API tools faq
paste
merloc

Edge router X / KPN

merloc
Jun 8th, 2018
266
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 9.78 KB | None | 0 0
raw download clone embed print report
  1. firewall {
  2. all-ping enable
  3. broadcast-ping disable
  4. ipv6-name WANv6_IN {
  5. default-action drop
  6. description "WAN inbound traffic forwarded to LAN"
  7. enable-default-log
  8. rule 10 {
  9. action accept
  10. description "Allow established/related sessions"
  11. state {
  12. established enable
  13. related enable
  14. }
  15. }
  16. rule 20 {
  17. action drop
  18. description "Drop invalid state"
  19. state {
  20. invalid enable
  21. }
  22. }
  23. }
  24. ipv6-name WANv6_LOCAL {
  25. default-action drop
  26. description "WAN inbound traffic to the router"
  27. enable-default-log
  28. rule 10 {
  29. action accept
  30. description "Allow established/related sessions"
  31. state {
  32. established enable
  33. related enable
  34. }
  35. }
  36. rule 20 {
  37. action drop
  38. description "Drop invalid state"
  39. state {
  40. invalid enable
  41. }
  42. }
  43. rule 30 {
  44. action accept
  45. description "Allow IPv6 icmp"
  46. protocol ipv6-icmp
  47. }
  48. rule 40 {
  49. action accept
  50. description "allow dhcpv6"
  51. destination {
  52. port 546
  53. }
  54. protocol udp
  55. source {
  56. port 547
  57. }
  58. }
  59. }
  60. ipv6-receive-redirects disable
  61. ipv6-src-route disable
  62. ip-src-route disable
  63. log-martians enable
  64. name WAN_IN {
  65. default-action drop
  66. description "WAN to Internal"
  67. enable-default-log
  68. rule 10 {
  69. action accept
  70. description "Allow established/related"
  71. log enable
  72. protocol all
  73. state {
  74. established enable
  75. invalid disable
  76. new disable
  77. related enable
  78. }
  79. }
  80. rule 20 {
  81. action drop
  82. description "Drop invalid state"
  83. log enable
  84. protocol all
  85. state {
  86. established disable
  87. invalid enable
  88. new disable
  89. related disable
  90. }
  91. }
  92. }
  93. name WAN_LOCAL {
  94. default-action drop
  95. description "WAN to router"
  96. enable-default-log
  97. rule 10 {
  98. action accept
  99. description "Allow established/related"
  100. log disable
  101. protocol all
  102. state {
  103. established enable
  104. invalid disable
  105. new disable
  106. related enable
  107. }
  108. }
  109. rule 20 {
  110. action drop
  111. description "Drop invalid state"
  112. log disable
  113. protocol all
  114. state {
  115. established disable
  116. invalid enable
  117. new disable
  118. related disable
  119. }
  120. }
  121. }
  122. receive-redirects disable
  123. send-redirects enable
  124. source-validation disable
  125. syn-cookies enable
  126. }
  127. interfaces {
  128. bridge br0 {
  129. aging 300
  130. bridged-conntrack disable
  131. hello-time 2
  132. max-age 20
  133. priority 32768
  134. promiscuous disable
  135. stp false
  136. }
  137. ethernet eth0 {
  138. description "eth0 - FTU"
  139. duplex auto
  140. mtu 1512
  141. speed auto
  142. vif 4 {
  143. address dhcp
  144. description "eth0.4 - IPTV"
  145. dhcp-options {
  146. client-option "send vendor-class-identifier "IPTV_RG";"
  147. client-option "request subnet-mask, routers, rfc3442-classless-static-routes;"
  148. default-route no-update
  149. default-route-distance 210
  150. name-server update
  151. }
  152. }
  153. vif 6 {
  154. description "eth0.6 - Internet"
  155. mtu 1508
  156. pppoe 0 {
  157. default-route auto
  158. dhcpv6-pd {
  159. no-dns
  160. pd 0 {
  161. interface eth1 {
  162. prefix-id :1
  163. service slaac
  164. }
  165. prefix-length /48
  166. }
  167. rapid-commit disable
  168. }
  169. firewall {
  170. in {
  171. ipv6-name WANv6_IN
  172. name WAN_IN
  173. }
  174. local {
  175. ipv6-name WANv6_LOCAL
  176. name WAN_LOCAL
  177. }
  178. }
  179. idle-timeout 180
  180. ipv6 {
  181. address {
  182. autoconf
  183. }
  184. dup-addr-detect-transmits 1
  185. enable {
  186. }
  187. }
  188. mtu 1500
  189. name-server auto
  190. password kpn
  191. user-id xx-xx-xx-xx-xx-xx@direct-adsl
  192. }
  193. }
  194. vif 7 {
  195. bridge-group {
  196. bridge br0
  197. }
  198. description "eth0.7 - VOIP"
  199. mtu 1500
  200. }
  201. }
  202. ethernet eth1 {
  203. address 10.10.10.4/24
  204. description "eth1 - LAN"
  205. duplex auto
  206. speed auto
  207. }
  208. ethernet eth2 {
  209. description "eth2 - IPTV"
  210. duplex auto
  211. mtu 1500
  212. speed auto
  213. vif 4 {
  214. description "eth2.4 - IPTV"
  215. mtu 1500
  216. }
  217. }
  218. ethernet eth3 {
  219. duplex auto
  220. speed auto
  221. }
  222. ethernet eth4 {
  223. description "eth2 - ExperiaBox"
  224. duplex auto
  225. speed auto
  226. vif 7 {
  227. bridge-group {
  228. bridge br0
  229. }
  230. description "eth2.7 - ExperiaBox VOIP"
  231. mtu 1500
  232. }
  233. }
  234. loopback lo {
  235. }
  236. switch switch0 {
  237. mtu 1500
  238. }
  239. }
  240. protocols {
  241. igmp-proxy {
  242. disable-quickleave
  243. interface eth0.4 {
  244. alt-subnet 10.16.12.0/16
  245. alt-subnet 213.75.0.0/16
  246. role upstream
  247. threshold 1
  248. }
  249. interface eth2 {
  250. role downstream
  251. threshold 1
  252. }
  253. }
  254. static {
  255. interface-route6 ::/0 {
  256. next-hop-interface pppoe0 {
  257. }
  258. }
  259. route 213.75.112.0/21 {
  260. next-hop 10.228.192.1 {
  261. }
  262. }
  263. }
  264. }
  265. service {
  266. dhcp-server {
  267. disabled false
  268. global-parameters "option vendor-class-identifier code 60 = string;"
  269. global-parameters "option broadcast-address code 28 = ip-address;"
  270. hostfile-update disable
  271. shared-network-name LAN {
  272. authoritative enable
  273. subnet 10.10.10.0/24 {
  274. default-router 10.10.10.4
  275. dns-server 8.8.8.8
  276. dns-server 8.8.4.4
  277. lease 86400
  278. start 10.10.10.100 {
  279. stop 10.10.10.200
  280. }
  281. }
  282. }
  283. static-arp disable
  284. use-dnsmasq disable
  285. }
  286. dns {
  287. forwarding {
  288. cache-size 150
  289. listen-on eth1
  290. name-server 8.8.8.8
  291. name-server 8.8.4.4
  292. options listen-address=10.10.10.4
  293. }
  294. }
  295. gui {
  296. http-port 80
  297. https-port 443
  298. older-ciphers enable
  299. }
  300. nat {
  301. rule 5000 {
  302. description IPTV
  303. destination {
  304. address 10.16.0.0/16
  305. }
  306. log disable
  307. outbound-interface eth0.4
  308. protocol all
  309. type masquerade
  310. }
  311. rule 5001 {
  312. description IPTV
  313. destination {
  314. address 213.75.112.0/21
  315. }
  316. log disable
  317. outbound-interface eth0.4
  318. protocol all
  319. type masquerade
  320. }
  321. rule 5010 {
  322. description "KPN Internet"
  323. log enable
  324. outbound-interface pppoe0
  325. protocol all
  326. source {
  327. address 10.10.10.4/24
  328. }
  329. type masquerade
  330. }
  331. }
  332. ssh {
  333. port 22
  334. protocol-version v2
  335. }
  336. }
  337. system {
  338. host-name ubnt
  339. login {
  340. user ubnt {
  341. authentication {
  342. encrypted-password
  343. x
  344. plaintext-password ""
  345. }
  346. full-name ""
  347. level admin
  348. }
  349. }
  350. name-server 8.8.8.8
  351. name-server 8.8.4.4
  352. ntp {
  353. server 0.ubnt.pool.ntp.org {
  354. }
  355. server 1.ubnt.pool.ntp.org {
  356. }
  357. server 2.ubnt.pool.ntp.org {
  358. }
  359. server 3.ubnt.pool.ntp.org {
  360. }
  361. }
  362. offload {
  363. hwnat enable
  364. }
  365. package {
  366. repository wheezy {
  367. components "main contrib non-free"
  368. distribution wheezy
  369. password ""
  370. url http://mirror.leaseweb.com/debian
  371. username ""
  372. }
  373. repository wheezy-security {
  374. components main
  375. distribution wheezy/updates
  376. password ""
  377. url http://security.debian.org
  378. username ""
  379. }
  380. }
  381. syslog {
  382. global {
  383. facility all {
  384. level notice
  385. }
  386. facility protocols {
  387. level debug
  388. }
  389. }
  390. }
  391. time-zone UTC
  392. traffic-analysis {
  393. dpi disable
  394. export disable
  395. }
  396. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!