LegacyTechops/mtp-configs/pfv-core-rtr02.pfv.turnsys.net

1012 lines
37 KiB
Plaintext
Raw Normal View History

2018-04-12 20:24:46 +00:00
<?xml version="1.0"?>
<opnsense>
<theme>opnsense</theme>
<sysctl>
<item>
<descr>Disable the pf ftp proxy handler.</descr>
<tunable>debug.pfftpproxy</tunable>
<value>default</value>
</item>
<item>
<descr>Increase UFS read-ahead speeds to match current state of hard drives and NCQ. More information here: http://ivoras.sharanet.org/blog/tree/2010-11-19.ufs-read-ahead.html</descr>
<tunable>vfs.read_max</tunable>
<value>default</value>
</item>
<item>
<descr>Set the ephemeral port range to be lower.</descr>
<tunable>net.inet.ip.portrange.first</tunable>
<value>default</value>
</item>
<item>
<descr>Drop packets to closed TCP ports without returning a RST</descr>
<tunable>net.inet.tcp.blackhole</tunable>
<value>default</value>
</item>
<item>
<descr>Do not send ICMP port unreachable messages for closed UDP ports</descr>
<tunable>net.inet.udp.blackhole</tunable>
<value>default</value>
</item>
<item>
<descr>Randomize the ID field in IP packets (default is 0: sequential IP IDs)</descr>
<tunable>net.inet.ip.random_id</tunable>
<value>default</value>
</item>
<item>
<descr>
Source routing is another way for an attacker to try to reach non-routable addresses behind your box.
It can also be used to probe for information about your internal networks. These functions come enabled
as part of the standard FreeBSD core system.
</descr>
<tunable>net.inet.ip.sourceroute</tunable>
<value>default</value>
</item>
<item>
<descr>
Source routing is another way for an attacker to try to reach non-routable addresses behind your box.
It can also be used to probe for information about your internal networks. These functions come enabled
as part of the standard FreeBSD core system.
</descr>
<tunable>net.inet.ip.accept_sourceroute</tunable>
<value>default</value>
</item>
<item>
<descr>
Redirect attacks are the purposeful mass-issuing of ICMP type 5 packets. In a normal network, redirects
to the end stations should not be required. This option enables the NIC to drop all inbound ICMP redirect
packets without returning a response.
</descr>
<tunable>net.inet.icmp.drop_redirect</tunable>
<value>default</value>
</item>
<item>
<descr>
This option turns off the logging of redirect packets because there is no limit and this could fill
up your logs consuming your whole hard drive.
</descr>
<tunable>net.inet.icmp.log_redirect</tunable>
<value>default</value>
</item>
<item>
<descr>Drop SYN-FIN packets (breaks RFC1379, but nobody uses it anyway)</descr>
<tunable>net.inet.tcp.drop_synfin</tunable>
<value>default</value>
</item>
<item>
<descr>Enable sending IPv4 redirects</descr>
<tunable>net.inet.ip.redirect</tunable>
<value>default</value>
</item>
<item>
<descr>Enable sending IPv6 redirects</descr>
<tunable>net.inet6.ip6.redirect</tunable>
<value>default</value>
</item>
<item>
<descr>Enable privacy settings for IPv6 (RFC 4941)</descr>
<tunable>net.inet6.ip6.use_tempaddr</tunable>
<value>default</value>
</item>
<item>
<descr>Prefer privacy addresses and use them over the normal addresses</descr>
<tunable>net.inet6.ip6.prefer_tempaddr</tunable>
<value>default</value>
</item>
<item>
<descr>Generate SYN cookies for outbound SYN-ACK packets</descr>
<tunable>net.inet.tcp.syncookies</tunable>
<value>default</value>
</item>
<item>
<descr>Maximum incoming/outgoing TCP datagram size (receive)</descr>
<tunable>net.inet.tcp.recvspace</tunable>
<value>default</value>
</item>
<item>
<descr>Maximum incoming/outgoing TCP datagram size (send)</descr>
<tunable>net.inet.tcp.sendspace</tunable>
<value>default</value>
</item>
<item>
<descr>Do not delay ACK to try and piggyback it onto a data packet</descr>
<tunable>net.inet.tcp.delayed_ack</tunable>
<value>default</value>
</item>
<item>
<descr>Maximum outgoing UDP datagram size</descr>
<tunable>net.inet.udp.maxdgram</tunable>
<value>default</value>
</item>
<item>
<descr>Handling of non-IP packets which are not passed to pfil (see if_bridge(4))</descr>
<tunable>net.link.bridge.pfil_onlyip</tunable>
<value>default</value>
</item>
<item>
<descr>Set to 1 to additionally filter on the physical interface for locally destined packets</descr>
<tunable>net.link.bridge.pfil_local_phys</tunable>
<value>default</value>
</item>
<item>
<descr>Set to 0 to disable filtering on the incoming and outgoing member interfaces.</descr>
<tunable>net.link.bridge.pfil_member</tunable>
<value>default</value>
</item>
<item>
<descr>Set to 1 to enable filtering on the bridge interface</descr>
<tunable>net.link.bridge.pfil_bridge</tunable>
<value>default</value>
</item>
<item>
<descr>Allow unprivileged access to tap(4) device nodes</descr>
<tunable>net.link.tap.user_open</tunable>
<value>default</value>
</item>
<item>
<descr>Randomize PID's (see src/sys/kern/kern_fork.c: sysctl_kern_randompid())</descr>
<tunable>kern.randompid</tunable>
<value>default</value>
</item>
<item>
<descr>Maximum size of the IP input queue</descr>
<tunable>net.inet.ip.intr_queue_maxlen</tunable>
<value>default</value>
</item>
<item>
<descr>Disable CTRL+ALT+Delete reboot from keyboard.</descr>
<tunable>hw.syscons.kbd_reboot</tunable>
<value>default</value>
</item>
<item>
<descr>Enable TCP extended debugging</descr>
<tunable>net.inet.tcp.log_debug</tunable>
<value>default</value>
</item>
<item>
<descr>Set ICMP Limits</descr>
<tunable>net.inet.icmp.icmplim</tunable>
<value>default</value>
</item>
<item>
<descr>TCP Offload Engine</descr>
<tunable>net.inet.tcp.tso</tunable>
<value>default</value>
</item>
<item>
<descr>UDP Checksums</descr>
<tunable>net.inet.udp.checksum</tunable>
<value>default</value>
</item>
<item>
<descr>Maximum socket buffer size</descr>
<tunable>kern.ipc.maxsockbuf</tunable>
<value>default</value>
</item>
<item>
<descr>Page Table Isolation (Meltdown mitigation, requires reboot.)</descr>
<tunable>vm.pmap.pti</tunable>
<value>default</value>
</item>
<item>
<descr>Disable Indirect Branch Restricted Speculation (Spectre V2 mitigation)</descr>
<tunable>hw.ibrs_disable</tunable>
<value>default</value>
</item>
</sysctl>
<system>
<optimization>normal</optimization>
<hostname>pfv-core-rtr02</hostname>
<domain>pfv.turnsys.net</domain>
<group>
<name>admins</name>
<description>System Administrators</description>
<scope>system</scope>
<gid>1999</gid>
<member>0</member>
<priv>user-shell-access</priv>
<priv>page-all</priv>
</group>
<user>
<name>root</name>
<descr>System Administrator</descr>
<scope>system</scope>
<groupname>admins</groupname>
<password>$2b$10$A6E8slPQ47ZeKAAWEZikquT4cKDePehCLY547YFCcOIlQGPcaTeSu</password>
<uid>0</uid>
<expires/>
<authorizedkeys>c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFDbzVUMEZFVUtvWWF4Umhqczl5V3pLdEV5WHVLSnZUV29scnlEMzk1ZXF5QkoweE94YmtYSis4RU13S3RXTTZOVzVxYXFXYlQySkovVnpPSWNvWW14QXUrK3F3U1dPZXNrVnIrRnhQcjJ5cGFXRDk4bkp5K0NwWjlSTjZQdzZLaWtIYWt5cXpTVVdLWGRvdldpVHBkenFSTytqMExtSm1nVWlUM05zaDQyZXlidnQvVDdKTWtWRzRXK2pvUlgrRENTNFVJUlJRZ01SRDRUcUJRL2pyOW03VnMwYUpuMWxmbGdzcHJzYWNnb2crc0hsRXppdHd3Y1JxTU5wcDVKbTBEZmhqNlBxQXZzZ0tKWVdPT01GVm93dkdzcW5ROXdxSm81QWxsbGJUR1YxUkhlSUJPM2ZSUlU4VWQ5VFBBM0FmeDE2L2FwZjFua0xoVjhRWDltSXhFV3A=</authorizedkeys>
<ipsecpsk/>
<otp_seed/>
</user>
<nextuid>2000</nextuid>
<nextgid>2000</nextgid>
<timezone>America/Chicago</timezone>
<timeservers>0.opnsense.pool.ntp.org 1.opnsense.pool.ntp.org 2.opnsense.pool.ntp.org 3.opnsense.pool.ntp.org</timeservers>
<webgui>
<protocol>https</protocol>
<ssl-certref>5ab5ea42ad218</ssl-certref>
<port/>
<ssl-ciphers/>
<interfaces/>
<compression/>
</webgui>
<disablenatreflection>yes</disablenatreflection>
<usevirtualterminal>1</usevirtualterminal>
<disableconsolemenu>1</disableconsolemenu>
<disablechecksumoffloading>1</disablechecksumoffloading>
<disablesegmentationoffloading>1</disablesegmentationoffloading>
<disablelargereceiveoffloading>1</disablelargereceiveoffloading>
<ipv6allow/>
<powerd_ac_mode>hadp</powerd_ac_mode>
<powerd_battery_mode>hadp</powerd_battery_mode>
<powerd_normal_mode>hadp</powerd_normal_mode>
<bogons>
<interval>monthly</interval>
</bogons>
<kill_states/>
<backupcount>60</backupcount>
<crypto_hardware>aesni</crypto_hardware>
<pf_share_forward>1</pf_share_forward>
<snat_use_sticky>1</snat_use_sticky>
<lb_use_sticky>1</lb_use_sticky>
<language>en_US</language>
<dnsserver>10.251.30.71</dnsserver>
<serialspeed>115200</serialspeed>
<primaryconsole>video</primaryconsole>
<ssh>
<noauto>1</noauto>
<interfaces/>
<enabled>enabled</enabled>
<permitrootlogin>1</permitrootlogin>
</ssh>
<dns1gw>none</dns1gw>
<dns2gw>none</dns2gw>
<dns3gw>none</dns3gw>
<dns4gw>none</dns4gw>
<dns5gw>none</dns5gw>
<dns6gw>none</dns6gw>
<dns7gw>none</dns7gw>
<dns8gw>none</dns8gw>
</system>
<interfaces>
<wan>
<enable>1</enable>
<if>ue0</if>
<ipaddr>dhcp</ipaddr>
<ipaddrv6>dhcp6</ipaddrv6>
<subnet>32</subnet>
<gateway/>
<blockbogons>on</blockbogons>
<media/>
<mediaopt/>
<dhcp6-ia-pd-len>0</dhcp6-ia-pd-len>
<descr>WAN</descr>
</wan>
<lan>
<enable>1</enable>
<if>bge0_vlan100</if>
<ipaddr>10.251.100.253</ipaddr>
<subnet>24</subnet>
<ipaddrv6/>
<subnetv6/>
<media/>
<mediaopt/>
<gateway/>
<gatewayv6/>
<descr>LAN</descr>
</lan>
<openvpn>
<internal_dynamic>1</internal_dynamic>
<enable>1</enable>
<if>openvpn</if>
<descr>OpenVPN</descr>
<type>group</type>
<virtual>1</virtual>
</openvpn>
<opt1>
<if>bge0_vlan30</if>
<descr>ProductionManagement</descr>
<enable>1</enable>
<spoofmac/>
<ipaddr>10.251.30.253</ipaddr>
<subnet>24</subnet>
</opt1>
<opt2>
<if>bge0_vlan22</if>
<descr>HouseServices</descr>
<enable>1</enable>
<spoofmac/>
<ipaddr>10.251.22.253</ipaddr>
<subnet>24</subnet>
</opt2>
<opt3>
<if>bge0_vlan200</if>
<descr>Nerdbone</descr>
<enable>1</enable>
<spoofmac/>
<ipaddr>10.251.200.253</ipaddr>
<subnet>24</subnet>
</opt3>
<opt4>
<if>bge0_vlan5</if>
<descr>RRVOIP</descr>
<enable>1</enable>
<spoofmac/>
<ipaddr>10.251.5.253</ipaddr>
<subnet>24</subnet>
</opt4>
<opt5>
<if>bge0_vlan3</if>
<descr>RRAP</descr>
<enable>1</enable>
<spoofmac/>
<ipaddr>10.251.3.253</ipaddr>
<subnet>24</subnet>
</opt5>
</interfaces>
<dhcpd>
<lan>
<enable>1</enable>
<numberoptions/>
<range>
<from>10.251.100.10</from>
<to>10.251.100.245</to>
</range>
<dnsserver>10.251.30.71</dnsserver>
</lan>
</dhcpd>
<unbound>
<enable>on</enable>
</unbound>
<snmpd>
<modules>
<mibii>1</mibii>
<netgraph>1</netgraph>
<pf>1</pf>
<hostres>1</hostres>
<ucd>1</ucd>
<regex>1</regex>
</modules>
<enable>1</enable>
<rocommunity>kn3lmgmt</rocommunity>
<pollport>161</pollport>
<syslocation/>
<syscontact/>
<trapserver/>
<trapserverport>162</trapserverport>
<trapstring/>
<bindip>opt1</bindip>
</snmpd>
<syslog>
<reverse>1</reverse>
<nentries>50</nentries>
<remoteserver>10.253.3.99</remoteserver>
<remoteserver2/>
<remoteserver3/>
<sourceip/>
<ipproto>ipv4</ipproto>
<dhcp>1</dhcp>
<portalauth>1</portalauth>
<mail>1</mail>
<vpn>1</vpn>
<dns>1</dns>
<apinger>1</apinger>
<relayd>1</relayd>
<hostapd>1</hostapd>
<system>1</system>
<enable>1</enable>
</syslog>
<nat>
<outbound>
<mode>automatic</mode>
</outbound>
</nat>
<filter>
<rule>
<type>pass</type>
<ipprotocol>inet</ipprotocol>
<descr>Default allow LAN to any rule</descr>
<interface>lan</interface>
<source>
<network>lan</network>
</source>
<destination>
<any/>
</destination>
</rule>
<rule>
<type>pass</type>
<ipprotocol>inet6</ipprotocol>
<descr>Default allow LAN IPv6 to any rule</descr>
<interface>lan</interface>
<source>
<network>lan</network>
</source>
<destination>
<any/>
</destination>
</rule>
<rule>
<type>pass</type>
<interface>openvpn</interface>
<ipprotocol>inet</ipprotocol>
<statetype>keep state</statetype>
<descr>allow full transit across vpn</descr>
<source>
<any>1</any>
</source>
<destination>
<any>1</any>
</destination>
<updated>
<username>root@10.251.100.101</username>
<time>1521872107.9121</time>
<description>/firewall_rules_edit.php made changes</description>
</updated>
<created>
<username>root@10.251.100.101</username>
<time>1521872107.9121</time>
<description>/firewall_rules_edit.php made changes</description>
</created>
</rule>
<rule>
<type>pass</type>
<interface>openvpn</interface>
<ipprotocol>inet</ipprotocol>
<statetype>keep state</statetype>
<descr>allow bgp</descr>
<protocol>tcp</protocol>
<source>
<address>192.168.198.1/30</address>
</source>
<destination>
<address>192.168.198.2/30</address>
<port>179</port>
</destination>
<updated>
<username>root@10.251.100.101</username>
<time>1521913738.0839</time>
<description>/firewall_rules_edit.php made changes</description>
</updated>
<created>
<username>root@10.251.100.101</username>
<time>1521913738.0839</time>
<description>/firewall_rules_edit.php made changes</description>
</created>
</rule>
<rule>
<type>pass</type>
<interface>opt1</interface>
<ipprotocol>inet</ipprotocol>
<statetype>keep state</statetype>
<source>
<network>lan</network>
</source>
<destination>
<network>opt1</network>
</destination>
<updated>
<username>root@10.251.100.101</username>
<time>1522507174.5786</time>
<description>/firewall_rules_edit.php made changes</description>
</updated>
<created>
<username>root@10.251.100.101</username>
<time>1522027365.9625</time>
<description>/firewall_rules_edit.php made changes</description>
</created>
</rule>
<rule>
<type>pass</type>
<interface>opt1</interface>
<ipprotocol>inet</ipprotocol>
<statetype>keep state</statetype>
<source>
<address>10.40.50.0/24</address>
</source>
<destination>
<network>opt1</network>
</destination>
<updated>
<username>root@10.251.100.101</username>
<time>1522508077.631</time>
<description>/firewall_rules_edit.php made changes</description>
</updated>
<created>
<username>root@10.251.100.101</username>
<time>1522508077.631</time>
<description>/firewall_rules_edit.php made changes</description>
</created>
</rule>
<rule>
<type>pass</type>
<interface>opt1</interface>
<ipprotocol>inet</ipprotocol>
<statetype>keep state</statetype>
<source>
<address>10.253.3.0/24</address>
</source>
<destination>
<network>opt1</network>
</destination>
<updated>
<username>root@10.251.100.101</username>
<time>1522508132.8358</time>
<description>/firewall_rules_edit.php made changes</description>
</updated>
<created>
<username>root@10.251.100.101</username>
<time>1522508132.8359</time>
<description>/firewall_rules_edit.php made changes</description>
</created>
</rule>
<rule>
<type>pass</type>
<interface>opt2</interface>
<ipprotocol>inet</ipprotocol>
<statetype>keep state</statetype>
<source>
<network>lan</network>
</source>
<destination>
<network>opt2</network>
</destination>
<updated>
<username>root@10.251.100.101</username>
<time>1522452947.2917</time>
<description>/firewall_rules_edit.php made changes</description>
</updated>
<created>
<username>root@10.251.100.101</username>
<time>1522452914.5354</time>
<description>/firewall_rules_edit.php made changes</description>
</created>
</rule>
<rule>
<type>pass</type>
<interface>opt3</interface>
<ipprotocol>inet</ipprotocol>
<statetype>keep state</statetype>
<source>
<network>lan</network>
</source>
<destination>
<network>opt3</network>
</destination>
<updated>
<username>root@10.251.100.101</username>
<time>1523232300.5565</time>
<description>/firewall_rules_edit.php made changes</description>
</updated>
<created>
<username>root@10.251.100.101</username>
<time>1523232300.5565</time>
<description>/firewall_rules_edit.php made changes</description>
</created>
</rule>
</filter>
<rrd>
<enable/>
</rrd>
<load_balancer>
<monitor_type>
<name>ICMP</name>
<type>icmp</type>
<descr>ICMP</descr>
<options/>
</monitor_type>
<monitor_type>
<name>TCP</name>
<type>tcp</type>
<descr>Generic TCP</descr>
<options/>
</monitor_type>
<monitor_type>
<name>HTTP</name>
<type>http</type>
<descr>Generic HTTP</descr>
<options>
<path>/</path>
<host/>
<code>200</code>
</options>
</monitor_type>
<monitor_type>
<name>HTTPS</name>
<type>https</type>
<descr>Generic HTTPS</descr>
<options>
<path>/</path>
<host/>
<code>200</code>
</options>
</monitor_type>
<monitor_type>
<name>SMTP</name>
<type>send</type>
<descr>Generic SMTP</descr>
<options>
<send/>
<expect>220 *</expect>
</options>
</monitor_type>
</load_balancer>
<ntpd>
<prefer>0.opnsense.pool.ntp.org</prefer>
</ntpd>
<widgets>
<sequence>system_information-container:00000000-col3:show,services_status-container:00000001-col4:show,gateways-container:00000002-col4:show,interface_list-container:00000003-col4:show</sequence>
<column_count>2</column_count>
</widgets>
<revision>
<username>root@10.40.50.77</username>
<time>1523564426.0701</time>
<description>/services_snmp.php made changes</description>
</revision>
<OPNsense>
<captiveportal version="1.0.0">
<zones/>
<templates/>
</captiveportal>
<cron version="1.0.0">
<jobs/>
</cron>
<TrafficShaper version="1.0.1">
<pipes/>
<queues/>
<rules/>
</TrafficShaper>
<IDS version="1.0.1">
<rules/>
<userDefinedRules/>
<files/>
<fileTags/>
<general>
<enabled>0</enabled>
<ips>0</ips>
<promisc>0</promisc>
<interfaces>wan</interfaces>
<homenet>192.168.0.0/16,10.0.0.0/8,172.16.0.0/12</homenet>
<defaultPacketSize/>
<UpdateCron/>
<AlertLogrotate>W0D23</AlertLogrotate>
<AlertSaveLogs>4</AlertSaveLogs>
<MPMAlgo>ac</MPMAlgo>
<syslog>0</syslog>
<LogPayload>0</LogPayload>
</general>
</IDS>
<proxy version="1.0.0">
<general>
<enabled>0</enabled>
<icpPort/>
<logging>
<enable>
<accessLog>1</accessLog>
<storeLog>1</storeLog>
</enable>
<ignoreLogACL/>
<target/>
</logging>
<alternateDNSservers/>
<dnsV4First>0</dnsV4First>
<forwardedForHandling>on</forwardedForHandling>
<uriWhitespaceHandling>strip</uriWhitespaceHandling>
<useViaHeader>1</useViaHeader>
<suppressVersion>0</suppressVersion>
<VisibleEmail>admin@localhost.local</VisibleEmail>
<VisibleHostname/>
<cache>
<local>
<enabled>0</enabled>
<directory>/var/squid/cache</directory>
<cache_mem>256</cache_mem>
<maximum_object_size/>
<size>100</size>
<l1>16</l1>
<l2>256</l2>
<cache_linux_packages>0</cache_linux_packages>
<cache_windows_updates>0</cache_windows_updates>
</local>
</cache>
<traffic>
<enabled>0</enabled>
<maxDownloadSize>2048</maxDownloadSize>
<maxUploadSize>1024</maxUploadSize>
<OverallBandwidthTrotteling>1024</OverallBandwidthTrotteling>
<perHostTrotteling>256</perHostTrotteling>
</traffic>
</general>
<forward>
<interfaces>lan</interfaces>
<port>3128</port>
<sslbumpport>3129</sslbumpport>
<sslbump>0</sslbump>
<sslurlonly>0</sslurlonly>
<sslcertificate/>
<sslnobumpsites/>
<ssl_crtd_storage_max_size>4</ssl_crtd_storage_max_size>
<sslcrtd_children>5</sslcrtd_children>
<ftpInterfaces/>
<ftpPort>2121</ftpPort>
<ftpTransparentMode>0</ftpTransparentMode>
<addACLforInterfaceSubnets>1</addACLforInterfaceSubnets>
<transparentMode>0</transparentMode>
<acl>
<allowedSubnets/>
<unrestricted/>
<bannedHosts/>
<whiteList/>
<blackList/>
<browser/>
<mimeType/>
<safePorts>80:http,21:ftp,443:https,70:gopher,210:wais,1025-65535:unregistered ports,280:http-mgmt,488:gss-http,591:filemaker,777:multiling http</safePorts>
<sslPorts>443:https</sslPorts>
<remoteACLs>
<blacklists/>
<UpdateCron/>
</remoteACLs>
</acl>
<icap>
<enable>0</enable>
<RequestURL>icap://[::1]:1344/avscan</RequestURL>
<ResponseURL>icap://[::1]:1344/avscan</ResponseURL>
<SendClientIP>1</SendClientIP>
<SendUsername>0</SendUsername>
<EncodeUsername>0</EncodeUsername>
<UsernameHeader>X-Username</UsernameHeader>
<EnablePreview>1</EnablePreview>
<PreviewSize>1024</PreviewSize>
<OptionsTTL>60</OptionsTTL>
<exclude/>
</icap>
<authentication>
<method/>
<realm>OPNsense proxy authentication</realm>
<credentialsttl>2</credentialsttl>
<children>5</children>
</authentication>
</forward>
</proxy>
<Netflow version="1.0.0">
<capture>
<interfaces/>
<egress_only>wan</egress_only>
<version>v9</version>
<targets/>
</capture>
<collect>
<enable>0</enable>
</collect>
</Netflow>
<quagga>
<general version="0.0.0">
<enabled>1</enabled>
<enablelogfile>1</enablelogfile>
<logfilelevel>debugging</logfilelevel>
<enablesyslog>0</enablesyslog>
<sysloglevel>notifications</sysloglevel>
</general>
<bgp version="0.0.0">
<enabled>1</enabled>
<asnumber>64524</asnumber>
<networks>10.251.0.0/16,192.168.198.0/30</networks>
<redistribute/>
<neighbors>
<neighbor uuid="d10c2862-f1bd-4a37-b72f-6d69cfd7125d">
<enabled>1</enabled>
<address>192.168.198.1</address>
<remoteas>64517</remoteas>
<updatesource>openvpn</updatesource>
<nexthopself>0</nexthopself>
<defaultoriginate>0</defaultoriginate>
<linkedPrefixlistIn/>
<linkedPrefixlistOut/>
<linkedRoutemapIn/>
<linkedRoutemapOut/>
</neighbor>
</neighbors>
<aspaths/>
<prefixlists/>
<routemaps/>
</bgp>
</quagga>
<clamav>
<general version="1.0.0">
<enabled>0</enabled>
<fc_enabled>0</fc_enabled>
<enabletcp>1</enabletcp>
<maxthreads>10</maxthreads>
<maxqueue>100</maxqueue>
<idletimeout>30</idletimeout>
<maxdirrecursion>20</maxdirrecursion>
<followdirsym>0</followdirsym>
<followfilesym>0</followfilesym>
<disablecache>0</disablecache>
<scanpe>1</scanpe>
<scanelf>1</scanelf>
<detectbroken>0</detectbroken>
<scanole2>1</scanole2>
<ole2blockmarcros>0</ole2blockmarcros>
<scanpdf>1</scanpdf>
<scanswf>1</scanswf>
<scanxmldocs>1</scanxmldocs>
<scanhwp3>1</scanhwp3>
<scanmailfiles>1</scanmailfiles>
<scanhtml>1</scanhtml>
<scanarchive>1</scanarchive>
<arcblockenc>0</arcblockenc>
<maxscansize>100M</maxscansize>
<maxfilesize>25M</maxfilesize>
<maxrecursion>16</maxrecursion>
<maxfiles>10000</maxfiles>
<fc_logverbose>0</fc_logverbose>
<fc_databasemirror>database.clamav.net</fc_databasemirror>
<fc_timeout>60</fc_timeout>
</general>
</clamav>
</OPNsense>
<vlans>
<vlan>
<if>bge0</if>
<tag>100</tag>
<vlanif>bge0_vlan100</vlanif>
</vlan>
<vlan>
<if>bge0</if>
<tag>100</tag>
<vlanif>bge0_vlan100</vlanif>
</vlan>
<vlan>
<if>bge0</if>
<tag>30</tag>
<pcp>0</pcp>
<descr>ProductionManagement</descr>
<vlanif>bge0_vlan30</vlanif>
</vlan>
<vlan>
<if>bge0</if>
<tag>200</tag>
<pcp>0</pcp>
<descr>Nerdbone</descr>
<vlanif>bge0_vlan200</vlanif>
</vlan>
<vlan>
<if>bge0</if>
<tag>22</tag>
<pcp>0</pcp>
<descr>LabManagement</descr>
<vlanif>bge0_vlan22</vlanif>
</vlan>
<vlan>
<if>bge0</if>
<tag>3</tag>
<pcp>0</pcp>
<descr>RR-AP</descr>
<vlanif>bge0_vlan3</vlanif>
</vlan>
<vlan>
<if>bge0</if>
<tag>4</tag>
<pcp>0</pcp>
<descr>RR-SW</descr>
<vlanif>bge0_vlan4</vlanif>
</vlan>
<vlan>
<if>bge0</if>
<tag>5</tag>
<pcp>0</pcp>
<descr>RR-VOIP</descr>
<vlanif>bge0_vlan5</vlanif>
</vlan>
<vlan>
<if>bge0</if>
<tag>6</tag>
<pcp>0</pcp>
<descr>RR-RTR-LAN1</descr>
<vlanif>bge0_vlan6</vlanif>
</vlan>
<vlan>
<if>bge0</if>
<tag>7</tag>
<pcp>0</pcp>
<descr>RR-IPTV</descr>
<vlanif>bge0_vlan7</vlanif>
</vlan>
<vlan>
<if>bge0</if>
<tag>8</tag>
<pcp>0</pcp>
<descr>RR-PeanutGallery1</descr>
<vlanif>bge0_vlan8</vlanif>
</vlan>
<vlan>
<if>bge0</if>
<tag>9</tag>
<pcp>0</pcp>
<descr>RR-MalZoo</descr>
<vlanif>bge0_vlan9</vlanif>
</vlan>
<vlan>
<if>bge0</if>
<tag>10</tag>
<pcp>0</pcp>
<descr>RR-Fstack1</descr>
<vlanif>bge0_vlan10</vlanif>
</vlan>
<vlan>
<if>bge0</if>
<tag>11</tag>
<pcp>0</pcp>
<descr>RR-RTRWAN-1</descr>
<vlanif>bge0_vlan11</vlanif>
</vlan>
</vlans>
<cert>
<refid>5ab5ea42ad218</refid>
<descr>Web GUI SSL certificate</descr>
<crt>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZiekNDQTFlZ0F3SUJBZ0lKQU40UkRYZDJBRkhnTUEwR0NTcUdTSWIzRFFFQkN3VUFNRTR4Q3pBSkJnTlYKQkFZVEFrNU1NUlV3RXdZRFZRUUlEQXhhZFdsa0xVaHZiR3hoYm1ReEZUQVRCZ05WQkFjTURFMXBaR1JsYkdoaApjbTVwY3pFUk1BOEdBMVVFQ2d3SVQxQk9jMlZ1YzJVd0hoY05NVGd3TXpJME1EWXdNelEzV2hjTk1Ua3dNekkwCk1EWXdNelEzV2pCT01Rc3dDUVlEVlFRR0V3Sk9UREVWTUJNR0ExVUVDQXdNV25WcFpDMUliMnhzWVc1a01SVXcKRXdZRFZRUUhEQXhOYVdSa1pXeG9ZWEp1YVhNeEVUQVBCZ05WQkFvTUNFOVFUbk5sYm5ObE1JSUNJakFOQmdrcQpoa2lHOXcwQkFRRUZBQU9DQWc4QU1JSUNDZ0tDQWdFQTU1NDB5ZmVxOXo0cmxNYW9xRWJmbWxBWTZNUXRjSGNxCi9PZzZMMytlQ1BYa1d6ZjFGZ3lsSVgxRWwyR0xkMk16OGlFRXZLMHZaVzhGVWNxbVlUeDgzN1RNNEVjdUhmSFgKRnBBNm1yYUh6RUNORThUaGpVeTgwL1NJbW9VdnUzdmR1YmFSVFMvMnFjMkhKLzdOWXpXc2hmaUFOYVVLRy9JYwpDY2hCZ1RhczJNVERuUGZ4UEY0YkZTOGtFYXJobFYzYzlJbHNUT3RmTG9iLzBpdkRyUU5RK3BtdlRYeS9Eb05ICi9RMmZyTVZOUWh2M0FUK25neFFKSXQvN3prcDR2YlVocHh5SW1ZSXZyOFNvWTVBeDBTRmR3YkFPTG5qQVZxWlMKUXNRaWdERkZaRi9uS05Zbk55enljMEJIbkdxS0Rxdm9HUGJjTDF2MS9mbG0yNWlPSkFKN1JPdzA5NExoc0l3NApOcmdqRURVQ0ZIWmJsdlBzT09IZlo1b3pCaU93Z2drY210MzVxVjBjcFkrQ0hodFRGZVV3R3BSUGlWRjNBeGUrClVZV1l2dXlVMkt0RDFIYzR6Wmg0a3p0WE0yMGpkMS9IOVRJNkhyQ2owaFJaN2hhSDZvOTJmL2luU0VkS2JuUW8KeHRzKzMyUElHRGRRQnpjNWZHL2dMT3F3NkQ5YjFyNTV0QkkrTUFrNlZ4NVM4STZsamgzeVRzQVI3Y2tiRlp4dApuSWtrbSt4YmJUTUdZd2xuaHpJUDE3dGloS2tyMjg3eGkyNndnK01ZaEJBMkZ2VVNPOHU3Mm1NbDdQUFNqU3hLCjZqTjJST1AzVTBnNElwM3N4K1ltbGdOUnp1Q1M2K0crdHJiVmlER3cvNHZ4UHZTcDJHM0M3cUZlQXF2SkJkY0oKQzhkSlJoZDkyUVVDQXdFQUFhTlFNRTR3SFFZRFZSME9CQllFRkhXeHZwdituUnFCczJIbHJQZ3lkVUc1Uk5EWgpNQjhHQTFVZEl3UVlNQmFBRkhXeHZwdituUnFCczJIbHJQZ3lkVUc1Uk5EWk1Bd0dBMVVkRXdRRk1BTUJBZjh3CkRRWUpLb1pJaHZjTkFRRUxCUUFEZ2dJQkFPS2NyRGNTRCtQbWtLY3poaU5WWGtKYisrdjdUdmh3UHpWbGRCNUMKbnc4R0kxMjRKYS9ZR01hQWVhMEs0ZlJwTjVGTFhZWHpDRUVXYlpDaS9oZm5DaG9IVXljbmtuN2VtR0UrZW9pYwpCcXhZUGNMcVdUcWw4YkpjWlNLSUFwZlBBZStuNktyc2syS0FZb0JpVHppb0lQdlpXanBTNEhCMTlOVkxweVJPCmVuS1BMcmZsZEpBNiszTGgrRXhNb1Y3VXNGc2REbzYxVU81d21PVm4vcDV2MmlvYVVkN3VZVUJSemJDRlF3SzkKNDhPR01WbkZVRnJoV2MxaE44ZkJ1c3A2V0lZOFYwdGJzM3JkQUJXdXladFMxQXFCdG9tR24vTDRhSWVSZmpRZwp1bDkvT0M2dWRjcHEvVkk0SVZDckd6TFpBem9xWit3VUZkaVpCVFRLWEpxU3R5cUVFZDY1Q3Z4Sm5QdllSR0IwCmNhOVRWMGtFYkFONDB6R2J4V3IySGN2UmRRR21FUUVjdjBUTmtUWVlDTjI3YmxWWGZiVHliU2dLL2VXcEF2VSsKaTE2NVRuZFZBeHh5ZkFJZmxwRFFyVDFrVHcwbWxFR2ZNcHRIck1SOXpWTm1nRjhNS041V3psTE9xNDR3bjQ4RAptR0IxZjVkR0VaTVd4NlN3cGpySUxoN0xWYkxSemkxU0t2dGRqOU40SEI0ZXZ0eGhoT0swVmhZMW0zRDR6T25jCkFiQ1dlV0dRWXVtM0pRNFQ1WVJoWTM0bC9rc0ZQMFBXRE1raStod1IxTUJNWU5UMy9CQjl4T0lBbmlhNlhZQ2UKd3RjcXYwQkd6bExkUEp2aWRRcDdEUjFkSk5KYlRnbmkza0RVZ0NaMG45TVIyT3NNSmtYUUN6TzV4SDBjS3EzQQp4TEszCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K</crt>
<prv>LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUpRUUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQ1Nzd2dna25BZ0VBQW9JQ0FRRG5ualRKOTZyM1BpdVUKeHFpb1J0K2FVQmpveEMxd2R5cjg2RG92ZjU0STllUmJOL1VXREtVaGZVU1hZWXQzWXpQeUlRUzhyUzlsYndWUgp5cVpoUEh6ZnRNemdSeTRkOGRjV2tEcWF0b2ZNUUkwVHhPR05UTHpUOUlpYWhTKzdlOTI1dHBGTkwvYXB6WWNuCi9zMWpOYXlGK0lBMXBRb2I4aHdKeUVHQk5xell4TU9jOS9FOFhoc1ZMeVFScXVHVlhkejBpV3hNNjE4dWh2L1MKSzhPdEExRDZtYTlOZkw4T2cwZjlEWitzeFUxQ0cvY0JQNmVERkFraTMvdk9Tbmk5dFNHbkhJaVpnaSt2eEtoagprREhSSVYzQnNBNHVlTUJXcGxKQ3hDS0FNVVZrWCtjbzFpYzNMUEp6UUVlY2Fvb09xK2dZOXR3dlcvWDkrV2JiCm1JNGtBbnRFN0RUM2d1R3dqRGcydUNNUU5RSVVkbHVXOCt3NDRkOW5tak1HSTdDQ0NSeWEzZm1wWFJ5bGo0SWUKRzFNVjVUQWFsRStKVVhjREY3NVJoWmkrN0pUWXEwUFVkempObUhpVE8xY3piU04zWDhmMU1qb2VzS1BTRkZudQpGb2ZxajNaLytLZElSMHB1ZENqRzJ6N2ZZOGdZTjFBSE56bDhiK0FzNnJEb1Axdld2bm0wRWo0d0NUcFhIbEx3CmpxV09IZkpPd0JIdHlSc1ZuRzJjaVNTYjdGdHRNd1pqQ1dlSE1nL1h1MktFcVN2Ynp2R0xickNENHhpRUVEWVcKOVJJN3k3dmFZeVhzODlLTkxFcnFNM1pFNC9kVFNEZ2luZXpINWlhV0ExSE80SkxyNGI2MnR0V0lNYkQvaS9FKwo5S25ZYmNMdW9WNENxOGtGMXdrTHgwbEdGMzNaQlFJREFRQUJBb0lDQUNxRjRTc3pUVEFYT2VrV2orQlZJcmd4Ci9HQy9vNWdDU09JbHdJajM1UXZBR1N5bUdWankrVjRzb1dzcGZYRnR4UnV1OUMrdm5BUURYZmFtUGVXY05WRGMKNE1CTVVTc3VPMDdwSzlrN3FiTFdKeEI2Rk83Y0o4N0NGbEpJSVh0S1FtcldHZGNSOXpjMWhKclRMT0lKK0tLZgovT25jWXY2K2RHZFhYSzljV2w5eHdIZ1JEVGtJRGZEVnRzbUhsZUxXV0xxTWdGV2U0TnFwN2sybnUwVUlWdFdyCllZUFlZenRHM3ZDV2o3b29md2FrRzdVZStxSVdDNWRiaDk5WHpOTUhiaVpBRnRRWUVxa3ljYmZWd1UrajBKSysKdjl2SVQ0ZVpBWUZBZ1JVSDlyVjI1Zm1aVjVuSnBybUNFNk9qNjdURjJ0YTZlN0kyTC9OdzFuRjZrSjRMMXBWMwpXV3Q1Q3hyL3UvdnQ0RVZqdzIrNkVZR2ZRV1dBcEhNbmw5eXJhb1A4QktQN2FHdWI3WHNCdWZZU3AyNVdDYWtxCnpWWEpIOXBubEZGTFFzUmVIeWMrdTc2SGxzRUtaOFhqQUtmSW01WUNSdkh6dWFxYjFVNGpjMGNkaWk1ckdVaHYKeVlaRDd3cFNDMjAwRkFRTzdHbnFUOWY1ckQ3d3pjZGR3WWZJNk5Hb2p3VnNHWkI4OE5ObWl1UmFPR0pQRmowUApuV1pWRFRGUFJzU20ydDVNbmZIOFlhUTR6UDJkRW1lNitQanB6NE80Q2NjUEY5dzRzUUFFM0xQM2Q0dStVd051ClNwRUVzUjJyWFBuN2djTEFYN2ZZOHlSbzFzMnI0UFlMcVRxbDRDT0loQzlhdktmR2UzSkc1RWZsekx4eFJHRzEKY0dwNnFSMEJxeXc5RHZOQmdtQUJBb0lCQVFENDRhWkxXZ3FUaU8yTjdoelVlRDVDaG9yQnIvQ2hqMzdwQk1pQworTEhBcHJtcGt5SEl5cURnSzYzRnVhMVBXRzhMeC96bG5Qa3ZqSmlvYmRjZFJWZjdLRkF5VkdjR1VmcE53dTFWCmQ1WTYyMGZodVpDNHZQYXgwaGxuTkxZTE14ZnQrejFCWmttK0E4S3BmajV3UTY1dmNweWhIVGR1emUxYVdSUUcKR21ucVMvc2tJVllFMXQ1aGs2WGVreklpSTZTZVZvYUlaL3NkUkh0YkZPYUpycjA1U3IyTk9TNmh1VG0vVHFwMQpZVjYrdWtSMVB1cHljdXFaSHBxSXdaQUxVQ01PK2dGZ2RaTFlUQmJrcGxuN3JseDg3OTIxa2F3V255ZGYzV0xUClVudmVIeHVNSDZtWWRWcEdtNGJRRm41MERteEpxcEh4RlczUU1Qb1RrOTVOcUJ6dEFvSUJBUUR1UGlhY2Z3MDYKNjByL1pPR1cwWmVlQk15RlBDNVY0enQvN01uUU9ZZExBQmVyOTJiT1Z2b21DbHVqODBLQzh1dkhYcTlaQWlKQwpieVo5YSs5SHZ3eE9ycU9FY0hqdDRNM09IdkFicjFBckhmTGY2aDgyaXJyYnNTTk9ScklGZGczNTh4QXUrRVFCCjcrME9VbitHNlZUZkpZbXorbUpYOHhpQ2lXbko3Rzh1dDZNL0o5RmVPNkp6N3JneUx3ZG1MYm1xczNKdlEwNy8KVkVleTFtaEtQbXRVaktlbFdNTStTNThQenFuTmUrY2RpN2pVQlJwekZzYWQrRkhIL0MxVU1TQW04QVVma3JiLwpydzFYRXEyVjJYaFAwSDdka0dxN2VSZm0zOXpBYlN4cy9ieU5MYVZYSHpRekp4dFZLR2ovSW1jOWNXWkg1dFhCCk9TS01VbFc4Y0VGNUFvSUJBQlFtWU1wVS9lbzMrZE8xNVl1bU9KUTJSR0d1RnZOZHBNN0UzbDhNTjRmN2Q2aXQKQ3QwdzJwbUxyOFFFWm0yNElUVjQrWmExZ005Q3VORmFJMEp4Yk5BZTBXOWh1ZjJmQVg3dU96emlNNzJNSjJPMQpIR3g0a0JpUmhCRUJDWVFhbk9OZHBmWDNqQnpnUFJCdjhpb3dzSnpCVU1FU2xueFlHOUZteU9JOW5UbWs4UzVaCnJKY3p0a2w4SkwvQ2R4cWdmQ0Y5cStLN1dHOWtMZ0NQenFKekRVcm9MRFNVM3B1bFhYR0pzdTlSOU5QSVRPYVoKTTI0VXM3MjE1cGtQNHRPbnAwNzlHc051Z1hjVm9memRJd2ZuZEFHQmdoZkROWVdYV1I2LzA5SjhLUjh3c1pCRQp0L3hwOCtjbmpHQ29rWkJmNHBDTVNNaVdEWS8vaHgreXB4cnVjM2tDZ2dFQWVxa0pIQjNWNC9Yc3dSMWhnRk1jCjZzQ3h4QTgrRS81UVRnYk55U1UxWVFvRkpnYlVxWHZpZ3Q5bVd6ME5pM29pcHAwN1RtcG8xU2VBKzZZc3BoWFkKOGxHNzRwNDl4TXV2YW1aSFhSbWYvdk1HYnY2TlgzbUJ4MGFtVk5EVkt6YWk3NE9UVzN0N0dEdzlJdGlhekEwcQpJMUdpV2tXWmlJcWluZUs5MHJhbWI3a2dsWTJjb0JXNENGUnFCWHh0Sk5CNS9VY3lyZEpMdyszU2xHTUxndDRzClNIVzZnc2oyalFaR09NOUFZWWxmYnJqWFNtSHVRajhCdDZkNEE2ejBjWnB4WVZyR2FJRVRNd1VmcXlyMHNHZ3QKSjNyRE5yUDZIOWV5MUsyQmJKbEkvRHlQYldpSTdoZ2t1Z2x5YXgvSkgwTEpRTHMzMitFZlFNSjM1U01tL1VRVwprUUtDQVFBUkVBdnB4a1VzMytPSnBabVFtanZ6UWhtUTdaNXJ1cHlPeXEvUkN0a3diMURBTHV1YzVnWUswMzAxCi9jVVFkRm1rWStUUnhJU3lURFdzN1RsTHhRNzZ1Ty9nUWtSNEhtUVhtb01UWDJwd1ZyMDhycFhEL21yYmNUMGYKRVBWSzBBR3dCNFNBd085a3pXc3g5b25Wc1RscGY5d2dGTnNGeUdtMEZac0VOL1
</cert>
<ppps/>
<openvpn>
<openvpn-client>
<protocol>UDP</protocol>
<dev_mode>tun</dev_mode>
<server_addr>158.69.183.162</server_addr>
<server_port>1199</server_port>
<proxy_authtype>none</proxy_authtype>
<description>asn2net</description>
<mode>p2p_shared_key</mode>
<crypto>AES-128-CBC</crypto>
<digest>SHA1</digest>
<engine>none</engine>
<tunnel_network>192.168.198.0/30</tunnel_network>
<compression>no</compression>
<verbosity_level>5</verbosity_level>
<interface>wan</interface>
<vpnid>1</vpnid>
<custom_options/>
<shared_key>Iw0KIyAyMDQ4IGJpdCBPcGVuVlBOIHN0YXRpYyBrZXkNCiMNCi0tLS0tQkVHSU4gT3BlblZQTiBTdGF0aWMga2V5IFYxLS0tLS0NCjM3ZTdhZjg0MjQ3OTA1YmFjMWUzN2U3Y2RjNTIyN2VmDQpjMTMxNTZiZjAyZDE4ZWJjMjk0ODUxOTg0OGQwMDdmYQ0KMTQ0NWNjNzgzY2I5Njc1NDA4ZWExN2ViZjJiNTgwZDcNCjU2NmQxODcxODc1NmNjN2UzZTBiZThjODM2NGJkMGI1DQpjZmVhNzJhYjNmMjFkZmQzOGExMjliODhiNWM1YzQ4ZA0KNzMxNDExOWNjN2E0ZDgxYzZiNzE3ZDVhZDRlNzZhZDMNCjg4YjY5M2YxY2ZmZWRhMjlkOTljMjc4NmQ4MTc3ZjE5DQpkOGQxNGI2ODM5YmZjZTMyN2EwOGYwODgzMGM2N2I2OA0KNmQ4NzA1YmVjYTlkOWZlNzdlMDhkNGVlODc2YTI4NzQNCjNjZThkMzY5YzM2ZGQzOWRhZjdkMDZjNGEzN2MzZWYxDQo3ZDdmZDAyYTMzMTc1NzBhOTE2NGI0Nzk1ZTYwNTNmYQ0KNmQ0ZDhjNThhNGMxZGNjZTQ1ZTI3NzYyNDAzNDQ3M2QNCmIwNjdlMmFlYjNhZDkzY2QyYmRhZWQ4MWRiZWIxNjMxDQowMDRjNzg0ZmMyZWRkZTJkNzM5YWMxY2MxZTFjOTFhNA0KYjA0YTgzNzg1MWQxMzIzOGRiMzhlZWY4MWUwYWQyNGMNCmVhM2M2OWRiYTQxYTgyOGE1MTQ0MWZlODA2ZjYxYjE4DQotLS0tLUVORCBPcGVuVlBOIFN0YXRpYyBrZXkgVjEtLS0tLQ0K</shared_key>
</openvpn-client>
</openvpn>
<virtualip>
<vip>
<type>single</type>
<subnet_bits>24</subnet_bits>
<mode>carp</mode>
<interface>opt2</interface>
<descr>lan gw - vl22</descr>
<subnet>10.251.22.254</subnet>
<vhid>1</vhid>
<advskew>0</advskew>
<advbase>1</advbase>
<password>vippw</password>
</vip>
<vip>
<type>single</type>
<subnet_bits>24</subnet_bits>
<mode>carp</mode>
<interface>opt1</interface>
<descr>langw - vl30</descr>
<subnet>10.251.30.254</subnet>
<vhid>2</vhid>
<advskew>0</advskew>
<advbase>1</advbase>
<password>vippw</password>
</vip>
<vip>
<type>single</type>
<subnet_bits>24</subnet_bits>
<mode>carp</mode>
<interface>opt3</interface>
<subnet>10.251.200.254</subnet>
<vhid>3</vhid>
<advskew>0</advskew>
<advbase>1</advbase>
<password>carpvip</password>
</vip>
</virtualip>
<staticroutes/>
</opnsense>