      <settings>
        <enabled>0</enabled>
        <autoRenewal>1</autoRenewal>
        <UpdateCron/>
        <environment>prod</environment>
        <challengePort>43580</challengePort>
        <restartTimeout>600</restartTimeout>
        <haproxyIntegration>0</haproxyIntegration>
        <haproxyAclRef/>
        <haproxyActionRef/>
        <haproxyServerRef/>
        <haproxyBackendRef/>
        <logLevel>normal</logLevel>
      </settings>
      <accounts/>
      <certificates/>
      <validations/>
      <actions/>
    </AcmeClient>
    <wireguard>
      <general version="0.0.1">
        <enabled>0</enabled>
      </general>
      <server version="0.0.2">
        <servers/>
      </server>
      <client version="0.0.4">
        <clients/>
      </client>
    </wireguard>
  </OPNsense>
  <ca/>
  <gateways>
    <gateway_item>
      <interface>opt1</interface>
      <gateway>dynamic</gateway>
      <name>GUICONSOLE_GW</name>
      <priority>254</priority>
      <weight>1</weight>
      <ipprotocol>inet</ipprotocol>
      <interval/>
      <descr>Interface GUICONSOLE_GW Gateway</descr>
      <monitor_disable>1</monitor_disable>
      <disabled>1</disabled>
    </gateway_item>
  </gateways>
  <cert>
    <refid>5dc6480491d59</refid>
    <descr>Web GUI SSL certificate</descr>
    <crt>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZiekNDQTFlZ0F3SUJBZ0lKQU9GMitnWVNSZWxYTUEwR0NTcUdTSWIzRFFFQkN3VUFNRTR4Q3pBSkJnTlYKQkFZVEFrNU1NUlV3RXdZRFZRUUlEQXhhZFdsa0xVaHZiR3hoYm1ReEZUQVRCZ05WQkFjTURFMXBaR1JsYkdoaApjbTVwY3pFUk1BOEdBMVVFQ2d3SVQxQk9jMlZ1YzJVd0hoY05NVGt4TVRBNU1EVXdNRFUwV2hjTk1qQXhNVEE0Ck1EVXdNRFUwV2pCT01Rc3dDUVlEVlFRR0V3Sk9UREVWTUJNR0ExVUVDQXdNV25WcFpDMUliMnhzWVc1a01SVXcKRXdZRFZRUUhEQXhOYVdSa1pXeG9ZWEp1YVhNeEVUQVBCZ05WQkFvTUNFOVFUbk5sYm5ObE1JSUNJakFOQmdrcQpoa2lHOXcwQkFRRUZBQU9DQWc4QU1JSUNDZ0tDQWdFQXg3NHhLZWFKbVI1QVNVMDMwb0hLZWNpMmtiVkxEMU5vCkNNQUxSZFk2bVRsUVZKeTZpWk1QYXZqTE9xZTJNRUR3eXBNc2xXVUV0bW15YUdXN25kY3g3WFJHTUlVdWROZ2sKY2V0ZEUwSG9lUHJ0SVlJL3RnUzJ6NS81Uk9idEFIMHRhZnRUTFhwQVlzeEhhN3VkbWlXZ0NYU0RocDlxdUZ0SQpuQzZUNE1TU0tuZTZoUFgxb1ZqV0NiU2lNOW1ZNTFYNVZyUzZ4K3RVYXB1ZnA0NjlHR2l6dndMR1QzRFEvakdQCjlyYmV5WnZjS1lxYW9pamdVQU9BSkF6Qk94ZkdTYWwxeG5jRDVCR0ZIK1FDQjI3ZUZnTVdnWXVvTzJETmdOaFAKQ3dpUHp1TS9ROHZ4TWZPYjh1TURCeWRGeWMzOXhkRyt1TmtxN21DcVlPZUJCTWFQdlZTOUtUc0VmREdSRkNoSgpYWXEyOWwvcEpZTkY3Z1FyT2d4Vy94OFkvMWZTOTBrL2prRGNkK1VrY1hxY0VpWEx2TEd5dU91Wk56WC82aEFKClVxU1J6bnV5OXV1bVBuY0d4Y1loSEcwSHgzMHNmZ3BQOHhXTGVSWGwxQ1hJTE95VWpkWVBjOTVDZWcrWjFCYW4KRktGSEdKdXBzbDBhNEdKOElJaHdzVjJEV3YrRjYrRGRmWDhOcm1Ka2duWDZOYkpOMWkzL0swTHhNMjdEYWJWdwo1T1JJL3BVK09wNWhsMUNFaFpETE9lVFpIYnVqUXFPUmZYNHRrU1BwRGMrYVc3K2NhWUhQeUNTUENLUUp4N25sCnlOT01SWVdJbTBvcXdGakZoemYwMm5vSzYyWXpLNitrdUVnZkRzVVllU0h0Zk1sZENPT2FsbUptYVhoT1VvQjMKZy9QQ2kySXljUThDQXdFQUFhTlFNRTR3SFFZRFZSME9CQllFRlBHVjRTSXduWlhMUlZiSnh3cWZDa1d0cDhuZwpNQjhHQTFVZEl3UVlNQmFBRlBHVjRTSXduWlhMUlZiSnh3cWZDa1d0cDhuZ01Bd0dBMVVkRXdRRk1BTUJBZjh3CkRRWUpLb1pJaHZjTkFRRUxCUUFEZ2dJQkFHS080WmhZdnh3Y3VIdFlqUW44WTk3cS9ucHBHK0VXYmI0QUR2dmoKTGlGMmpDbHdmRFladFJGcEwyWTdneUhFOFVTcTdBaGg0MWMyMGQ5bjBwSjJoekplT2pKVHMvSkY4S2k0SWJYQgpaNTZMeUtBZnZ3ajBNV0d0VkN5SEtOeDlISmdoMlFTdkZNZDhTVnp4MEtuMnJNQUJkNSsvb3NTV1pGNWppSHBsCmR3R1RmbENSem5sZmNUR084dWk5QkNqRGdqVXRBU1JhU2NmdHZZazk5SER2T0NkazF4OS93YXdXcG5qSXNzRGgKNEtMZVVOU2hLT1VwVENmNHJUaWlpL2l1aTNrd0FQbFlDOTZCSDZncXRuR0M4cHp0VEV1RGphYjdDd3JRWEdWRQpnQUE0c3JibUV6RVluN3huc0M5b08wT0N0YWtCZlRrM1VrUEMyNmF2cjlsYzRnemJVTHNldkFlOHRBaHJINFl3Cko4b2lhWWJMb1NyVTJ5R2FkcU5CaVVXOURuSHQxZkpMSmtINjNrRUJITllnOHE0QkxSK2dETTJHT3RBbGk5ekYKS3BUM2c3STEwU1FBd2FtekFvTmoxVFVkTnhLbTR6ZEU0dmtacnFHS1lya29KU3ZiYzNyRTI1OCtpUkpyd0pScwpjODNNdFI5djRxSGtFY0h5a0JSeEJ2YnVHb3hFWFRTem9DbU9QRHpkOFBDMFdmQ1lBTkdQZmsxSlozbXQ1eGtJCmVsdUlpd2lrc2FQS1RCK3J6R1JPWG5ueTd0d0RjSkNvSmVDS0gwKzIzTmt4Uk5FdVM4RGZFQWdJekJjY0puL00KNTMrSmZyaDZMRlhTT1FOeEdNSDE1ei9RcktROWxvbXQ4b0NQb3RpWm5LeEVCcE5QWTBQVGR0UVFNbWcrby9HWApOSUxUCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K</crt>
    <prv>LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUpRZ0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQ1N3d2dna29BZ0VBQW9JQ0FRREh2akVwNW9tWkhrQkoKVFRmU2djcDV5TGFSdFVzUFUyZ0l3QXRGMWpxWk9WQlVuTHFKa3c5cStNczZwN1l3UVBES2t5eVZaUVMyYWJKbwpaYnVkMXpIdGRFWXdoUzUwMkNSeDYxMFRRZWg0K3UwaGdqKzJCTGJQbi9sRTV1MEFmUzFwKzFNdGVrQml6RWRyCnU1MmFKYUFKZElPR24ycTRXMGljTHBQZ3hKSXFkN3FFOWZXaFdOWUp0S0l6MlpqblZmbFd0THJINjFScW01K24KanIwWWFMTy9Bc1pQY05EK01ZLzJ0dDdKbTl3cGlwcWlLT0JRQTRBa0RNRTdGOFpKcVhYR2R3UGtFWVVmNUFJSApidDRXQXhhQmk2ZzdZTTJBMkU4TENJL080ejlEeS9FeDg1dnk0d01ISjBYSnpmM0YwYjY0MlNydVlLcGc1NEVFCnhvKzlWTDBwT3dSOE1aRVVLRWxkaXJiMlgra2xnMFh1QkNzNkRGYi9IeGovVjlMM1NUK09RTngzNVNSeGVwd1MKSmN1OHNiSzQ2NWszTmYvcUVBbFNwSkhPZTdMMjY2WStkd2JGeGlFY2JRZkhmU3grQ2svekZZdDVGZVhVSmNncwo3SlNOMWc5ejNrSjZENW5VRnFjVW9VY1ltNm15WFJyZ1lud2dpSEN4WFlOYS80WHI0TjE5ZncydVltU0NkZm8xCnNrM1dMZjhyUXZFemJzTnB0WERrNUVqK2xUNDZubUdYVUlTRmtNczU1TmtkdTZOQ281RjlmaTJSSStrTno1cGIKdjV4cGdjL0lKSThJcEFuSHVlWEkwNHhGaFlpYlNpckFXTVdITi9UYWVncnJaak1ycjZTNFNCOE94Umg1SWUxOAp5VjBJNDVxV1ltWnBlRTVTZ0hlRDg4S0xZakp4RHdJREFRQUJBb0lDQUFidkNEL2ZHOW12M2lWdFE4blA3WnBxCnFFUEltbEZ1NE1haysvOHhuNWtnRHpUUXQvejhtT1ZxdTR0T3RSbFp0OElnZDhTNzIvMEZFRWRsZUt6VEFvMnUKb3AwZWttMUY3NFh3Mkt0SmQydHpzbldlVXQzYnJnanBFYnNkbFE2V1NkUkxBQ2tzL0QweHdDenlOMWRaaFFPdgpBcjNTbk43SGRHN1BneHlqVmp1WkttVmhNR1NvYzgya2Nwa0FMYm1pRjJTMkkyRzdQcFB3MFFyOC9uMXhiUVB0CmNicmlQSzhHUTJ3YUR3UEtvRXJrMzlkUE9mSXRITzZqYnJYQmJvV3lGeitMZEJ3ZnE1SmUxTjh6THd4dWtRSncKT2FmT0JYUTZqZ3ZoQVRUNldJRGUvSUZ5Wm5CNUJ1cmhweCtKUWd6eTZmNzZzdTNSZHppajhLdWN4UEthbFhKZwpPUnV2TmwwRmVsQjh4V2ptTHR6MzRXcmRVNWN5RERsSmxFY3k4bTJaT1BnODA1M1llUTN5V29TZW84RW9YM2pwCjRVZUtMaVJrdlZDNVJCS0hZRTNrN3pncUEzd2NSZjRONWVlQXh5aENWd05JNlNOckZRZEk0ZFkra1JUTUVXOGYKcUdYUGxqRndQRDJSSTh3eFdZVEdFTGRZSlZ6WWF0d3QzVmxxcWhNVHE3NUlydStCU1BaZG4xVlgycnBIZjNoYwpwQ3dTWlBiMmhHV1VWbjF2ZWUzZjJ4ckZSZk1SY203ZTBuSmJJYzlFZDBINUZVbjliSlZpNThEOWhLd051bUV0CitvUTRCZFFxNzU4M0hjYVBPclpJdWJJYTF0aFZmSCtJYWRjaTNyc3ArcUFXb1AwcEhQUXBmaWE0cDdSSVdyaGcKYmhWSHN2N0dEVmpNOEFqZ3JzenBBb0lCQVFEeHNKeU5JcHFJM1FGTDRSVEpFd3hlQ2xTeHFSTmI4cVF4M1g1TQpTMnFrNm51NlEvRk5INU5idE9TNnZwSm5FbnhCcGs5VkhHZmZNd2QyVjZhU2tWZC9DVUtldFcrTHF1bGtPTXkyCktraDk3c1gvbHhUMmx3T2U4b1dPWW5RYWFjK0p2M2JmQ3gwTnoyUDE2V0ZJU2xmRWVkTmV6ZFFZY3plRXRHZnkKcUdTV0RxNm4rdVRIZ3ZtNklWaEJYK1gxMTlGeDBDVGZmdndKSENZY0dMTVZuL0NRS1dqUzE4Ym05K0dqM0ZTdgp1TFVFZm51SjVBYlpwZENUc200VkZpcy9DWnFlZFFlQlArei9pVFJJNUE2Y1dqc281UzdaQXZRZ212WlljcFJaClJnelVGRTdDT3NkSUhZWDFQYmtVcTlmdE5ObisraXNMaXYwREJYTlFMTXVxUW16TEFvSUJBUURUa2NZc3p6anYKOUlYQ0txYklmTmpPL2t6VkdnRWxRc2pHa21aMmxjZHJxc1E2eE1rek5LVUYrMjkwUEkvanRIV3M5eUowSEVVMgoxWFF3RFBGbG13SnI3TjMvdmVseEJxWFRJemV3eERQTjg5ZDJBV2hDMFBleVFhcDVLbWhmZGdWdVZaeDBMNkJlClNYcEduT3RMK21jaU1mQ3NSNnlzVm9mVXozcjdYa24rVHpUM2tiS0RGY2xDUFNGL3htMFpkaitWNFN4dG5oS1YKajF4MmZHT1ZTNHJJZEcwRGdGN2JubXZPRDZ0L3pRYXJnWFhSdGp2SE4xVWx1T2RWZmRvUS9QMDFrT3g3a1R0TgprajBqSWdGMXNvbWFkMU1aUU0rWC9TcVZXQVptb0NYZDgyM0ZQR2wxeEFGcVVQNEVVRS9tcEt0RWJSQnM5UVNUCjB6RmFQRTl5cUNoTkFvSUJBRk5MSklqWFZoNjQyOHVFeEo4UGU0R2xXYzdva0ExdUwvd25jM0ZqeEZzVm5KSnkKKytReWI1eDVXU0txcnRYcTN2dlpEeG9yOGZoUUk5QTdJT0wrU0FNMTg4bXlpY0MrcERTd0JvejVRWVoxRmJPaQpJODFmK2hWN1MxL291azZvREtoU1hlczhiMFRsSm5RSGZFbG5wWnZHeUh1eHY5aTFUSHJsbWJWZEoxMDNyaVdpCko5cENYMEl3WDdRWUVxNkpORnRlK25ZejB6Um9pUkhCeVdZNGVyV1VMOVlLR3poYVVWOGhmZVlaWi9rbWhmamQKcHlhM0tJemVQMlh3Ly9KM290dmRSVHJjQnhlQjk0enZXOEd5cnhURzkwQSs3bGVXVURQbk9RMFRRVFNOMHg3SgpGd2paYytNeTVHZ2xXUU1jNWN3ajkxWEJEclZOMlpIVi9sS3RGY1VDZ2dFQUpTUVZKeTZscnpJOC9RNGh3MVp2CmRUOGRXOWU1MWNHNG4ydDZBMTFkNmQvTG5RbUl6SzEwUHUyWjdrem5jYkR2YTVMakFJRXFBV3ROZjFYMlZzRDAKbHQrNVJUa2dydy9jc29rZk1LL3c3RG5mWEQ3NC82blJvZ0IzSGRnOUJHMGluUEQ0aTBrRkhTaEhCL2hxTWlkZQpUWmw0eDdXNWNYT3JXc2VscmxVcUpqUGZkNHFqVFBIWktBQzFUY29Xd3Y2SVFSYUxoeDdWNGwyTmZOdHZXL2tyCi91NjVhSUR6cGhoVWtwTWJwMDdsMmR2YlJCcDZ1Z2xUc0ZDYWc5NlpGcHhqRXpGQzRwcG5UOEhaYTc1L2hScjMKbng5TmZrUnJiU0lyaEpZMFlYWEIwQW40L2tRUnUzUFNUOGl5SHkyK0tSNUZWcmpTeGwzcEZNNWhmcGJSMTYzLwpqUUtDQVFFQWdvdEFSU2ZWVHFEWFIra09vRFZGQ3JrTmZTNktlc0tRRkFjQTNCN1ZySXVBSllmdDN5TzNOMVlHCjlCMy81QnJWUzZTWGduaGxCZlNjbXRNaSt2OHhaMzhqTFNrQk54bDNhWVNhQW9RTDAvbU4vWDZZNXlCNTFBVlQKTjlEQmdBUWVUTDRQMnNHMWk5eGlBRWxjRHpOMHkrM1llbVdnd0tiNnVzeXhmQVdJanNvTHFXRkNCcTdCVnZkQwpuQXYwcEJrNHlvNWJTcUtra2REMXR6KzdLd21HTXdoaWo2eld4dzZtOFRBSElhKzV2cjdWWW5hWk9SVFZweDl1CjV6U2JZUlpUcXliUzFBVHpQbnQzdm9ZQnJoMjc5RktlRXkxVU9UUnkxYTJWRWNRV2dydU1QdGI5ZkJEWmpIaVMKRWVieDk0MTB3SUFwZUJJQmR3WU9LVFdndTY5UDF3PT0KLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLQo=</prv>
  </cert>
  <ppps>
    <ppp/>
  </ppps>
  <vlans>
    <vlan>
      <if>re0</if>
      <tag>100</tag>
      <pcp>0</pcp>
      <descr>LOCAL</descr>
      <vlanif>re0_vlan100</vlanif>
    </vlan>
    <vlan>
      <if>re0</if>
      <tag>200</tag>
      <pcp>0</pcp>
      <descr>LAB</descr>
      <vlanif>re0_vlan200</vlanif>
    </vlan>
    <vlan>
      <if>re0</if>
      <tag>10</tag>
      <pcp>0</pcp>
      <descr>LOCALOLD</descr>
      <vlanif>re0_vlan10</vlanif>
    </vlan>
    <vlan>
      <if>re0</if>
      <tag>20</tag>
      <pcp>0</pcp>
      <descr>LABOLD</descr>
      <vlanif>re0_vlan20</vlanif>
    </vlan>
  </vlans>
  <bridges>
    <bridged/>
  </bridges>
  <staticroutes>
    <route/>
  </staticroutes>
  <wol/>
  <dhcpdv6/>
  <openvpn>
    <openvpn-server/>
    <openvpn-client/>
  </openvpn>
  <nat>
    <outbound>
      <mode>automatic</mode>
    </outbound>
  </nat>
  <virtualip>
    <vip/>
  </virtualip>
</opnsense>