firewall {
    all-ping enable
    broadcast-ping disable
    config-trap disable
    group {
        network-group Private_IPs {
            network 10.0.0.0/8
            network 127.0.0.0/8
            network 172.16.0.0/12
            network 192.168.0.0/16
            network 168.254.0.0/16
            network 169.254.0.0/16
            network 192.0.2.0/24
            network 224.0.0.0/4
            network 240.0.0.0/4
        }
        port-group NetBIOS_TCP {
            port 135-139
            port 445
        }
        port-group NetBIOS_UDP {
            port 137-138
        }
    }
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    name accept_all {
        default-action accept
    }
    name private_to_public {
        default-action accept
        rule 9 {
            action accept
            description "Allow admin of Vigor 130"
            destination {
                address 192.168.5.2
                port 443
            }
            protocol tcp
            source {
                address 192.168.3.100
            }
        }
        rule 10 {
            action drop
            description "Stop Local Addresses traversing the WEB"
            destination {
                group {
                    network-group Private_IPs
                }
            }
        }
        rule 20 {
            action drop
            description "Block NetBIOS from LAN to WEB"
            destination {
                group {
                    port-group NetBIOS_TCP
                }
            }
            protocol tcp
        }
        rule 21 {
            action drop
            description "Block NetBIOS from LAN to WEB"
            destination {
                group {
                    port-group NetBIOS_UDP
                }
            }
            protocol udp
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    state-policy {
        established {
            action accept
        }
        related {
            action accept
        }
    }
    syn-cookies enable
    twa-hazards-protection disable
}
interfaces {
    ethernet eth0 {
        address 192.168.3.1/24
        duplex auto
        hw-id 4c:02:89:12:16:ce
        smp-affinity auto
        speed auto
    }
    ethernet eth1 {
        address 192.168.1.1/24
        duplex auto
        hw-id 4c:02:89:12:16:cf
        smp-affinity auto
        speed auto
    }
    ethernet eth2 {
        address 192.168.4.1/24
        duplex auto
        hw-id 4c:02:89:12:16:d0
        smp-affinity auto
        speed auto
    }
    ethernet eth3 {
        address 192.168.5.1/24
        duplex auto
        hw-id 4c:02:89:12:16:d1
        mtu 1508
        pppoe 0 {
            default-route auto
            mtu 1500
            name-server none
            password ********
            user-id [email protected]
        }
        smp-affinity auto
        speed auto
    }
    loopback lo {
    }
}
nat {
    source {
        rule 10 {
            outbound-interface pppoe0
            translation {
                address masquerade
            }
        }
    }
}
service {
    dhcp-server {
        shared-network-name ETH0_Pool {
            subnet 192.168.3.0/24 {
                default-router 192.168.3.1
                dns-server 192.168.3.1
                lease 86400
                range 0 {
                    start 192.168.3.100
                    stop 192.168.3.199
                }
                static-mapping NB0001 {
                    ip-address 192.168.3.100
                    mac-address EC:F4:BB:******
                }
            }
        }
        shared-network-name ETH1_Pool {
            subnet 192.168.1.0/24 {
                default-router 192.168.1.1
                dns-server 192.168.1.1
                lease 86400
                range 0 {
                    start 192.168.1.100
                    stop 192.168.1.199
                }
                static-mapping SamsungTV {
                    ip-address 192.168.1.103
                    mac-address cc:b1:1a:******
                }
            }
        }
        shared-network-name ETH2_Pool {
            subnet 192.168.4.0/24 {
                default-router 192.168.4.1
                dns-server 192.168.4.1
                lease 86400
                range 0 {
                    start 192.168.4.100
                    stop 192.168.4.199
                }
            }
        }
    }
    dns {
        forwarding {
            allow-from 0.0.0.0/0
            allow-from ::/0
            cache-size 150
            listen-address 192.168.1.1
            listen-address 192.168.3.1
            listen-address 192.168.4.1
            name-server 194.72.6.51
            name-server 194.74.65.69
        }
    }
    ssh {
        listen-address 192.168.3.1
        port 22
    }
}
system {
    config-management {
        commit-revisions 20
    }
    conntrack {
        expect-table-size 2048
        hash-size 32768
        modules {
            sip {
                disable
            }
        }
        table-size 262144
    }
    console {
        device ttyS0 {
            speed 9600
        }
    }
    host-name home-r1
    login {
        user stevep {
            authentication {
                encrypted-password ********************************************
                plaintext-password ""
            }
            full-name "Steve Palmer"
        }
        user vyos {
            authentication {
                encrypted-password **********************************************
                plaintext-password ""
            }
        }
    }
    name-server 8.8.8.8
    ntp {
        server 0.pool.ntp.org {
        }
        server 1.pool.ntp.org {
        }
        server 2.pool.ntp.org {
        }
    }
    syslog {
        global {
            facility all {
                level notice
            }
            facility protocols {
                level debug
            }
        }
    }
    time-zone Europe/London
}
zone-policy {
    zone local {
        default-action drop
        from private {
            firewall {
                name accept_all
            }
        }
        local-zone
    }
    zone public {
        default-action drop
        description "Public Zone"
        from private {
            firewall {
                name private_to_public
            }
        }
        interface pppoe0
        interface eth3
    }
}