vyos

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2021.11.15 10:22:46 =~=~=~=~=~=~=~=~=~=~=~=
show configuration

interfaces {
    ethernet eth0 {
        address 103.10.24.2/25
        duplex auto
        hw-id 00:50:56:53:af:c4
        speed auto
        traffic-policy {
            out EGRESS_QOS
        }
    }
    ethernet eth1 {
        address 10.62.1.60/26
        hw-id 00:50:56:53:3c:64
    }
    ethernet eth2 {
        address 202.13.132.53/30
        hw-id 00:50:56:53:2e:55
        traffic-policy {
            out INGRESS_QOS
        }
    }
    ethernet eth3 {
        address 103.11.26.12/31
        description 3CLINK
        hw-id 00:50:56:53:15:54
    }
    loopback lo {
    }
    wireguard wg01 {
        address 122.16.100.1/24
        peer Mat {
            allowed-ips 122.16.100.3/32
            persistent-keepalive 15
:
            pubkey ****************
        }
        port 4000
    }
}
nat {
    source {
        rule 101 {
            outbound-interface eth1
            source {
                address 122.16.100.0/24
            }
            translation {
                address masquerade
            }
        }
    }
}
policy {
    access-list 100 {
        rule 50 {
            action permit
            destination {
                any
            }
            source {
                inverse-mask 0.0.1.255
                network 103.150.24.0
            }
        }
    }
    prefix-list AS25332-IN {
        rule 10 {
            action permit
            prefix 0.0.0.0/0
        }
    }
    prefix-list AS25332-OUT {
        rule 10 {
            action permit
            prefix 103.150.24.0/23
        }
    }
:
    prefix-list AS141235-IN {
        rule 10 {
            action permit
            prefix 0.0.0.0/0
        }
    }
    prefix-list AS141235-OUT {
        rule 10 {
            action permit
            prefix 103.150.24.0/23
        }
    }
    route-map AS25332-IN {
        rule 10 {
            action permit
            match {
                ip {
                    address {
                        prefix-list AS25332-IN
                    }
                }
            }
        }
        rule 20 {
            action deny
        }
    }
    route-map AS25332-OUT {
        rule 10 {
            action permit
            match {
                ip {
                    address {
                        prefix-list AS25332-OUT
                    }
                }
            }
        }
        rule 20 {
            action deny
        }
    }
    route-map AS141235-IN {
:
        rule 10 {
            action permit
            match {
                ip {
                    address {
                        prefix-list AS141235-IN
                    }
                }
            }
        }
        rule 20 {
            action deny
        }
    }
    route-map AS141235-OUT {
        rule 10 {
            action permit
            match {
                ip {
                    address {
                        prefix-list AS141235-OUT
                    }
                }
            }
        }
        rule 20 {
            action deny
        }
    }
    route-map OSPFFILTER {
        rule 100 {
            action deny
            match {
                ip {
                    address {
                        access-list 100
                    }
                }
            }
        }
        rule 500 {
            action permit
        }
:
    }
}
protocols {
    bgp 142631 {
        address-family {
            ipv4-unicast {
                network 103.150.24.0/23 {
                }
            }
        }
        neighbor 103.151.26.16 {
            address-family {
                ipv4-unicast {
                    route-map {
                        export AS141235-OUT
                    }
                    soft-reconfiguration {
                        inbound
                    }
                }
            }
            password ****************
            remote-as 140635
        }
        neighbor 202.123.132.52 {
            address-family {
                ipv4-unicast {
                    route-map {
                        export AS25332-OUT
                    }
                    soft-reconfiguration {
                        inbound
                    }
                }
            }
            remote-as 24332
        }
        parameters {
            router-id 202.123.132.53
        }
    }
    ospf {
        area 0 {
:
            area-type {
                normal
            }
            network 103.150.24.0/25
        }
        default-information {
            originate {
                metric-type 2
            }
        }
        neighbor 103.150.24.1 {
            poll-interval 60
            priority 0
        }
        neighbor 103.150.24.3 {
            poll-interval 60
            priority 0
        }
        parameters {
            abr-type cisco
            router-id 103.150.24.2
        }
        redistribute {
            connected {
                metric-type 2
            }
            static {
                metric-type 2
                route-map OSPFFILTER
            }
        }
    }
    static {
        route 0.0.0.0/0 {
            next-hop 202.123.132.52 {
                interface eth2
            }
        }
        route 103.150.24.0/23 {
            blackhole {
                distance 254
            }
        }
:
        route 103.223.252.0/22 {
            next-hop 202.123.132.52 {
            }
        }
        route 135.5.156.0/22 {
            next-hop 202.123.132.52 {
            }
        }
    }
}
service {
    snmp {
        community xxxxxxxxxx {
            authorization ro
        }
    }
    ssh {
        port 2222
    }
}
system {
    config-management {
            }
    host-name MA-BR2
    login {
        user vyos {
            authentication {
                encrypted-password ****************
                plaintext-password ****************
            }
        }
    }
    name-server 202.62.52.201
    name-server 1.1.1.1
    ntp {
        server 0.pool.ntp.org {
        }
        server 1.pool.ntp.org {
        }
:
        server 2.pool.ntp.org {
        }
    }
    syslog {
        global {
            facility all {
                level debug
            }
            facility protocols {
                level debug
            }
        }
        host 10.63.3.12 {
            facility all {
                level all
                protocol udp
            }
            port 514
        }
    }
    time-zone Asia/Bangkok
}
vpn {
:
    ipsec {
        esp-group central-rtr-esp {
            compression disable
            lifetime 10300
            mode tunnel
            pfs disable
            proposal 1 {
                encryption aes256
                hash sha1
            }
            proposal 2 {
                encryption aes256
                hash sha1
            }
        }
        ike-group central-rtr-ike {
            close-action none
            ikev2-reauth no
            key-exchange ikev1
            lifetime 3600
            proposal 1 {
                dh-group 2
                encryption aes256
                hash sha1
            }
        }
        ipsec-interfaces {
            interface eth0
        }
        site-to-site {
            peer 35.204.155.41 {
                authentication {
                    mode pre-shared-secret
                    pre-shared-secret ****************
                }
                connection-type initiate
                ike-group central-rtr-ike
                ikev2-reauth inherit
                local-address 103.150.24.2
                tunnel 0 {
                    allow-nat-networks disable
                    allow-public-networks enable
                    esp-group central-rtr-esp
:
                    local {
                        prefix 103.150.24.26/32
                    }
                    remote {
                        prefix 35.204.35.200/32
                    }
                }
            }
        }
    }
}