Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- firewall {
- all-ping enable
- broadcast-ping disable
- group {
- address-group Embarcdero {
- address внешний адрес.52
- address внешний адрес.179
- address внешний адрес.44
- address внешний адрес.45
- address внешний адрес.111
- description Embarcdero
- }
- address-group directors {
- address локалка-раз.135
- address локалка-раз.129
- address локалка-раз.163
- description ""
- }
- }
- ipv6-receive-redirects disable
- ipv6-src-route disable
- ip-src-route disable
- log-martians enable
- name WAN_IN {
- default-action drop
- description "WAN to internal"
- rule 10 {
- action accept
- description "Allow established/related"
- log disable
- state {
- established enable
- related enable
- }
- }
- rule 20 {
- action drop
- description "Drop invalid state"
- log disable
- state {
- invalid enable
- }
- }
- rule 21 {
- action accept
- description "allow all traffic to локалка-раз.104 lite.доменное имя"
- destination {
- address локалка-раз.104
- }
- log disable
- protocol all
- }
- rule 22 {
- action accept
- description "allow all traffic to локалка-раз.205 имя"
- destination {
- address локалка-раз.205
- }
- log disable
- protocol all
- }
- rule 23 {
- action accept
- description "allow all traffic to локалка-два.15 Mailz"
- destination {
- address локалка-два.15
- port 465,993,1443
- }
- log disable
- protocol tcp
- }
- rule 24 {
- action accept
- description "allow all traffic to локалка-два.10 SCM"
- destination {
- address локалка-два.10
- port 22,1443,8080
- }
- log disable
- protocol tcp
- }
- rule 25 {
- action accept
- description "allow all traffic to локалка-два.26 installer"
- destination {
- address локалка-два.26
- port 8086,10500
- }
- log disable
- protocol tcp
- }
- rule 26 {
- action accept
- description "allow all traffic to локалка-два.3 Artifactory"
- destination {
- address локалка-два.3
- port 80
- }
- log disable
- protocol tcp
- }
- rule 27 {
- action accept
- description "allow all traffic to локалка-два.6 www.другое доменное имя"
- destination {
- address локалка-два.6
- port 80
- }
- log disable
- protocol tcp
- }
- rule 28 {
- action accept
- description "allowall trafic to локалка-раз.130 test server Nikolay"
- destination {
- address локалка-раз.130
- port 20116-20121
- }
- log disable
- protocol tcp
- }
- rule 29 {
- action accept
- description "allow all trafic to andrey 155"
- destination {
- address локалка-раз.155
- port 20125-20128
- }
- log disable
- protocol tcp
- }
- rule 30 {
- action accept
- description "allow all trafic to vladimir 163"
- destination {
- address локалка-раз.163
- port 20216-20220
- }
- log disable
- protocol tcp
- }
- rule 31 {
- action accept
- description "allow all trafic to andrey 155 3389"
- destination {
- address локалка-раз.155
- port 3389
- }
- log disable
- protocol tcp
- }
- }
- name WAN_LOCAL {
- default-action drop
- description "WAN to router"
- rule 10 {
- action accept
- description "Allow established/related"
- log disable
- state {
- established enable
- related enable
- }
- }
- rule 20 {
- action drop
- description "Drop invalid state"
- log disable
- state {
- invalid enable
- }
- }
- }
- name WAN_OUT {
- default-action accept
- description ""
- rule 1 {
- action drop
- description "Embarcedero ban"
- destination {
- group {
- address-group Embarcdero
- }
- }
- log enable
- protocol all
- }
- }
- receive-redirects disable
- send-redirects enable
- source-validation disable
- syn-cookies enable
- }
- interfaces {
- ethernet eth0 {
- description Local
- duplex auto
- speed auto
- }
- ethernet eth1 {
- address другой внешний адрес.194/29
- address другой внешний адрес.195/29
- address другой внешний адрес.196/29
- description Internet
- duplex auto
- firewall {
- in {
- name WAN_IN
- }
- local {
- name WAN_LOCAL
- }
- out {
- name WAN_OUT
- }
- }
- speed auto
- }
- ethernet eth2 {
- description Local
- duplex auto
- speed auto
- }
- ethernet eth3 {
- description Local
- duplex auto
- speed auto
- }
- ethernet eth4 {
- description Local
- duplex auto
- poe {
- output pthru
- }
- speed auto
- }
- loopback lo {
- }
- switch switch0 {
- address локалка-раз.1/24
- description Local
- mtu 1500
- switch-port {
- interface eth0 {
- }
- interface eth2 {
- }
- interface eth3 {
- }
- vlan-aware disable
- }
- }
- }
- port-forward {
- auto-firewall enable
- hairpin-nat enable
- lan-interface switch0
- wan-interface eth1
- }
- protocols {
- static {
- route локалка три.0/24 {
- next-hop локалка-раз.99 {
- }
- }
- route локалка-два.0/24 {
- next-hop локалка-раз.99 {
- }
- }
- }
- }
- service {
- dhcp-server {
- disabled false
- hostfile-update disable
- shared-network-name LAN {
- authoritative enable
- subnet локалка-раз.0/24 {
- default-router локалка-раз.1
- dns-server локалка-раз.10
- dns-server локалка-раз.1
- domain-name другое доменное имя
- lease 86400
- start локалка-раз.106 {
- stop локалка-раз.243
- }
- static-mapping NIKOLAI {
- ip-address локалка-раз.130
- mac-address здесь был мак-адрес
- }
- static-mapping VLADIMIR2 {
- ip-address локалка-раз.163
- mac-address здесь был мак-адрес
- }
- static-mapping WIN-8KFCM5L2ERJ_LITE {
- ip-address локалка-раз.104
- mac-address здесь был мак-адрес
- }
- static-mapping andrey-b {
- ip-address локалка-раз.155
- mac-address здесь был мак-адрес
- }
- static-mapping компания-t_srv {
- ip-address локалка-раз.205
- mac-address здесь был мак-адрес
- }
- }
- }
- use-dnsmasq disable
- }
- dns {
- forwarding {
- cache-size 150
- listen-on switch0
- name-server локалка-раз.10
- options address=/lite.доменное имя/локалка-раз.204
- }
- }
- gui {
- http-port 80
- https-port 443
- older-ciphers enable
- }
- nat {
- rule 1 {
- description lite
- destination {
- address другой внешний адрес.195
- }
- inbound-interface eth1
- inside-address {
- address локалка-раз.104
- }
- log disable
- protocol all
- type destination
- }
- rule 2 {
- description имя
- destination {
- address другой внешний адрес.196
- }
- inbound-interface eth1
- inside-address {
- address локалка-раз.205
- }
- log disable
- protocol all
- type destination
- }
- rule 3 {
- description "mailz 465"
- destination {
- address другой внешний адрес.194
- port 465
- }
- inbound-interface eth1
- inside-address {
- address локалка-два.15
- port 465
- }
- log disable
- protocol tcp
- type destination
- }
- rule 4 {
- description "mailz 993"
- destination {
- address другой внешний адрес.194
- port 993
- }
- inbound-interface eth1
- inside-address {
- address локалка-два.15
- port 993
- }
- log disable
- protocol tcp
- type destination
- }
- rule 5 {
- description "mailz 1443"
- destination {
- address другой внешний адрес.194
- port 1443
- }
- inbound-interface eth1
- inside-address {
- address локалка-два.15
- port 1443
- }
- log disable
- protocol tcp
- type destination
- }
- rule 6 {
- description "scm 22"
- destination {
- address другой внешний адрес.194
- port 22
- }
- inbound-interface eth1
- inside-address {
- address локалка-два.10
- port 22
- }
- log disable
- protocol tcp
- type destination
- }
- rule 7 {
- description "scm 443"
- destination {
- address другой внешний адрес.194
- port 443
- }
- inbound-interface eth1
- inside-address {
- address локалка-два.10
- port 1443
- }
- log disable
- protocol tcp
- type destination
- }
- rule 8 {
- description "installer.services.третье доменное имя 8086"
- destination {
- address другой внешний адрес.194
- port 8086
- }
- inbound-interface eth1
- inside-address {
- address локалка-два.26
- port 8086
- }
- log disable
- protocol tcp
- type destination
- }
- rule 9 {
- description "installer.services.третье доменное имя 10500"
- destination {
- address другой внешний адрес.194
- port 10500
- }
- inbound-interface eth1
- inside-address {
- address локалка-два.26
- port 10500
- }
- log disable
- protocol tcp
- type destination
- }
- rule 10 {
- description "Artifactory 8081"
- destination {
- address другой внешний адрес.194
- port 8081
- }
- inbound-interface eth1
- inside-address {
- address локалка-два.3
- port 80
- }
- log disable
- protocol tcp
- type destination
- }
- rule 11 {
- description "Nikolay Server 20117"
- destination {
- address другой внешний адрес.194
- port 20116-20121
- }
- inbound-interface eth1
- inside-address {
- address локалка-раз.130
- port 20116-20121
- }
- log disable
- protocol tcp_udp
- type destination
- }
- rule 12 {
- description "www.другое доменное имя 80"
- destination {
- address другой внешний адрес.194
- port 80
- }
- inbound-interface eth1
- inside-address {
- address локалка-два.6
- port 80
- }
- log disable
- protocol tcp
- type destination
- }
- rule 13 {
- description "andrey 20125-20128"
- destination {
- address другой внешний адрес.194
- port 20125-20128
- }
- inbound-interface eth1
- inside-address {
- address локалка-раз.155
- port 20125-20128
- }
- log disable
- protocol tcp_udp
- type destination
- }
- rule 14 {
- description "vladimir 20216-20220"
- destination {
- address другой внешний адрес.194
- port 20216-20220
- }
- inbound-interface eth1
- inside-address {
- address локалка-раз.163
- port 20216-20220
- }
- log disable
- protocol tcp_udp
- type destination
- }
- rule 15 {
- description "fserver 785"
- destination {
- address другой внешний адрес.194
- port 785
- }
- inbound-interface eth1
- inside-address {
- address локалка-два.15
- port 636
- }
- log disable
- protocol tcp
- type destination
- }
- rule 16 {
- description "andrey RDP"
- destination {
- address другой внешний адрес.194
- port 20129
- }
- inbound-interface eth1
- inside-address {
- address локалка-раз.155
- port 3389
- }
- log disable
- protocol tcp_udp
- type destination
- }
- rule 5000 {
- description имя
- log disable
- outbound-interface eth1
- outside-address {
- address другой внешний адрес.196
- }
- protocol all
- source {
- address локалка-раз.205
- }
- type source
- }
- rule 5001 {
- description lite
- log disable
- outbound-interface eth1
- outside-address {
- address другой внешний адрес.195
- }
- protocol all
- source {
- address локалка-раз.104
- }
- type source
- }
- rule 5002 {
- description "mailz 465"
- log disable
- outbound-interface eth1
- outside-address {
- address другой внешний адрес.194
- port 465
- }
- protocol tcp
- source {
- address локалка-два.15
- port 465
- }
- type source
- }
- rule 5003 {
- description "mailz 993"
- log disable
- outbound-interface eth1
- outside-address {
- address другой внешний адрес.194
- port 993
- }
- protocol tcp
- source {
- address локалка-два.15
- port 993
- }
- type source
- }
- rule 5004 {
- description "mailz 1443"
- log disable
- outbound-interface eth1
- outside-address {
- address другой внешний адрес.194
- port 1443
- }
- protocol tcp
- source {
- address локалка-два.15
- port 1443
- }
- type source
- }
- rule 5005 {
- description "scm 22"
- log disable
- outbound-interface eth1
- outside-address {
- address другой внешний адрес.194
- port 22
- }
- protocol tcp
- source {
- address локалка-два.10
- port 22
- }
- type source
- }
- rule 5006 {
- description "scm 443"
- log disable
- outbound-interface eth1
- outside-address {
- address другой внешний адрес.194
- port 443
- }
- protocol tcp
- source {
- address локалка-два.10
- port 1443
- }
- type source
- }
- rule 5007 {
- description "installer.services.третье доменное имя 8086"
- log disable
- outbound-interface eth1
- outside-address {
- address другой внешний адрес.194
- port 8086
- }
- protocol tcp
- source {
- address локалка-два.26
- port 8086
- }
- type source
- }
- rule 5008 {
- description "installer.services.третье доменное имя 10500"
- log disable
- outbound-interface eth1
- outside-address {
- address другой внешний адрес.194
- port 10500
- }
- protocol tcp
- source {
- address локалка-два.26
- port 10500
- }
- type source
- }
- rule 5009 {
- description "Artifactory 8081"
- log disable
- outbound-interface eth1
- outside-address {
- address другой внешний адрес.194
- port 8081
- }
- protocol tcp
- source {
- address локалка-два.26
- port 80
- }
- type source
- }
- rule 5010 {
- description "Nikolay Server rule 20117"
- log disable
- outbound-interface eth1
- outside-address {
- address другой внешний адрес.194
- port 20116-20121
- }
- protocol tcp
- source {
- address локалка-раз.130
- port 20116-20121
- }
- type source
- }
- rule 5011 {
- description "www.другое доменное имя 80"
- log disable
- outbound-interface eth1
- outside-address {
- address другой внешний адрес.194
- port 80
- }
- protocol tcp
- source {
- address локалка-два.6
- port 80
- }
- type source
- }
- rule 5012 {
- description "masquerade for WAN"
- log disable
- outbound-interface eth1
- protocol all
- source {
- address локалка-раз.0/24
- }
- type masquerade
- }
- rule 5013 {
- description "andrey 20125-20128"
- log disable
- outbound-interface eth1
- outside-address {
- address другой внешний адрес.194
- port 20125-20128
- }
- protocol tcp
- source {
- address локалка-раз.155
- port 20125-20128
- }
- type source
- }
- rule 5014 {
- description "vladimir 20216-20220"
- log disable
- outbound-interface eth1
- outside-address {
- address другой внешний адрес.194
- port 20216-20220
- }
- protocol tcp
- source {
- address локалка-раз.163
- port 20216-20220
- }
- type source
- }
- rule 5015 {
- description "fserver 785"
- log disable
- outbound-interface eth1
- outside-address {
- address другой внешний адрес.194
- port 785
- }
- protocol tcp
- source {
- address локалка-раз.10
- port 636
- }
- type source
- }
- rule 5016 {
- description "andrey RDP"
- log disable
- outbound-interface eth1
- outside-address {
- address другой внешний адрес.194
- port 20129
- }
- protocol tcp
- source {
- address локалка-раз.155
- port 3389
- }
- type source
- }
- }
- ssh {
- port 22
- protocol-version v2
- }
- }
- system {
- gateway-address другой внешний адрес.193
- host-name ubnt
- login {
- user ubnt {
- authentication {
- encrypted-password абракадабра
- }
- level admin
- }
- }
- name-server четвертый внешний айпи адрес.197
- ntp {
- server 0.ubnt.pool.ntp.org {
- }
- server 1.ubnt.pool.ntp.org {
- }
- server 2.ubnt.pool.ntp.org {
- }
- server 3.ubnt.pool.ntp.org {
- }
- }
- syslog {
- global {
- facility all {
- level notice
- }
- facility protocols {
- level debug
- }
- }
- }
- time-zone UTC
- traffic-analysis {
- dpi disable
- export enable
- }
- }
- traffic-control {
- advanced-queue {
- filters {
- match 1 {
- attach-to 1023
- ip {
- destination {
- address локалка-раз.117/32
- }
- }
- target 1
- }
- match 2 {
- attach-to 1023
- ip {
- source {
- address локалка-раз.117/32
- }
- }
- target 2
- }
- match 3 {
- attach-to 1023
- ip {
- destination {
- address локалка-раз.131/32
- }
- }
- target 3
- }
- match 4 {
- attach-to 1023
- ip {
- source {
- address локалка-раз.131/32
- }
- }
- target 4
- }
- match 5 {
- attach-to 1023
- ip {
- destination {
- address локалка-раз.155/32
- }
- }
- target 5
- }
- match 6 {
- attach-to 1023
- ip {
- source {
- address локалка-раз.155/32
- }
- }
- target 6
- }
- match 7 {
- attach-to 1023
- ip {
- destination {
- address локалка-раз.106/32
- }
- }
- target 7
- }
- match 8 {
- attach-to 1023
- ip {
- source {
- address локалка-раз.106/32
- }
- }
- target 8
- }
- match 9 {
- attach-to 1023
- ip {
- destination {
- address локалка-раз.141/32
- }
- }
- target 9
- }
- match 10 {
- attach-to 1023
- ip {
- source {
- address локалка-раз.141/32
- }
- }
- target 10
- }
- match 11 {
- attach-to 1023
- ip {
- destination {
- address локалка-раз.10/32
- }
- }
- target 11
- }
- match 12 {
- attach-to 1023
- ip {
- source {
- address локалка-раз.10/32
- }
- }
- target 12
- }
- match 13 {
- attach-to 1023
- ip {
- destination {
- address локалка-раз.123/32
- }
- }
- target 13
- }
- match 14 {
- attach-to 1023
- ip {
- source {
- address локалка-раз.123/32
- }
- }
- target 14
- }
- match 15 {
- attach-to 1023
- ip {
- destination {
- address локалка-раз.104/32
- }
- }
- target 15
- }
- match 16 {
- attach-to 1023
- ip {
- source {
- address локалка-раз.104/32
- }
- }
- target 16
- }
- }
- leaf {
- queue 1 {
- bandwidth 1mbit
- parent 1023
- queue-type UBNT_BQ_FIFO
- }
- queue 2 {
- bandwidth 1mbit
- parent 1023
- queue-type UBNT_BQ_FIFO
- }
- queue 3 {
- bandwidth 5mbit
- parent 1023
- queue-type UBNT_BQ_SFQ
- }
- queue 4 {
- bandwidth 5mbit
- parent 1023
- queue-type UBNT_BQ_SFQ
- }
- queue 5 {
- bandwidth 3mbit
- parent 1023
- queue-type UBNT_BQ_SFQ
- }
- queue 6 {
- bandwidth 3mbit
- parent 1023
- queue-type UBNT_BQ_SFQ
- }
- queue 7 {
- bandwidth 2mbit
- parent 1023
- queue-type UBNT_BQ_SFQ
- }
- queue 8 {
- bandwidth 2mbit
- parent 1023
- queue-type UBNT_BQ_SFQ
- }
- queue 9 {
- bandwidth 2mbit
- parent 1023
- queue-type UBNT_BQ_SFQ
- }
- queue 10 {
- bandwidth 2mbit
- parent 1023
- queue-type UBNT_BQ_SFQ
- }
- queue 11 {
- bandwidth 1mbit
- parent 1023
- queue-type UBNT_BQ_SFQ
- }
- queue 12 {
- bandwidth 1mbit
- parent 1023
- queue-type UBNT_BQ_SFQ
- }
- queue 13 {
- bandwidth 1mbit
- parent 1023
- queue-type UBNT_BQ_SFQ
- }
- queue 14 {
- bandwidth 1mbit
- parent 1023
- queue-type UBNT_BQ_SFQ
- }
- queue 15 {
- bandwidth 5mbit
- parent 1023
- queue-type UBNT_BQ_SFQ
- }
- queue 16 {
- bandwidth 5mbit
- parent 1023
- queue-type UBNT_BQ_SFQ
- }
- }
- queue-type {
- pfifo UBNT_BQ_FIFO {
- }
- sfq UBNT_BQ_SFQ {
- }
- }
- root {
- queue 1023 {
- attach-to global
- bandwidth 1000mbit
- description UBNT-BQ
- }
- }
- }
- }
- /* Warning: Do not remove the following line. */
- /* === vyatta-config-version: "config-management@1:conntrack@1:cron@1:dhcp-relay@1:dhcp-server@4:firewall@5:ipsec@5:nat@3:qos@1:quagga@2:system@4:ubnt-pptp@1:ubnt-util@1:vrrp@1:webgui@1:webproxy@1:zone-policy@1" === */
- /* Release version: v1.9.0.4901118.160804.1131 */
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement