firewall {
    all-ping enable
    broadcast-ping disable
    group {
        address-group DNS_SERVERS {
            address 192.168.2.141
            description "Pihole etc"
        }
        address-group IPTV_IN {
            address 213.75.0.0/16
            address 217.166.0.0/16
            address 224.0.0.0/4
            address 239.0.0.0/16
            description "IPTV externe adress range"
        }
        network-group LOCAL_LANS {
            description "RFC1918 ranges"
            network 192.168.0.0/16
            network 172.16.0.0/12
            network 10.0.0.0/8
        }
    }
    ipv6-name WANv6_IN {
        default-action drop
        description "WAN inbound traffic forwarded to LAN"
        enable-default-log
        rule 10 {
            action accept
            description "Allow established/related sessions"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
        rule 30 {
            action accept
            icmpv6 {
                type echo-request
            }
            protocol ipv6-icmp
        }
    }
    ipv6-name WANv6_LOCAL {
        default-action drop
        description "WAN inbound traffic to the router"
        enable-default-log
        rule 10 {
            action accept
            description "Allow established/related sessions"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
        rule 30 {
            action accept
            description "Allow IPv6 icmp"
            icmpv6 {
            }
            protocol ipv6-icmp
        }
        rule 40 {
            action accept
            description "allow dhcpv6"
            destination {
                port 546
            }
            protocol udp
            source {
                port 547
            }
        }
    }
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    modify SOURCE_ROUTE {
        rule 100 {
            action modify
            description "traffic from 10.0.0.0/24 to vtun0"
            modify {
                table 1
            }
            source {
                address 10.0.0.0/24
            }
        }
    }
    name CH3SNAS {
        default-action drop
        description CH3SNAS_LOCAL
        rule 1 {
            action accept
            description "CH3SNAS NTP"
            destination {
                port 123
            }
            log disable
            protocol tcp_udp
        }
        rule 2 {
            action accept
            description "CH3SNAS DHCP"
            destination {
                port 67
            }
            log disable
            protocol udp
        }
    }
    name CH3SNAS_IN {
        default-action drop
        description ""
        rule 1 {
            action accept
            description "Allow established - related"
            destination {
                group {
                    network-group LOCAL_LANS
                }
            }
            log enable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
    }
    name IDIoT_IN {
        default-action accept
        description "IoT into the edgerouter"
        enable-default-log
        rule 10 {
            action accept
            description "Allow established related"
            destination {
                group {
                    network-group LOCAL_LANS
                }
            }
            log enable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 20 {
            action accept
            description "Allow PiHole DNS"
            destination {
                group {
                    address-group DNS_SERVERS
                }
                port 53
            }
            log enable
            protocol tcp_udp
        }
        rule 30 {
            action drop
            description "Drop non pihole DNS"
            destination {
                port 53
            }
            log disable
            protocol tcp_udp
        }
        rule 40 {
            action accept
            description "Allow RPi Zero W to NAS"
            destination {
                address 192.168.2.187
            }
            log disable
            protocol tcp_udp
            source {
                address 192.168.107.6
            }
        }
        rule 50 {
            action accept
            description "Allow LG TV to mediaserver"
            destination {
                address 192.168.2.187
            }
            log disable
            protocol all
            source {
                address 192.168.107.12
            }
        }
        rule 60 {
            action accept
            description "Allow Plex"
            destination {
                address 192.168.2.187
                port 32400
            }
            log disable
            protocol tcp
        }
        rule 70 {
            action drop
            description "Drop IoT to LAN network"
            destination {
                group {
                    network-group LOCAL_LANS
                }
            }
            log disable
            protocol all
        }
    }
    name IDIoT_LOCAL {
        default-action drop
        description "IoT to local IoT network"
        enable-default-log
        rule 10 {
            action accept
            description "Allow IoT DNS"
            destination {
                address 192.168.107.1
                port 53
            }
            log disable
            protocol tcp_udp
        }
        rule 30 {
            action accept
            description "Allow IoT DHCP"
            destination {
                port 67
            }
            log disable
            protocol udp
        }
        rule 40 {
            action accept
            description "Allow mDNS"
            destination {
                port 5353
            }
            log disable
            protocol udp
        }
    }
    name IPTV_IN {
        default-action accept
        description "IoT into the edgerouter"
        enable-default-log
        rule 20 {
            action accept
            description "Allow Established - Related"
            destination {
                group {
                    network-group LOCAL_LANS
                }
            }
            log disable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 30 {
            action drop
            description "Drop IPTV to LAN network"
            destination {
                group {
                    network-group LOCAL_LANS
                }
            }
            log disable
            protocol all
        }
    }
    name Surveillance_IN {
        default-action drop
        description ""
        rule 1 {
            action accept
            description "Allow established - related"
            destination {
                group {
                    network-group LOCAL_LANS
                }
            }
            log enable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
    }
    name Surveillance_LOCAL {
        default-action drop
        description ""
        enable-default-log
        rule 1 {
            action accept
            description "Allow DHCP Surveiilance"
            destination {
                port 67
            }
            log disable
            protocol udp
        }
        rule 2 {
            action accept
            description "Allow NTP surveillance"
            destination {
                port 123
            }
            log disable
            protocol tcp_udp
        }
    }
    name VPN_LOCAL {
        default-action drop
        description "VPN to VPN local"
        enable-default-log
        rule 1 {
            action accept
            description "Allow VPN DNS"
            destination {
                address 10.0.0.1
                port 53
            }
            log disable
            protocol tcp_udp
        }
        rule 2 {
            action accept
            description "Allow VPN DHCP"
            destination {
                port 67
            }
            log disable
            protocol udp
        }
    }
    name VoIP_IN {
        default-action accept
        description "VoIP into the edgerouter"
        enable-default-log
        rule 40 {
            action accept
            description "Allow established related"
            destination {
                group {
                    network-group LOCAL_LANS
                }
            }
            log enable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 50 {
            action drop
            description "Drop VoIP to LAN network"
            destination {
                group {
                    network-group LOCAL_LANS
                }
            }
            log disable
            protocol all
        }
    }
    name VoIP_LOCAL {
        default-action drop
        description "VoIP to local VoIP network"
        enable-default-log
        rule 1 {
            action accept
            description "Allow VoIP DNS"
            destination {
                address 192.168.222.1
                port 53
            }
            log disable
            protocol tcp_udp
        }
        rule 2 {
            action accept
            description "Allow VoIP DHCP"
            destination {
                port 67
            }
            log disable
            protocol udp
        }
    }
    name WAN_IN {
        default-action drop
        description "WAN to Internal"
        enable-default-log
        rule 10 {
            action accept
            description "Allow established/related"
            log enable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            log enable
            protocol all
            state {
                established disable
                invalid enable
                new disable
                related disable
            }
        }
    }
    name WAN_IN_IPTV {
        default-action drop
        description ""
        rule 10 {
            action accept
            description "Allow established - related"
            log disable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 20 {
            action accept
            description "IPTV  multicast"
            destination {
                group {
                    address-group IPTV_IN
                }
            }
            log disable
            protocol udp
            source {
                group {
                }
            }
        }
        rule 30 {
            action drop
            description invalid
            log disable
            protocol all
            state {
                established disable
                invalid enable
                new disable
                related disable
            }
        }
    }
    name WAN_LOCAL {
        default-action drop
        description "WAN to router"
        enable-default-log
        rule 10 {
            action accept
            description "Allow established/related"
            log disable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            log disable
            protocol all
            state {
                established disable
                invalid enable
                new disable
                related disable
            }
        }
    }
    name WAN_LOCAL_IPTV {
        default-action drop
        description ""
        rule 10 {
            action accept
            description "Allow established - related"
            log disable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 20 {
            action accept
            description "IPTV  multicast"
            destination {
                group {
                    address-group IPTV_IN
                }
            }
            log disable
            protocol udp
        }
        rule 30 {
            action accept
            description "Allow IGMP IPTV LOCAL"
            log disable
            protocol igmp
        }
        rule 31 {
            action drop
            description "block invalid"
            log disable
            protocol all
            state {
                established disable
                invalid enable
                new disable
                related disable
            }
        }
    }
    options {
        mss-clamp {
            interface-type all
            mss 1492
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
}
interfaces {
    ethernet eth0 {
        description "eth0 - FTTH"
        duplex auto
        mtu 1512
        poe {
            output off
        }
        speed auto
        vif 4 {
            address dhcp
            description "eth0.4 - IPTV"
            dhcp-options {
                client-option "send vendor-class-identifier "IPTV_RG";"
                client-option "request subnet-mask, routers, rfc3442-classless-static-routes;"
                default-route no-update
                default-route-distance 210
                name-server update
            }
            mtu 1500
        }
        vif 6 {
            description "eth0.6 - Internet"
            mtu 1508
            pppoe 0 {
                default-route auto
                dhcpv6-pd {
                    no-dns
                    pd 0 {
                        interface eth1 {
                            host-address ::1
                            prefix-id :1
                            service slaac
                        }
                        prefix-length /48
                    }
                    prefix-only
                    rapid-commit disable
                }
                firewall {
                    in {
                        ipv6-name WANv6_IN
                        name WAN_IN
                    }
                    local {
                        ipv6-name WANv6_LOCAL
                        name WAN_LOCAL
                    }
                }
                idle-timeout 180
                ipv6 {
                    address {
                        autoconf
                    }
                    dup-addr-detect-transmits 1
                    enable {
                    }
                }
                mtu 1500
                name-server auto
                password kpn
                user-id MACADRESHIER@internet
            }
        }
    }
    ethernet eth1 {
        address 192.168.2.254/24
        description "eth1 - LAN"
        duplex auto
        ipv6 {
            dup-addr-detect-transmits 1
            router-advert {
                cur-hop-limit 64
                link-mtu 0
                managed-flag false
                max-interval 600
                name-server CLOUDFLARE::1111
                name-server CLOUDFLARE::1001
                other-config-flag false
                prefix ::/64 {
                    autonomous-flag true
                    on-link-flag true
                    valid-lifetime 2592000
                }
                radvd-options "RDNSS CLOUDFLARE:::1111 CLOUDFLARE::1001 {};"
                reachable-time 0
                retrans-timer 0
                send-advert true
            }
        }
        poe {
            output off
        }
        speed auto
        vif 9 {
            address 10.0.0.1/24
            firewall {
                in {
                    modify SOURCE_ROUTE
                }
                local {
                    name VPN_LOCAL
                }
            }
        }
        vif 107 {
            address 192.168.107.1/24
            description "eth1.107 - IDIoT"
            firewall {
                in {
                    name IDIoT_IN
                }
                local {
                    name IDIoT_LOCAL
                }
            }
        }
        vif 247 {
            address 192.168.247.1/24
            description "eth1.247 - Surveillance"
            firewall {
                in {
                    name Surveillance_IN
                }
                local {
                    name Surveillance_LOCAL
                }
            }
            mtu 1500
        }
    }
    ethernet eth2 {
        address 192.168.222.1/24
        description "eth2 - VoIP - fritzbox"
        duplex auto
        firewall {
            in {
                name VoIP_IN
            }
            local {
                name VoIP_LOCAL
            }
        }
        mtu 1500
        poe {
            output off
        }
        speed auto
    }
    ethernet eth3 {
        address 192.168.0.1/24
        description "eth3 - CH3SNAS"
        duplex auto
        firewall {
            in {
                name CH3SNAS_IN
            }
            local {
                name CH3SNAS
            }
        }
        poe {
            output off
        }
        speed auto
    }
    ethernet eth4 {
        duplex auto
        poe {
            output off
        }
        speed auto
        vif 4 {
            address 192.168.4.1/24
            description "eth4.4 - IPTV to eth4"
            firewall {
                in {
                    name IPTV_IN
                }
                local {
                }
            }
        }
    }
    ethernet eth5 {
        duplex auto
        speed auto
    }
    loopback lo {
    }
    openvpn vtun0 {
        config-file /config/openvpn/nl417.nordvpn.com.udp.ovpn
        description "OpenVPN VPN tunnel"
    }
}
protocols {
    igmp-proxy {
        interface eth0 {
            role disabled
            threshold 1
        }
        interface eth0.4 {
            alt-subnet 0.0.0.0/0
            role upstream
            threshold 1
        }
        interface eth1 {
            role disabled
            threshold 1
        }
        interface eth1.107 {
            role downstream
            threshold 1
        }
        interface eth1.247 {
            role disabled
            threshold 1
        }
        interface eth2.7 {
            role disabled
            threshold 1
        }
        interface eth3 {
            role disabled
            threshold 1
        }
        interface eth4 {
            role disabled
            threshold 1
        }
        interface eth4.4 {
            alt-subnet 192.168.4.0/24
            role downstream
            threshold 1
        }
        interface eth5 {
            role disabled
            threshold 1
        }
    }
    static {
        interface-route6 ::/0 {
            next-hop-interface pppoe0 {
            }
        }
        route 213.75.112.0/21 {
            next-hop 10.200.32.1 {
            }
        }
        table 1 {
            interface-route 0.0.0.0/0 {
                next-hop-interface vtun0 {
                }
            }
        }
    }
}
service {
    dhcp-server {
        disabled false
        global-parameters "option vendor-class-identifier code 60 = string;"
        global-parameters "option broadcast-address code 28 = ip-address;"
        hostfile-update disable
        shared-network-name IDIoT {
            authoritative disable
            subnet 192.168.107.0/24 {
                default-router 192.168.107.1
                dns-server 192.168.107.1
                lease 86400
                start 192.168.107.2 {
                    stop 192.168.107.254
                }
              static-mapping XXusb {
                    ip-address 192.168.107.6
              mac-address MACADRES

                }
                unifi-controller 192.168.2.172
            }
        }
        shared-network-name LAN {
            authoritative enable
            subnet 192.168.2.0/24 {
                default-router 192.168.2.254
                dns-server 192.168.2.152
                dns-server 192.168.2.254
                lease 86400
                start 192.168.2.50 {
                    stop 192.168.2.200
                }
                static-mapping Ameterkast {
//								ANDERE STATIC MAPPINGS OM PRIVACY DOELEINDEN VERWIJDERD
            }
        }
        shared-network-name LAN_CH3SNAS {
            authoritative disable
            subnet 192.168.0.0/24 {
                default-router 192.168.0.1
                lease 100000
                start 192.168.0.2 {
                    stop 192.168.0.100
                }
            }
        }
        shared-network-name Surveillance {
            authoritative disable
            subnet 192.168.247.0/24 {
                default-router 192.168.247.1
                lease 604800
                start 192.168.247.2 {
                    stop 192.168.247.50
                }
            }
        }
        shared-network-name VPN_Subnet {
            authoritative disable
            subnet 10.0.0.0/24 {
                default-router 10.0.0.1
                dns-server 1.1.1.1
                dns-server 1.0.0.1
                lease 86400
                start 10.0.0.50 {
                    stop 10.0.0.150
                }
            }
        }
        shared-network-name VoIP {
            authoritative disable
            subnet 192.168.222.0/24 {
                default-router 192.168.222.1
                dns-server 192.168.222.1
                dns-server 1.1.1.1
                lease 86400
                start 192.168.222.2 {
                    stop 192.168.222.5
                }
                static-mapping FRITZBox {
                    ip-address 192.168.222.2
                    mac-address XXXXXXXXXXX
                }
            }
        }
        shared-network-name iptv {
            authoritative disable
            subnet 192.168.4.0/24 {
                default-router 192.168.4.1
                dns-server 192.168.4.1
                dns-server 1.1.1.1
                lease 86400
                start 192.168.4.2 {
                    stop 192.168.4.150
                }
                static-mapping STB {
                    ip-address 192.168.4.2
                    mac-address XXXXXXXXXXXXX
                }
                static-mapping STB_2 {
                    ip-address 192.168.4.3
                    mac-address XXXXXXXXXXXX
                }
                static-mapping STB_3 {
                    ip-address 192.168.4.4
                    mac-address XXXXXXXXXXXX
                }
            }
        }
        static-arp disable
        use-dnsmasq disable
    }
    dns {
        forwarding {
            cache-size 4000
            listen-on eth1
            listen-on eth1.107
            listen-on eth4.4
            listen-on eth1.9
            listen-on eth2
            listen-on vtun0
            name-server 1.1.1.1
            name-server 1.0.0.1
            name-server 2606:4700:4700::1111
            name-server 2606:4700:4700::1001
            options listen-address=192.168.2.254
        }
    }
    gui {
        http-port 80
        https-port 443
        older-ciphers enable
    }
    mdns {
        repeater {
            interface eth1
            interface eth1.107
        }
    }
    nat {
        rule 5000 {
            description "IPTV (0.4) TV signaal"
            destination {
                group {
                    address-group IPTV_IN
                }
            }
            log disable
            outbound-interface eth0.4
            protocol all
            source {
                group {
                }
            }
            type masquerade
        }
        rule 5010 {
            description "XS4ALL Internet"
            log enable
            outbound-interface pppoe0
            protocol all
            source {
                address 192.168.2.0/24
            }
            type masquerade
        }
        rule 5011 {
            description "IDIoT internet"
            destination {
                group {
                }
            }
            log enable
            outbound-interface pppoe0
            protocol all
            source {
                address 192.168.107.0/24
            }
            type masquerade
        }
        rule 5012 {
            description "IPTV (0.4) Internet signaal"
            log enable
            outbound-interface pppoe0
            protocol all
            source {
                address 192.168.4.0/24
            }
            type masquerade
        }
        rule 5030 {
            description "OpenVPN Clients"
            log disable
            outbound-interface vtun0
            source {
                address 10.0.0.0/24
            }
            type masquerade
        }
        rule 5031 {
            description VoIP
            log disable
            outbound-interface pppoe0
            protocol all
            source {
                address 192.168.222.0/24
                group {
                }
            }
            type masquerade
        }
    }
    ssh {
        port 22
        protocol-version v2
    }
    unms {
        disable
    }
}
system {
    analytics-handler {
        send-analytics-report false
    }
    crash-handler {
        send-crash-report false
    }
    host-name ubnt
    ipv6 {
    }
    login {
        user XXXXXX {
            authentication {
                encrypted-password XXXXXXXX
                plaintext-password XXXXXXXX
            }
            full-name "XXXXX"
            level admin
        }
    }
    name-server 127.0.0.1
    name-server 2606:4700:4700::1111
    name-server 2606:4700:4700::1001
    ntp {
        server 0.ubnt.pool.ntp.org {
        }
        server 1.ubnt.pool.ntp.org {
        }
        server 2.ubnt.pool.ntp.org {
        }
        server 3.ubnt.pool.ntp.org {
        }
    }
    offload {
        hwnat disable
        ipv4 {
            bonding enable
            forwarding enable
            gre enable
            pppoe enable
            vlan enable
        }
        ipv6 {
            bonding enable
            forwarding enable
            pppoe disable
            vlan enable
        }
    }
    package {
        repository wheezy {
            components "main contrib non-free"
            distribution wheezy
            password ""
            url http://mirror.leaseweb.com/debian
            username ""
        }
        repository wheezy-security {
            components main
            distribution wheezy/updates
            password ""
            url http://security.debian.org
            username ""
        }
    }
    syslog {
        global {
            facility all {
                level notice
            }
            facility protocols {
                level debug
            }
        }
    }
    task-scheduler {
        task updateIPTVroute {
            executable {
                path /config/scripts/tvroute.sh
            }
            interval 5m
        }
    }
    time-zone Europe/Amsterdam
    traffic-analysis {
        custom-category streaming_media {
            name Netflix
        }
        dpi enable
        export enable
    }
}

firewall {
    all-ping enable
    broadcast-ping disable
    group {
        address-group Blocked-DNS {
            address 8.8.8.8
            address 8.8.4.4
        }
    }
    ipv6-name WANv6_IN {
        default-action drop
        description "WAN IPv6 naar LAN"
        rule 10 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
        rule 30 {
            action accept
            description "Allow IPv6 icmp"
            icmpv6 {
                type echo-request
            }
            protocol ipv6-icmp
        }
    }
    ipv6-name WANv6_LOCAL {
        default-action drop
        description "WAN IPv6 naar Router"
        rule 10 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
        rule 30 {
            action accept
            description "Allow IPv6 icmp"
            protocol ipv6-icmp
        }
        rule 40 {
            action accept
            description "Allow dhcpv6"
            destination {
                port 546
            }
            protocol udp
            source {
                port 547
            }
        }
    }
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    name WAN_IN {
        default-action drop
        description "WAN naar LAN"
        rule 10 {
            action accept
            description "Allow established/related"
            log disable
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
    }
    name WAN_LOCAL {
        default-action drop
        description "WAN naar Router"
        rule 10 {
            action accept
            description "Allow established/related"
            log disable
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                established disable
                invalid enable
                new disable
                related disable
            }
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
}
interfaces {
    ethernet eth0 {
        description "Niet in gebruik"
        duplex auto
        speed auto
    }
    ethernet eth1 {
        address 192.168.2.254/24
        description Thuis
        duplex auto
        ipv6 {
            dup-addr-detect-transmits 1
            router-advert {
                cur-hop-limit 64
                link-mtu 0
                managed-flag false
                max-interval 30
                name-server 2a02:a47f:e000::53
                name-server 2a02:a47f:e000::54
                other-config-flag false
                prefix ::/64 {
                    autonomous-flag true
                    on-link-flag true
                    valid-lifetime 2592000
                }
                radvd-options "RDNSS 2a02:a47f:e000::53 2a02:a47f:e000::54 {};"
                reachable-time 0
                retrans-timer 0
                send-advert true
            }
        }
        speed auto
        vif 4 {
            address 192.168.4.254/24
            description IPTV
            egress-qos "0:5 1:5 2:5 3:5 4:5"
        }
    }
    ethernet eth2 {
        description "Niet in gebruik"
        duplex auto
        speed auto
    }
    ethernet eth3 {
        description FTTH
        duplex full
        mtu 1512
        speed 1000
        vif 4 {
            address dhcp
            description "KPN IPTV"
            dhcp-options {
                client-option "send vendor-class-identifier "IPTV_RG";"
                client-option "request subnet-mask, routers, rfc3442-classless-static-routes;"
                default-route no-update
                default-route-distance 210
                name-server update
            }
            mtu 1500
        }
        vif 6 {
            description "KPN Internet"
            mtu 1508
            pppoe 0 {
                default-route auto
                dhcpv6-pd {
                    no-dns
                    pd 0 {
                        interface eth1 {
                            host-address ::1
                            no-dns
                            prefix-id :1
                            service slaac
                        }
                        prefix-length /48
                    }
                    rapid-commit enable
                }
                firewall {
                    in {
                        ipv6-name WANv6_IN
                        name WAN_IN
                    }
                    local {
                        ipv6-name WANv6_LOCAL
                        name WAN_LOCAL
                    }
                }
                idle-timeout 180
                ipv6 {
                    address {
                        autoconf
                    }
                    dup-addr-detect-transmits 1
                    enable {
                    }
                }
                mtu 1500
                name-server auto
                password ppp
                user-id 74-ac-b9-12-ff-2a@internet
            }
        }
    }
    loopback lo {
    }
}
protocols {
    igmp-proxy {
        interface eth1.4 {
            alt-subnet 0.0.0.0/0
            role downstream
            threshold 1
        }
        interface eth3.4 {
            alt-subnet 0.0.0.0/0
            role upstream
            threshold 1
        }
    }
    static {
        interface-route6 ::/0 {
            next-hop-interface pppoe0 {
            }
        }
    }
}
service {
    dhcp-server {
        disabled false
        global-parameters "option vendor-class-identifier code 60 = string;"
        global-parameters "option broadcast-address code 28 = ip-address;"
        hostfile-update disable
        shared-network-name IPTV {
            authoritative disable
            subnet 192.168.4.0/24 {
                default-router 192.168.4.254
                dns-server 192.121.1.34
                dns-server 192.121.1.66
                domain-name iptv.local
                lease 86400
                start 192.168.4.100 {
                    stop 192.168.4.200
                }
            }
        }
        shared-network-name Thuis {
            authoritative enable
            subnet 192.168.2.0/24 {
                default-router 192.168.2.254
                dns-server 192.168.2.254
                domain-name thuis.local
                lease 86400
                start 192.168.2.1 {
                    stop 192.168.2.200
                }
                static-mapping RoborockS6 {
                    ip-address 192.168.2.156
                    mac-address 64:90:c1:05:d1:94
                }
                static-mapping XBOXONE {
                    ip-address 192.168.2.165
                    mac-address 28:16:a8:b3:14:56
                }
                static-mapping ccu3-webui {
                    ip-address 192.168.2.174
                    mac-address b8:27:eb:ef:c0:9a
                }
            }
        }
        static-arp disable
        use-dnsmasq enable
    }
    dns {
        forwarding {
            cache-size 4000
            listen-on eth1
            listen-on eth1.4
            name-server 2606:4700:4700::1112
            name-server 2606:4700:4700::1002
            name-server 195.121.97.202
            name-server 195.121.97.203
            name-server 2a02:a47f:ac::210
            name-server 2a02:a47f:ac::212
            name-server 1.1.1.2
            name-server 1.0.0.2
            options listen-address=192.168.2.254
            options listen-address=192.168.4.254
        }
    }
    gui {
        http-port 80
        https-port 443
        older-ciphers enable
    }
    nat {
        rule 1 {
            description "Redirect Blocked DNS servers"
            destination {
                group {
                    address-group Blocked-DNS
                }
                port 53
            }
            inbound-interface eth1
            inside-address {
                address 192.168.2.254
                port 53
            }
            log disable
            protocol tcp_udp
            type destination
        }
        rule 5010 {
            description Internet
            log disable
            outbound-interface pppoe0
            protocol all
            type masquerade
        }
        rule 5011 {
            description IPTV
            destination {
                address 213.75.112.0/21
            }
            log disable
            outbound-interface eth3.4
            protocol all
            source {
                address 192.168.0.0/16
            }
            type masquerade
        }
    }
    ssh {
        port 22
        protocol-version v2
    }
    telnet {
        port 23
    }
    unms {
        disable
    }
}
system {
    analytics-handler {
        send-analytics-report true
    }
    crash-handler {
        send-crash-report true
    }
    domain-name thuis.local
    host-name Thuis
    login {
        user ubnt {
            authentication {
                encrypted-password $5$1a5MCsybJbnY1mUT$kP4GIQSDP8eBj0LWMuBtnxvqQzI1305exIZ3/XLzj50
                plaintext-password ""
            }
            level admin
        }
    }
    name-server 127.0.0.1
    ntp {
        server 0.nl.pool.ntp.org {
        }
        server 1.nl.pool.ntp.org {
        }
        server ntp0.nl.net {
        }
        server ntp1.nl.net {
        }
        server time.kpn.net {
        }
    }
    offload {
        hwnat disable
        ipsec enable
        ipv4 {
            forwarding enable
            gre enable
            pppoe enable
            vlan enable
        }
        ipv6 {
            forwarding enable
            pppoe enable
            vlan disable
        }
    }
    syslog {
        global {
            facility all {
                level notice
            }
            facility protocols {
                level debug
            }
        }
    }
    time-zone Europe/Amsterdam
    traffic-analysis {
        dpi enable
        export enable
    }
}

/* Warning: Do not remove the following line. */
/* === vyatta-config-version: "config-management@1:conntrack@1:cron@1:dhcp-relay@1:dhcp-server@4:firewall@5:ipsec@5:nat@3:qos@1:quagga@2:suspend@1:system@5:ubnt-l2tp@1:ubnt-pptp@1:ubnt-udapi-server@1:ubnt-unms@2:ubnt-util@1:vrrp@1:vyatta-netflow@1:webgui@1:webproxy@1:zone-policy@1" === */
/* Release version: v2.0.9.5346345.201028.1647 */