vyos fw

firewall {
    all-ping enable
    broadcast-ping disable
    config-trap disable
    group {
        address-group ag-bcast_iot {
            address 192.168.11.255
            address 192.168.11.253
        }
        address-group ag-bcast_lan {
            address 192.168.13.255
            address 192.168.13.253
        }
        address-group ag-bcast_limit {
            address 255.255.255.255
        }
        address-group ag-blueiris {
            address 192.168.67.110
        }
        address-group ag-cert_issuer {
            address 192.168.67.231
        }
        address-group ag-cert_web {
            address 192.168.67.231
        }
        address-group ag-ct_sync {
            address 224.0.0.50
        }
        address-group ag-dc {
            address 192.168.67.241
            address 192.168.67.242
        }
        address-group ag-dockerhosts {
            address 192.168.7.195
            address 192.168.67.196
            address 192.168.7.196
            address 192.168.67.195
        }
        address-group ag-docker_pub {
            address 192.168.17.207
        }
        address-group ag-fileserver {
            address 192.168.67.200
            address 192.168.67.205
        }
        address-group ag-hypervisors {
            address 192.168.7.10
            address 192.168.7.11
            address 192.168.7.12
            address 192.168.7.15
            address 192.168.7.16
        }
        address-group ag-igmp {
            address 224.0.0.22
        }
        address-group ag-kms {
            address 192.168.67.240
        }
        address-group ag-mdns {
            address 224.0.0.251
            address 192.168.11.252
            address 192.168.11.254
            address 192.168.13.254
            address 192.168.13.252
            address 192.168.13.253
            address 192.168.11.253
            address 192.168.131.253
            address 192.168.131.252
            address 192.168.131.254
        }
        address-group ag-media_player {
            address 192.168.11.66
            address 192.168.11.99
        }
        address-group ag-portainer {
            address 192.168.7.196
        }
        address-group ag-printer {
            address 192.168.13.210
        }
        address-group ag-testDNS_fw {
            address 192.168.7.140
        }
        address-group ag-testNTP {
            address 192.168.7.140
            address 192.168.7.141
        }
        address-group ag-testWEB {
            address 192.168.7.142
            address 192.168.7.143
            address 192.168.7.141
            address 192.168.7.146
        }
        address-group ag-traccar_mysql {
            address 192.168.67.195
        }
        address-group ag-traccar_srv {
            address 192.168.17.207
        }
        address-group ag-tv_server {
            address 192.168.11.196
        }
        address-group ag-unifi {
            address 192.168.7.196
        }
        address-group ag-ups_mgmt {
            address 192.168.7.100
        }
        address-group ag-vcenter {
            address 192.168.7.15
        }
        address-group ag-vpn_bck {
            address 192.168.17.100
        }
        address-group ag-vpn_pri {
            address 192.168.17.100
        }
        address-group ag-vpn_servers {
            address 192.168.17.100
        }
        address-group ag-vrrp {
            address 224.0.0.18
        }
        address-group ag-vsphere {
            address 192.168.7.15
        }
        address-group ag-wsus {
            address 192.168.67.235
        }
        address-group ag-dhcp-isp {
            address 172.17.0.1
            address 172.23.0.1
        }
        address-group ag-dhcp-server {
            address 192.168.67.241
            address 192.168.67.242
        }
        address-group ag-dns-dc_main {
            address 192.168.67.241
            address 192.168.67.242
        }
        address-group ag-down-fileserver {
            address 192.168.79.202
        }
        address-group ag-fw-iot {
            address 192.168.11.253
        }
        address-group ag-fw-lan {
            address 192.168.13.253
        }
        address-group ag-vrrp-cam {
            address 192.168.53.252
            address 192.168.53.254
        }
        address-group ag-vrrp-dmz {
            address 192.168.67.252
            address 192.168.67.254
        }
        address-group ag-vrrp-download {
            address 192.168.79.252
            address 192.168.79.254
        }
        address-group ag-vrrp-guest {
            address 192.168.131.252
            address 192.168.131.254
        }
        address-group ag-vrrp-iot {
            address 192.168.11.252
            address 192.168.11.254
        }
        address-group ag-vrrp-lan {
            address 192.168.13.252
            address 192.168.13.254
        }
        address-group ag-vrrp-mgmt {
            address 192.168.7.252
            address 192.168.7.254
        }
        address-group ag-vrrp-public {
            address 192.168.17.252
            address 192.168.17.254
        }
        address-group dns-piholes {
            address 192.168.67.243
            address 192.168.67.244
        }
        address-group dnsforwarders {
            address 192.168.67.241
            address 192.168.67.242
            address 192.168.67.243
            address 192.168.67.244
        }
        address-group mgmtfromlan {
            address 192.168.13.15
            address 192.168.13.85
            address 192.168.13.43
            address 192.168.13.95
            address 192.168.13.44
            address 192.168.13.86
        }
        address-group ntpservers {
            address 192.168.67.241
            address 192.168.67.242
        }
        address-group wifiaps {
            address 192.168.7.210
            address 192.168.7.247
            address 192.168.7.248
        }
        network-group ng-guest {
            network 192.168.131.0/24
        }
        network-group ng-lan {
            network 192.168.13.0/24
        }
        network-group vpnusers {
            network 10.168.17.0/24
            network 10.168.19.0/24
        }
        port-group pg-agps {
            port 7275
        }
        port-group pg-blueiris {
            port 443
            port 442
        }
        port-group pg-cam_onvif {
            port 80
            port 8999
        }
        port-group pg-cam_rtsp {
            port 554
        }
        port-group pg-cert_issuer {
            port 135
            port 49152-65535
        }
        port-group pg-crashplan {
            port 4287
        }
        port-group pg-ct_sync {
            port 3780
        }
        port-group pg-dhcp {
            port 67
            port 68
        }
        port-group pg-dns {
            port 53
        }
        port-group pg-dnsblock_admin {
            port 3000
        }
        port-group pg-dns_tls {
            port 853
        }
        port-group pg-domain {
            port 389
            port 88
            port 445
            port 636
            port 3269
            port 3268
            port 135
            port 49152-65535
        }
        port-group pg-ftp {
            port 21
        }
        port-group pg-google_cast {
            port 8008
            port 8009
            port 8443
        }
        port-group pg-google_cast_pic {
            port 2346
        }
        port-group pg-google_fcm {
            port 5228
            port 5229
            port 5230
        }
        port-group pg-google_quic {
            port 443
            port 19302-19309
        }
        port-group pg-iperf {
            port 5201
        }
        port-group pg-iptv {
            port 8086
            port 8080
            port 8000
            port 9090
        }
        port-group pg-person2work_genesys {
            port 16384-32768
        }
        port-group pg-person2work_webrtc {
            port 3478
            port 19302
        }
        port-group pg-kms {
            port 1688
        }
        port-group pg-liam_work {
            port 9993
        }
        port-group pg-person1work_lotusnotes {
            port 1352
        }
        port-group pg-mdns {
            port 5353
        }
        port-group pg-mysql {
            port 3306
        }
        port-group pg-netbios {
            port 137
            port 138
            port 139
        }
        port-group pg-ntp {
            port 123
        }
        port-group pg-ocsp {
            port 80
        }
        port-group pg-pia_ping {
            port 8888
        }
        port-group pg-pia_wguard {
            port 1337
        }
        port-group pg-pihole {
            port 80
            port 443
        }
        port-group pg-portainer {
            port 9000
        }
        port-group pg-portainer_agent {
            port 9001
        }
        port-group pg-printer_web {
            port 443
        }
        port-group pg-rdp {
            port 3389
        }
        port-group pg-skype {
            port 3478
            port 3479
            port 3480
            port 3481
        }
        port-group pg-smb {
            port 445
        }
        port-group pg-solar {
            port 54321
            port 54320
            port 54319
            port 49049
        }
        port-group pg-solar2 {
            port 50052
        }
        port-group pg-speedtest {
            port 5060
            port 8080
        }
        port-group pg-spotify {
            port 4070
        }
        port-group pg-ssh {
            port 22
        }
        port-group pg-traccar_srv {
            port 8082
        }
        port-group pg-tvh_htsp {
            port 9982
        }
        port-group pg-tvh_web {
            port 9981
        }
        port-group pg-tv_discover {
            port 65001
        }
        port-group pg-unifi {
            port 8443
        }
        port-group pg-unifi_adapt {
            port 10001
        }
        port-group pg-ups_web {
            port 4679
            port 4680
        }
        port-group pg-vcenter {
            port 5480
        }
        port-group pg-vpn_bck {
            port 443
        }
        port-group pg-vpn_globalprotect {
            port 4501
            port 500
            port 4500
        }
        port-group pg-vpn_pri {
            port 443
        }
        port-group pg-web {
            port 80
            port 443
        }
        port-group pg-webex {
            port 9000
            port 5004
            port 33434-33598
        }
        port-group pg-whatsapp {
            port 3478
        }
        port-group pg-wsus {
            port 8530
        }
        port-group pg-xmpp {
            port 5222
        }
    }
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    name cam-dmz {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 400 {
            action accept
            destination {
                group {
                    address-group ntpservers
                    port-group pg-ntp
                }
            }
            log enable
            protocol udp
        }
    }
    name cam-download {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name cam-firewall {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 10 {
            action accept
            destination {
                group {
                    address-group ag-vrrp-cam
                }
            }
            protocol vrrp
            source {
                group {
                    address-group ag-vrrp-cam
                }
            }
        }
    }
    name cam-guest {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name cam-lan {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name cam-mgmt {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name cam-public {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name cam-wan {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name dmz-cam {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 380 {
            action accept
            destination {
                group {
                    port-group pg-cam_rtsp
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group ag-blueiris
                }
            }
        }
        rule 381 {
            action accept
            destination {
                group {
                    port-group pg-cam_onvif
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group ag-blueiris
                }
            }
        }
    }
    name dmz-download {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
        rule 300 {
            action accept
            destination {
                group {
                    address-group ag-down-fileserver
                    port-group pg-smb
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group ag-fileserver
                }
            }
        }
    }
    name dmz-firewall {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 10 {
            action accept
            destination {
                group {
                    address-group ag-vrrp-dmz
                }
            }
            protocol vrrp
            source {
                group {
                    address-group ag-vrrp-dmz
                }
            }
        }
        rule 600 {
            action accept
            destination {
                group {
                    port-group pg-dhcp
                }
            }
            log enable
            protocol udp
            source {
                group {
                    address-group ag-dhcp-server
                }
            }
        }
        rule 610 {
            action drop
            description "Drop Netbios traffic from logs"
            destination {
                group {
                    port-group pg-netbios
                }
            }
            log disable
            protocol udp
        }
    }
    name dmz-guest {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name dmz-iot {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name dmz-lan {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name dmz-mgmt {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
    }
    name dmz-public {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name dmz-wan {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
        rule 200 {
            action accept
            destination {
                group {
                    port-group pg-web
                }
            }
            log enable
            protocol tcp
        }
        rule 205 {
            action accept
            destination {
                group {
                    port-group pg-speedtest
                }
            }
            log enable
            protocol tcp
        }
        rule 400 {
            action accept
            destination {
                group {
                    port-group pg-ntp
                }
            }
            log enable
            protocol udp
            source {
                group {
                    address-group ntpservers
                }
            }
        }
        rule 500 {
            action accept
            destination {
                group {
                    port-group pg-dns
                }
            }
            log enable
            protocol tcp_udp
            source {
                group {
                    address-group dnsforwarders
                }
            }
        }
        rule 700 {
            action accept
            destination {
                group {
                    port-group pg-ftp
                }
            }
            log enable
            protocol tcp
        }
    }
    name download-cam {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name download-dmz {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
        rule 300 {
            action accept
            destination {
                group {
                    address-group ag-fileserver
                    port-group pg-smb
                }
            }
            log enable
            protocol tcp
        }
        rule 400 {
            action accept
            destination {
                group {
                    address-group ntpservers
                    port-group pg-ntp
                }
            }
            log enable
            protocol udp
        }
        rule 500 {
            action accept
            destination {
                group {
                    address-group dnsforwarders
                    port-group pg-dns
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 501 {
            action accept
            description "Allow pihole web interface"
            destination {
                group {
                    address-group dns-piholes
                    port-group pg-pihole
                }
            }
            log enable
            protocol tcp
        }
        rule 560 {
            action accept
            destination {
                group {
                    address-group ag-wsus
                    port-group pg-wsus
                }
            }
            log enable
            protocol tcp
        }
    }
    name download-firewall {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 10 {
            action accept
            destination {
                group {
                    address-group ag-vrrp-download
                }
            }
            protocol vrrp
            source {
                group {
                    address-group ag-vrrp-download
                }
            }
        }
        rule 610 {
            action drop
            description "Drop Netbios traffic from logs"
            destination {
                group {
                    port-group pg-netbios
                }
            }
            log disable
            protocol udp
        }
    }
    name download-guest {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name download-lan {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name download-mgmt {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name download-public {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name download-wan {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
        rule 200 {
            action accept
            destination {
                group {
                    port-group pg-web
                }
            }
            log enable
            protocol tcp
        }
        rule 201 {
            action accept
            destination {
                group {
                    port-group pg-pia_wguard
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 202 {
            action accept
            destination {
                group {
                    port-group pg-pia_wguard
                }
            }
            log enable
            protocol icmp
        }
        rule 700 {
            action accept
            destination {
                group {
                    port-group pg-ftp
                }
            }
            log enable
            protocol tcp
        }
        rule 705 {
            action accept
            destination {
                group {
                    port-group pg-pia_ping
                }
            }
            log enable
            protocol udp
        }
    }
    name firewall-cam {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 10 {
            action accept
            destination {
                group {
                    address-group ag-vrrp
                }
            }
            protocol vrrp
            source {
                group {
                    address-group ag-vrrp-cam
                }
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
    }
    name firewall-dmz {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 10 {
            action accept
            destination {
                group {
                    address-group ag-vrrp
                }
            }
            protocol vrrp
            source {
                group {
                    address-group ag-vrrp-dmz
                }
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
        rule 400 {
            action accept
            destination {
                group {
                    address-group ntpservers
                    port-group pg-ntp
                }
            }
            log enable
            protocol udp
        }
        rule 500 {
            action accept
            destination {
                group {
                    address-group ag-dns-dc_main
                    port-group pg-dns
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 600 {
            action accept
            destination {
                group {
                    address-group ag-dhcp-server
                    port-group pg-dhcp
                }
            }
            log enable
            protocol udp
        }
    }
    name firewall-download {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 10 {
            action accept
            destination {
                group {
                    address-group ag-vrrp
                }
            }
            protocol vrrp
            source {
                group {
                    address-group ag-vrrp-download
                }
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
    }
    name firewall-guest {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 10 {
            action accept
            destination {
                group {
                    address-group ag-vrrp
                }
            }
            protocol vrrp
            source {
                group {
                    address-group ag-vrrp-guest
                }
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
        rule 602 {
            action accept
            destination {
                group {
                    address-group ag-mdns
                    port-group pg-mdns
                }
            }
            protocol udp
        }
    }
    name firewall-iot {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 10 {
            action accept
            destination {
                group {
                    address-group ag-vrrp
                }
            }
            protocol vrrp
            source {
                group {
                    address-group ag-vrrp-iot
                }
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
        rule 602 {
            action accept
            destination {
                group {
                    address-group ag-mdns
                    port-group pg-mdns
                }
            }
            protocol udp
        }
    }
    name firewall-lan {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 10 {
            action accept
            destination {
                group {
                    address-group ag-vrrp
                }
            }
            protocol vrrp
            source {
                group {
                    address-group ag-vrrp-lan
                }
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
        rule 602 {
            action accept
            destination {
                group {
                    address-group ag-mdns
                    port-group pg-mdns
                }
            }
            protocol udp
        }
    }
    name firewall-mgmt {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 10 {
            action accept
            destination {
                group {
                    address-group ag-vrrp
                }
            }
            protocol vrrp
            source {
                group {
                    address-group ag-vrrp-mgmt
                }
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
        rule 650 {
            action accept
            description "Accept Conntrack Sync"
            destination {
                group {
                    address-group ag-ct_sync
                    port-group pg-ct_sync
                }
            }
            protocol udp
            source {
                group {
                    address-group ag-vrrp-mgmt
                }
            }
        }
        rule 651 {
            action accept
            description "Allow IGMP for Conntrack Sync"
            destination {
                group {
                    address-group ag-igmp
                }
            }
            protocol igmp
            source {
                group {
                    address-group ag-vrrp-mgmt
                }
            }
        }
    }
    name firewall-public {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 10 {
            action accept
            destination {
                group {
                    address-group ag-vrrp
                }
            }
            protocol vrrp
            source {
                group {
                    address-group ag-vrrp-public
                }
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
    }
    name firewall-wan {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
        rule 200 {
            action accept
            description "Allow updating dynamic DNS"
            destination {
                group {
                    port-group pg-web
                }
            }
            log enable
            protocol tcp
        }
        rule 600 {
            action accept
            destination {
                group {
                    port-group pg-dhcp
                }
            }
            log enable
            protocol udp
        }
    }
    name guest-cam {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name guest-dmz {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 400 {
            action accept
            destination {
                group {
                    address-group ntpservers
                    port-group pg-ntp
                }
            }
            log enable
            protocol udp
        }
        rule 500 {
            action accept
            destination {
                group {
                    address-group dnsforwarders
                    port-group pg-dns
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 501 {
            action accept
            description "Allow HTTP for Pi-hole"
            destination {
                group {
                    address-group dns-piholes
                    port-group pg-pihole
                }
            }
            log enable
            protocol tcp
        }
        rule 600 {
            action accept
            destination {
                group {
                    address-group ag-dhcp-server
                    port-group pg-dhcp
                }
            }
            log enable
            protocol udp
        }
    }
    name guest-download {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name guest-firewall {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 10 {
            action accept
            destination {
                group {
                    address-group ag-vrrp-guest
                }
            }
            protocol vrrp
            source {
                group {
                    address-group ag-vrrp-guest
                }
            }
        }
        rule 600 {
            action accept
            destination {
                group {
                    port-group pg-dhcp
                }
            }
            log enable
            protocol udp
        }
        rule 602 {
            action accept
            destination {
                group {
                    address-group ag-mdns
                    port-group pg-mdns
                }
            }
            protocol udp
        }
        rule 605 {
            action accept
            description "Allow media/TV discovery (Direct)"
            destination {
                group {
                    address-group ag-bcast_lan
                    port-group pg-tv_discover
                }
            }
            log enable
            protocol udp
        }
        rule 606 {
            action accept
            description "Allow media/TV discovery (Limited)"
            destination {
                group {
                    address-group ag-bcast_limit
                    port-group pg-tv_discover
                }
            }
            log enable
            protocol udp
        }
        rule 610 {
            action drop
            description "Drop Netbios traffic from logs"
            destination {
                group {
                    port-group pg-netbios
                }
            }
            log disable
            protocol udp
        }
    }
    name guest-iot {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 207 {
            action accept
            destination {
                group {
                    port-group pg-google_cast
                }
            }
            log enable
            protocol tcp
        }
        rule 208 {
            action accept
            log enable
            protocol udp
            source {
                group {
                    port-group pg-google_cast_pic
                }
            }
        }
    }
    name guest-lan {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name guest-mgmt {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name guest-public {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name guest-wan {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
        rule 200 {
            action accept
            destination {
                group {
                    port-group pg-web
                }
            }
            log enable
            protocol tcp
        }
        rule 203 {
            action accept
            destination {
                group {
                    port-group pg-google_quic
                }
            }
            log enable
            protocol udp
        }
        rule 204 {
            action accept
            destination {
                group {
                    port-group pg-google_fcm
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 205 {
            action accept
            destination {
                group {
                    port-group pg-speedtest
                }
            }
            log enable
            protocol tcp
        }
        rule 208 {
            action accept
            destination {
                group {
                    port-group pg-agps
                }
            }
            log enable
            protocol tcp
        }
        rule 209 {
            action accept
            destination {
                group {
                    port-group pg-xmpp
                }
            }
            log enable
            protocol tcp
        }
        rule 215 {
            action accept
            destination {
                group {
                    port-group pg-spotify
                }
            }
            log enable
            protocol tcp
        }
        rule 400 {
            action accept
            destination {
                group {
                    port-group pg-ntp
                }
            }
            log enable
            protocol udp
        }
        rule 500 {
            action accept
            destination {
                group {
                    port-group pg-dns
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 630 {
            action accept
            destination {
                group {
                    port-group pg-whatsapp
                }
            }
            log enable
            protocol udp
        }
        rule 631 {
            action accept
            destination {
                group {
                    port-group pg-skype
                }
            }
            log enable
            protocol udp
        }
        rule 632 {
            action accept
            destination {
                group {
                    port-group pg-webex
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 635 {
            action accept
            destination {
                group {
                    port-group pg-liam_work
                }
            }
            log enable
            protocol udp
        }
        rule 700 {
            action accept
            destination {
                group {
                    port-group pg-ftp
                }
            }
            log enable
            protocol tcp
        }
    }
    name iot-dmz {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            destination {
                group {
                    address-group dns-piholes
                }
            }
            log enable
            protocol icmp
        }
        rule 300 {
            action accept
            destination {
                group {
                    address-group ag-fileserver
                    port-group pg-smb
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group ag-media_player
                }
            }
        }
        rule 400 {
            action accept
            destination {
                group {
                    address-group ntpservers
                    port-group pg-ntp
                }
            }
            log enable
            protocol udp
        }
        rule 500 {
            action accept
            destination {
                group {
                    address-group dns-piholes
                    port-group pg-dns
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 501 {
            action accept
            description "Allow HTTP for Pi-hole"
            destination {
                group {
                    address-group dns-piholes
                    port-group pg-pihole
                }
            }
            log enable
            protocol tcp
        }
        rule 502 {
            action drop
            description "Disable DNS over TLS"
            destination {
                group {
                    address-group dns-piholes
                    port-group pg-dns_tls
                }
            }
            log enable
            protocol tcp
        }
        rule 600 {
            action accept
            destination {
                group {
                    address-group ag-dhcp-server
                    port-group pg-dhcp
                }
            }
            log enable
            protocol udp
        }
    }
    name iot-firewall {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 10 {
            action accept
            destination {
                group {
                    address-group ag-vrrp-iot
                }
            }
            protocol vrrp
            source {
                group {
                    address-group ag-vrrp-iot
                }
            }
        }
        rule 100 {
            action accept
            destination {
                group {
                    address-group ag-fw-iot
                }
            }
            log enable
            protocol icmp
        }
        rule 371 {
            action accept
            description "Fronius solar 2"
            destination {
                address 192.168.11.255
                group {
                    port-group pg-solar2
                }
            }
            log enable
            protocol udp
        }
        rule 600 {
            action accept
            destination {
                group {
                    port-group pg-dhcp
                }
            }
            log enable
            protocol udp
        }
        rule 601 {
            action accept
            description "Allow direct bcast mDNS"
            destination {
                group {
                    address-group ag-bcast_iot
                    port-group pg-mdns
                }
            }
            log enable
            protocol udp
        }
        rule 602 {
            action accept
            destination {
                group {
                    address-group ag-mdns
                    port-group pg-mdns
                }
            }
            protocol udp
        }
        rule 605 {
            action accept
            description "Allow media/TV discovery (Direct)"
            destination {
                group {
                    address-group ag-bcast_iot
                    port-group pg-tv_discover
                }
            }
            log enable
            protocol udp
        }
        rule 606 {
            action accept
            description "Allow media/TV discovery (Limited)"
            destination {
                group {
                    address-group ag-bcast_limit
                    port-group pg-tv_discover
                }
            }
            log enable
            protocol udp
        }
        rule 610 {
            action drop
            description "Drop Netbios traffic from logs"
            destination {
                group {
                    port-group pg-netbios
                }
            }
            log disable
            protocol udp
        }
    }
    name iot-guest {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 207 {
            action accept
            description "Allow Google Cast Returns"
            destination {
                group {
                    network-group ng-guest
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group ag-media_player
                    port-group pg-google_cast
                }
            }
        }
    }
    name iot-lan {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 207 {
            action accept
            description "Allow Google Cast Returns"
            destination {
                group {
                    network-group ng-lan
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group ag-media_player
                    port-group pg-google_cast
                }
            }
        }
    }
    name iot-wan {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
        rule 200 {
            action accept
            destination {
                group {
                    port-group pg-web
                }
            }
            log enable
            protocol tcp
        }
        rule 203 {
            action accept
            destination {
                group {
                    port-group pg-google_quic
                }
            }
            log enable
            protocol udp
        }
        rule 204 {
            action accept
            destination {
                group {
                    port-group pg-google_fcm
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 209 {
            action accept
            destination {
                group {
                    port-group pg-xmpp
                }
            }
            log enable
            protocol tcp
        }
        rule 370 {
            action accept
            description "Fronius solar"
            destination {
                group {
                    port-group pg-solar
                }
            }
            log enable
            protocol udp
        }
        rule 400 {
            action accept
            destination {
                group {
                    port-group pg-ntp
                }
            }
            log enable
            protocol udp
        }
    }
    name lan-cam {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 380 {
            action accept
            destination {
                group {
                    port-group pg-cam_rtsp
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
        rule 381 {
            action accept
            destination {
                group {
                    port-group pg-cam_onvif
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
        rule 900 {
            action accept
            destination {
                group {
                    port-group pg-ssh
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
    }
    name lan-dmz {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
        rule 200 {
            action accept
            destination {
                group {
                    port-group pg-web
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
        rule 300 {
            action accept
            destination {
                group {
                    address-group ag-fileserver
                    port-group pg-smb
                }
            }
            log enable
            protocol tcp
        }
        rule 385 {
            action accept
            destination {
                group {
                    address-group ag-blueiris
                    port-group pg-blueiris
                }
            }
            log enable
            protocol tcp
        }
        rule 400 {
            action accept
            destination {
                group {
                    address-group ntpservers
                    port-group pg-ntp
                }
            }
            log enable
            protocol udp
        }
        rule 450 {
            action accept
            destination {
                group {
                    address-group ag-dc
                    port-group pg-domain
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 500 {
            action accept
            destination {
                group {
                    address-group dnsforwarders
                    port-group pg-dns
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 501 {
            action accept
            description "Allow HTTP for Pi-hole"
            destination {
                group {
                    address-group dns-piholes
                    port-group pg-pihole
                }
            }
            log enable
            protocol tcp
        }
        rule 505 {
            action accept
            description "Allow admin interface for DNS blocking services"
            destination {
                group {
                    address-group dns-piholes
                    port-group pg-dnsblock_admin
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
        rule 560 {
            action accept
            destination {
                group {
                    address-group ag-wsus
                    port-group pg-wsus
                }
            }
            log enable
            protocol tcp
        }
        rule 600 {
            action accept
            destination {
                group {
                    address-group ag-dhcp-server
                    port-group pg-dhcp
                }
            }
            log enable
            protocol udp
        }
        rule 800 {
            action accept
            destination {
                group {
                    port-group pg-rdp
                }
            }
            log enable
            protocol tcp_udp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
        rule 900 {
            action accept
            destination {
                group {
                    port-group pg-ssh
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
        rule 950 {
            action accept
            destination {
                group {
                    address-group ag-cert_web
                    port-group pg-ocsp
                }
            }
            log enable
            protocol tcp
        }
        rule 951 {
            action accept
            destination {
                group {
                    address-group ag-cert_issuer
                    port-group pg-cert_issuer
                }
            }
            log enable
            protocol tcp
        }
        rule 960 {
            action accept
            destination {
                group {
                    address-group ag-kms
                    port-group pg-kms
                }
            }
            log enable
            protocol tcp
        }
    }
    name lan-download {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
        rule 300 {
            action accept
            destination {
                group {
                    port-group pg-smb
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
        rule 800 {
            action accept
            destination {
                group {
                    port-group pg-rdp
                }
            }
            log enable
            protocol tcp_udp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
    }
    name lan-firewall {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 10 {
            action accept
            destination {
                group {
                    address-group ag-vrrp-lan
                }
            }
            protocol vrrp
            source {
                group {
                    address-group ag-vrrp-lan
                }
            }
        }
        rule 100 {
            action accept
            destination {
                group {
                    address-group ag-fw-lan
                }
            }
            log enable
            protocol icmp
        }
        rule 101 {
            action accept
            destination {
                group {
                    address-group ag-vrrp-lan
                }
            }
            log enable
            protocol icmp
        }
        rule 455 {
            action accept
            destination {
                group {
                    port-group pg-iperf
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 600 {
            action accept
            destination {
                group {
                    port-group pg-dhcp
                }
            }
            log enable
            protocol udp
        }
        rule 602 {
            action accept
            destination {
                group {
                    address-group ag-mdns
                    port-group pg-mdns
                }
            }
            protocol udp
        }
        rule 605 {
            action accept
            description "Allow media/TV discovery (Direct)"
            destination {
                group {
                    address-group ag-bcast_lan
                    port-group pg-tv_discover
                }
            }
            log enable
            protocol udp
        }
        rule 606 {
            action accept
            description "Allow media/TV discovery (Limited)"
            destination {
                group {
                    address-group ag-bcast_limit
                    port-group pg-tv_discover
                }
            }
            log enable
            protocol udp
        }
        rule 610 {
            action drop
            description "Drop Netbios traffic from logs"
            destination {
                group {
                    port-group pg-netbios
                }
            }
            log disable
            protocol udp
        }
        rule 900 {
            action accept
            destination {
                group {
                    port-group pg-ssh
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
    }
    name lan-guest {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name lan-iot {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
        rule 207 {
            action accept
            destination {
                group {
                    port-group pg-google_cast
                }
            }
            log enable
            protocol tcp
        }
        rule 208 {
            action accept
            log enable
            protocol udp
            source {
                group {
                    port-group pg-google_cast_pic
                }
            }
        }
        rule 300 {
            action accept
            destination {
                group {
                    address-group ag-media_player
                    port-group pg-smb
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
        rule 555 {
            action accept
            destination {
                group {
                    address-group ag-tv_server
                    port-group pg-tvh_web
                }
            }
            log enable
            protocol tcp
        }
        rule 556 {
            action accept
            destination {
                group {
                    address-group ag-tv_server
                    port-group pg-tvh_htsp
                }
            }
            log enable
            protocol tcp
        }
    }
    name lan-mgmt {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
        rule 200 {
            action accept
            destination {
                group {
                    port-group pg-web
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
        rule 230 {
            action accept
            destination {
                group {
                    address-group ag-unifi
                    port-group pg-unifi
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
        rule 450 {
            action accept
            destination {
                group {
                    address-group ag-dc
                    port-group pg-domain
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 455 {
            action accept
            destination {
                group {
                    port-group pg-iperf
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 456 {
            action accept
            destination {
                group {
                    address-group ag-vcenter
                    port-group pg-vcenter
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
        rule 633 {
            action accept
            destination {
                group {
                    address-group ag-portainer
                    port-group pg-portainer
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
        rule 800 {
            action accept
            destination {
                group {
                    port-group pg-rdp
                }
            }
            log enable
            protocol tcp_udp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
        rule 900 {
            action accept
            destination {
                group {
                    port-group pg-ssh
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
    }
    name lan-public {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
        rule 223 {
            action accept
            destination {
                group {
                    address-group ag-traccar_srv
                    port-group pg-traccar_srv
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
        rule 900 {
            action accept
            destination {
                group {
                    port-group pg-ssh
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
    }
    name lan-wan {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
        rule 200 {
            action accept
            destination {
                group {
                    port-group pg-web
                }
            }
            log enable
            protocol tcp
        }
        rule 203 {
            action accept
            destination {
                group {
                    port-group pg-google_quic
                }
            }
            log enable
            protocol udp
        }
        rule 204 {
            action accept
            destination {
                group {
                    port-group pg-google_fcm
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 205 {
            action accept
            destination {
                group {
                    port-group pg-speedtest
                }
            }
            log enable
            protocol tcp
        }
        rule 208 {
            action accept
            destination {
                group {
                    port-group pg-agps
                }
            }
            log enable
            protocol tcp
        }
        rule 209 {
            action accept
            destination {
                group {
                    port-group pg-xmpp
                }
            }
            log enable
            protocol tcp
        }
        rule 215 {
            action accept
            destination {
                group {
                    port-group pg-spotify
                }
            }
            log enable
            protocol tcp
        }
        rule 360 {
            action accept
            destination {
                group {
                    port-group pg-iptv
                }
            }
            log enable
            protocol tcp
        }
        rule 400 {
            action accept
            destination {
                group {
                    port-group pg-ntp
                }
            }
            log enable
            protocol udp
        }
        rule 500 {
            action accept
            destination {
                group {
                    port-group pg-dns
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 620 {
            action accept
            destination {
                group {
                    port-group pg-crashplan
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group mgmtfromlan
                }
            }
        }
        rule 630 {
            action accept
            destination {
                group {
                    port-group pg-whatsapp
                }
            }
            log enable
            protocol udp
        }
        rule 631 {
            action accept
            destination {
                group {
                    port-group pg-skype
                }
            }
            log enable
            protocol udp
        }
        rule 632 {
            action accept
            destination {
                group {
                    port-group pg-webex
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 634 {
            action accept
            destination {
                group {
                    port-group pg-vpn_globalprotect
                }
            }
            log enable
            protocol udp
        }
        rule 635 {
            action accept
            destination {
                group {
                    port-group pg-person2work_genesys
                }
            }
            log enable
            protocol udp
        }
        rule 636 {
            action accept
            destination {
                group {
                    port-group pg-person2work_webrtc
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 637 {
            action accept
            destination {
                group {
                    port-group pg-person1work_lotusnotes
                }
            }
            log enable
            protocol tcp
        }
        rule 700 {
            action accept
            destination {
                group {
                    port-group pg-ftp
                }
            }
            log enable
            protocol tcp
        }
    }
    name mgmt-cam {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name mgmt-dmz {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
        rule 300 {
            action accept
            destination {
                group {
                    address-group ag-fileserver
                    port-group pg-smb
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group ag-hypervisors
                }
            }
        }
        rule 400 {
            action accept
            destination {
                group {
                    address-group ntpservers
                    port-group pg-ntp
                }
            }
            log enable
            protocol udp
        }
        rule 450 {
            action accept
            destination {
                group {
                    address-group ag-dc
                    port-group pg-domain
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 500 {
            action accept
            destination {
                group {
                    address-group dnsforwarders
                    port-group pg-dns
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 950 {
            action accept
            destination {
                group {
                    address-group ag-cert_web
                    port-group pg-ocsp
                }
            }
            log enable
            protocol tcp
        }
        rule 951 {
            action accept
            destination {
                group {
                    address-group ag-cert_issuer
                    port-group pg-cert_issuer
                }
            }
            log enable
            protocol tcp
        }
        rule 952 {
            action accept
            description "FOR SETTING UP MELLANOX SWITCHES - DELETE"
            destination {
                group {
                    address-group ag-cert_web
                    port-group pg-web
                }
            }
            log enable
            protocol tcp
        }
    }
    name mgmt-download {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name mgmt-firewall {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 10 {
            action accept
            destination {
                group {
                    address-group ag-vrrp-mgmt
                }
            }
            protocol vrrp
            source {
                group {
                    address-group ag-vrrp-mgmt
                }
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
        rule 231 {
            action accept
            description "Allow UniFi Controller Adaption"
            destination {
                group {
                    address-group ag-bcast_limit
                    port-group pg-unifi_adapt
                }
            }
            log enable
            protocol udp
        }
        rule 580 {
            action accept
            description "Allow UPS discover"
            destination {
                group {
                    address-group ag-bcast_limit
                    port-group pg-ups_web
                }
            }
            log enable
            protocol udp
            source {
                group {
                    address-group ag-ups_mgmt
                }
            }
        }
        rule 600 {
            action accept
            description "Allow DHCP relay from WiFi AP"
            destination {
                group {
                    address-group ag-bcast_limit
                    port-group pg-dhcp
                }
            }
            log enable
            protocol udp
        }
        rule 610 {
            action drop
            description "Drop Netbios traffic from logs"
            destination {
                group {
                    port-group pg-netbios
                }
            }
            log disable
            protocol udp
        }
        rule 650 {
            action accept
            description "Accept Conntrack Sync"
            destination {
                group {
                    address-group ag-ct_sync
                    port-group pg-ct_sync
                }
            }
            protocol udp
            source {
                group {
                    address-group ag-vrrp-mgmt
                }
            }
        }
        rule 900 {
            action accept
            destination {
                group {
                    port-group pg-ssh
                }
            }
            log enable
            protocol tcp
        }
    }
    name mgmt-guest {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name mgmt-lan {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
    }
    name mgmt-public {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
        rule 224 {
            action accept
            destination {
                group {
                    address-group ag-docker_pub
                    port-group pg-portainer_agent
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group ag-dockerhosts
                }
            }
        }
    }
    name mgmt-wan {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
        rule 198 {
            action accept
            destination {
                group {
                    port-group pg-web
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group ag-hypervisors
                }
            }
        }
        rule 199 {
            action accept
            destination {
                group {
                    port-group pg-web
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group ag-dockerhosts
                }
            }
        }
        rule 200 {
            action accept
            destination {
                group {
                    port-group pg-web
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group wifiaps
                }
            }
        }
        rule 787 {
            action accept
            description "TEST Allow HTTP/HTTPS"
            destination {
                group {
                    port-group pg-web
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group ag-testWEB
                }
            }
        }
        rule 788 {
            action accept
            description "TEST Allow NTP"
            destination {
                group {
                    port-group pg-ntp
                }
            }
            log enable
            protocol udp
            source {
                group {
                    address-group ag-testNTP
                }
            }
        }
        rule 789 {
            action accept
            description "TEST Allow DNS"
            destination {
                group {
                    port-group pg-dns
                }
            }
            log enable
            protocol tcp_udp
            source {
                group {
                    address-group ag-testDNS_fw
                }
            }
        }
    }
    name public-cam {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name public-dmz {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
        rule 200 {
            action accept
            destination {
                group {
                    port-group pg-web
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
        rule 222 {
            action accept
            destination {
                group {
                    address-group ag-traccar_mysql
                    port-group pg-mysql
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group ag-traccar_srv
                }
            }
        }
        rule 300 {
            action accept
            destination {
                group {
                    address-group ag-fileserver
                    port-group pg-smb
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
        rule 385 {
            action accept
            destination {
                group {
                    address-group ag-blueiris
                    port-group pg-blueiris
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
        rule 400 {
            action accept
            destination {
                group {
                    address-group ntpservers
                    port-group pg-ntp
                }
            }
            log enable
            protocol udp
        }
        rule 500 {
            action accept
            destination {
                group {
                    address-group dnsforwarders
                    port-group pg-dns
                }
            }
            log enable
            protocol tcp_udp
        }
        rule 501 {
            action accept
            description "Allow HTTP for pihole interface"
            destination {
                group {
                    address-group dns-piholes
                    port-group pg-pihole
                }
            }
            log enable
            protocol tcp
        }
        rule 505 {
            action accept
            description "Allow admin interface for DNS blocking services"
            destination {
                group {
                    address-group dns-piholes
                    port-group pg-dnsblock_admin
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
        rule 800 {
            action accept
            destination {
                group {
                    port-group pg-rdp
                }
            }
            log enable
            protocol tcp_udp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
        rule 950 {
            action accept
            destination {
                group {
                    address-group ag-cert_web
                    port-group pg-ocsp
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
    }
    name public-download {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
        rule 800 {
            action accept
            destination {
                group {
                    port-group pg-rdp
                }
            }
            log enable
            protocol tcp_udp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
        rule 900 {
            action accept
            destination {
                group {
                    port-group pg-ssh
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
    }
    name public-firewall {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 10 {
            action accept
            destination {
                group {
                    address-group ag-vrrp-public
                }
            }
            protocol vrrp
            source {
                group {
                    address-group ag-vrrp-public
                }
            }
        }
        rule 900 {
            action accept
            destination {
                group {
                    port-group pg-ssh
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
    }
    name public-guest {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name public-iot {
        default-action drop
        rule 555 {
            action accept
            destination {
                group {
                    address-group ag-tv_server
                    port-group pg-tvh_web
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
    }
    name public-lan {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 777 {
            action accept
            destination {
                group {
                    address-group ag-printer
                    port-group pg-printer_web
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
        rule 800 {
            action accept
            destination {
                group {
                    address-group mgmtfromlan
                    port-group pg-rdp
                }
            }
            log enable
            protocol tcp_udp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
    }
    name public-mgmt {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
        rule 200 {
            action accept
            destination {
                group {
                    port-group pg-web
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
        rule 230 {
            action accept
            destination {
                group {
                    address-group ag-unifi
                    port-group pg-unifi
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
        rule 400 {
            action accept
            destination {
                group {
                    address-group ntpservers
                    port-group pg-ntp
                }
            }
            log enable
            protocol udp
        }
        rule 456 {
            action accept
            destination {
                group {
                    address-group ag-vcenter
                    port-group pg-vcenter
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
        rule 633 {
            action accept
            destination {
                group {
                    address-group ag-portainer
                    port-group pg-portainer
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
        rule 800 {
            action accept
            destination {
                group {
                    port-group pg-rdp
                }
            }
            log enable
            protocol tcp_udp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
        rule 900 {
            action accept
            destination {
                group {
                    port-group pg-ssh
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    network-group vpnusers
                }
            }
        }
    }
    name public-wan {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 100 {
            action accept
            log enable
            protocol icmp
        }
        rule 200 {
            action accept
            destination {
                group {
                    port-group pg-web
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group ag-vpn_servers
                }
            }
        }
        rule 221 {
            action accept
            destination {
                group {
                    port-group pg-web
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group ag-docker_pub
                }
            }
        }
        rule 700 {
            action accept
            destination {
                group {
                    port-group pg-ftp
                }
            }
            log enable
            protocol tcp
            source {
                group {
                    address-group ag-vpn_servers
                }
            }
        }
    }
    name wan-cam {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name wan-dmz {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name wan-download {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name wan-firewall {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 600 {
            action drop
            description "Disable ISP DHCP and dont log it"
            destination {
                group {
                    address-group ag-bcast_limit
                    port-group pg-dhcp
                }
            }
            log disable
            protocol udp
            source {
                group {
                    port-group pg-dhcp
                }
            }
        }
    }
    name wan-guest {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name wan-iot {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name wan-lan {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name wan-mgmt {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
    }
    name wan-public {
        default-action drop
        enable-default-log
        rule 1 {
            action accept
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            log enable
            state {
                invalid enable
            }
        }
        rule 220 {
            action accept
            destination {
                group {
                    address-group ag-vpn_pri
                    port-group pg-vpn_pri
                }
            }
            log enable
            protocol tcp
        }
        rule 221 {
            action accept
            destination {
                group {
                    address-group ag-vpn_bck
                    port-group pg-vpn_bck
                }
            }
            log enable
            protocol udp
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
    twa-hazards-protection disable
}