Created
April 16, 2020 21:19
-
-
Save FeatherKing/0746d4dd32c2e9585524ca5150d1408c to your computer and use it in GitHub Desktop.
edgerouter X config
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| firewall { | |
| all-ping enable | |
| broadcast-ping disable | |
| group { | |
| } | |
| ipv6-receive-redirects disable | |
| ipv6-src-route disable | |
| ip-src-route disable | |
| log-martians enable | |
| name WAN_IN { | |
| default-action drop | |
| description "WAN to internal" | |
| rule 10 { | |
| action accept | |
| description "External Web Traffic 80" | |
| destination { | |
| port 80 | |
| } | |
| log disable | |
| protocol tcp | |
| state { | |
| established enable | |
| invalid disable | |
| new enable | |
| related enable | |
| } | |
| } | |
| rule 20 { | |
| action accept | |
| description "External Web Traffic 443" | |
| destination { | |
| port 443 | |
| } | |
| log disable | |
| protocol tcp | |
| state { | |
| established enable | |
| invalid disable | |
| new enable | |
| related enable | |
| } | |
| } | |
| rule 30 { | |
| action accept | |
| description "Allow established/related" | |
| state { | |
| established enable | |
| related enable | |
| } | |
| } | |
| rule 40 { | |
| action drop | |
| description "Drop invalid state" | |
| state { | |
| invalid enable | |
| } | |
| } | |
| } | |
| name WAN_LOCAL { | |
| default-action drop | |
| description "WAN to router" | |
| rule 10 { | |
| action accept | |
| description "Allow established/related" | |
| state { | |
| established enable | |
| related enable | |
| } | |
| } | |
| rule 20 { | |
| action accept | |
| description "SSH Remote" | |
| destination { | |
| port 22 | |
| } | |
| disable | |
| log disable | |
| protocol tcp_udp | |
| source { | |
| } | |
| } | |
| rule 30 { | |
| action drop | |
| description "Drop invalid state" | |
| state { | |
| invalid enable | |
| } | |
| } | |
| rule 31 { | |
| action accept | |
| description IKE | |
| destination { | |
| port 500 | |
| } | |
| log disable | |
| protocol udp | |
| } | |
| rule 40 { | |
| action accept | |
| description L2TP | |
| destination { | |
| port 1701 | |
| } | |
| log disable | |
| protocol udp | |
| } | |
| rule 50 { | |
| action accept | |
| description ESP | |
| log disable | |
| protocol esp | |
| } | |
| rule 60 { | |
| action accept | |
| description NAT-T | |
| destination { | |
| port 4500 | |
| } | |
| log disable | |
| protocol udp | |
| } | |
| } | |
| receive-redirects disable | |
| send-redirects enable | |
| source-validation disable | |
| syn-cookies enable | |
| } | |
| interfaces { | |
| ethernet eth0 { | |
| address dhcp | |
| description Internet | |
| duplex auto | |
| firewall { | |
| in { | |
| name WAN_IN | |
| } | |
| local { | |
| name WAN_LOCAL | |
| } | |
| } | |
| speed auto | |
| } | |
| ethernet eth1 { | |
| description Local | |
| duplex auto | |
| speed auto | |
| } | |
| ethernet eth2 { | |
| description Local | |
| duplex auto | |
| speed auto | |
| } | |
| ethernet eth3 { | |
| description Local | |
| duplex auto | |
| speed auto | |
| } | |
| ethernet eth4 { | |
| description Local | |
| duplex auto | |
| speed auto | |
| } | |
| loopback lo { | |
| } | |
| switch switch0 { | |
| address 192.168.0.2/24 | |
| description Local | |
| mtu 1500 | |
| switch-port { | |
| interface eth1 { | |
| } | |
| interface eth2 { | |
| } | |
| interface eth3 { | |
| } | |
| interface eth4 { | |
| } | |
| vlan-aware disable | |
| } | |
| } | |
| } | |
| port-forward { | |
| auto-firewall enable | |
| hairpin-nat enable | |
| lan-interface switch0 | |
| rule 1 { | |
| description urBackup | |
| forward-to { | |
| address 192.168.0.23 | |
| port 55415 | |
| } | |
| original-port 55415 | |
| protocol tcp_udp | |
| } | |
| rule 2 { | |
| description plex | |
| forward-to { | |
| address 192.168.0.23 | |
| port 32400 | |
| } | |
| original-port 32400 | |
| protocol tcp_udp | |
| } | |
| wan-interface eth0 | |
| } | |
| service { | |
| dhcp-server { | |
| disabled false | |
| hostfile-update disable | |
| shared-network-name lan { | |
| authoritative disable | |
| subnet 192.168.0.0/24 { | |
| default-router 192.168.0.2 | |
| dns-server 192.168.0.2 | |
| domain-name c.local | |
| lease 86400 | |
| start 192.168.0.11 { | |
| stop 192.168.0.60 | |
| } | |
| unifi-controller 192.168.0.23 | |
| } | |
| } | |
| static-arp disable | |
| use-dnsmasq enable | |
| } | |
| dns { | |
| dynamic { | |
| } | |
| forwarding { | |
| cache-size 10000 | |
| listen-on switch0 | |
| listen-on eth1 | |
| name-server 1.1.1.1 | |
| name-server 208.67.222.222 | |
| name-server 208.67.220.220 | |
| options listen-address=192.168.0.2 | |
| } | |
| } | |
| gui { | |
| http-port 80 | |
| https-port 443 | |
| older-ciphers enable | |
| } | |
| nat { | |
| rule 1 { | |
| description "Remote SSH" | |
| destination { | |
| port 1443 | |
| } | |
| inbound-interface eth0 | |
| inside-address { | |
| address 192.168.0.2 | |
| port 22 | |
| } | |
| log enable | |
| protocol tcp_udp | |
| source { | |
| } | |
| type destination | |
| } | |
| rule 2 { | |
| description "External Web Traffic 80" | |
| destination { | |
| port 80 | |
| } | |
| inbound-interface eth0 | |
| inside-address { | |
| address 192.168.0.23 | |
| port 80 | |
| } | |
| log disable | |
| protocol tcp_udp | |
| type destination | |
| } | |
| rule 3 { | |
| description "External Web Traffic 443" | |
| destination { | |
| port 443 | |
| } | |
| inbound-interface eth0 | |
| inside-address { | |
| address 192.168.0.23 | |
| port 443 | |
| } | |
| log disable | |
| protocol tcp_udp | |
| type destination | |
| } | |
| rule 5010 { | |
| description "masquerade for WAN" | |
| outbound-interface eth0 | |
| type masquerade | |
| } | |
| } | |
| ssh { | |
| port 22 | |
| protocol-version v2 | |
| } | |
| upnp { | |
| listen-on switch0 { | |
| outbound-interface eth0 | |
| } | |
| } | |
| } | |
| system { | |
| domain-name c.local | |
| host-name router | |
| login { | |
| user admin { | |
| authentication { | |
| encrypted-password $6$3HV9sXMWZJ8k$c1Bo5SVYvMfkFSFpiaYzDck0DbX/9qZZobDzhEIr4cHRGwUIlNe6Bw8kLahFt6jWIFkNG5U3WnQqUX8MDnhNE0 | |
| plaintext-password "" | |
| } | |
| level admin | |
| } | |
| user ubnt { | |
| authentication { | |
| encrypted-password $6$BLTSNjFIwoSAZ$TlBNnBaaJdqCNFctbtDMYeXBNGg8jxEREDaZ7IS7cGPDYpRONK6OFg95PRDsJBO7/gysb5KrjTExMThV.jlzE0 | |
| plaintext-password "" | |
| } | |
| level operator | |
| } | |
| } | |
| name-server 127.0.0.1 | |
| ntp { | |
| server 0.ubnt.pool.ntp.org { | |
| } | |
| server 1.ubnt.pool.ntp.org { | |
| } | |
| server 2.ubnt.pool.ntp.org { | |
| } | |
| server 3.ubnt.pool.ntp.org { | |
| } | |
| } | |
| offload { | |
| hwnat enable | |
| ipsec enable | |
| } | |
| syslog { | |
| global { | |
| facility all { | |
| level notice | |
| } | |
| facility protocols { | |
| level debug | |
| } | |
| } | |
| } | |
| time-zone UTC | |
| traffic-analysis { | |
| custom-category Games { | |
| name "Valve Steam" | |
| name QUIC | |
| name "Blizzard Entertainment" | |
| } | |
| dpi disable | |
| export enable | |
| } | |
| } | |
| traffic-control { | |
| } | |
| vpn { | |
| ipsec { | |
| auto-firewall-nat-exclude disable | |
| ipsec-interfaces { | |
| interface eth0 | |
| } | |
| logging { | |
| log-level 1 | |
| } | |
| } | |
| l2tp { | |
| remote-access { | |
| authentication { | |
| local-users { | |
| username feathers { | |
| password mysecret | |
| } | |
| } | |
| mode local | |
| } | |
| client-ip-pool { | |
| start 192.168.5.1 | |
| stop 192.168.5.10 | |
| } | |
| dhcp-interface eth0 | |
| dns-servers { | |
| server-1 192.168.0.2 | |
| } | |
| idle 1800 | |
| ipsec-settings { | |
| authentication { | |
| mode pre-shared-secret | |
| pre-shared-secret mysecret | |
| } | |
| ike-lifetime 3600 | |
| lifetime 3600 | |
| } | |
| mtu 1300 | |
| } | |
| } | |
| } | |
| /* Warning: Do not remove the following line. */ | |
| /* === vyatta-config-version: "config-management@1:conntrack@1:cron@1:dhcp-relay@1:dhcp-server@4:firewall@5:ipsec@5:nat@3:qos@1:quagga@2:suspend@1:system@4:ubnt-pptp@1:ubnt-udapi-server@1:ubnt-unms@1:ubnt-util@1:vrrp@1:webgui@1:webproxy@1:zone-policy@1" === */ | |
| /* Release version: v1.10.11.5274269.200221.1028 */ |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment