windy/my-vault
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
049ed35557679f58fb9f59a052d9dde7faf7018c
my-vault/01_Projects/Infrastructure/Network/ER-X.md
T

1037 lines
36 KiB
Markdown
Raw Normal View History

vault backup: 2026-01-05 13:03:55
2026-01-05 13:03:55 +08:00
config:
```
set firewall all-ping enable
set firewall broadcast-ping disable
set firewall ipv6-name WANv6_IN default-action drop
set firewall ipv6-name WANv6_IN description 'WAN inbound traffic forwarded to LAN'
set firewall ipv6-name WANv6_IN enable-default-log
set firewall ipv6-name WANv6_IN rule 10 action accept
set firewall ipv6-name WANv6_IN rule 10 description 'Allow established/related sessions'
set firewall ipv6-name WANv6_IN rule 10 state established enable
set firewall ipv6-name WANv6_IN rule 10 state related enable
set firewall ipv6-name WANv6_IN rule 20 action drop
set firewall ipv6-name WANv6_IN rule 20 description 'Drop invalid state'
set firewall ipv6-name WANv6_IN rule 20 state invalid enable
set firewall ipv6-name WANv6_LOCAL default-action drop
set firewall ipv6-name WANv6_LOCAL description 'WAN inbound traffic to the router'
set firewall ipv6-name WANv6_LOCAL enable-default-log
set firewall ipv6-name WANv6_LOCAL rule 10 action accept
set firewall ipv6-name WANv6_LOCAL rule 10 description 'Allow established/related sessions'
set firewall ipv6-name WANv6_LOCAL rule 10 state established enable
set firewall ipv6-name WANv6_LOCAL rule 10 state related enable
set firewall ipv6-name WANv6_LOCAL rule 20 action drop
set firewall ipv6-name WANv6_LOCAL rule 20 description 'Drop invalid state'
set firewall ipv6-name WANv6_LOCAL rule 20 state invalid enable
set firewall ipv6-name WANv6_LOCAL rule 30 action accept
set firewall ipv6-name WANv6_LOCAL rule 30 description 'Allow IPv6 icmp'
set firewall ipv6-name WANv6_LOCAL rule 30 protocol ipv6-icmp
set firewall ipv6-name WANv6_LOCAL rule 40 action accept
set firewall ipv6-name WANv6_LOCAL rule 40 description 'allow dhcpv6'
set firewall ipv6-name WANv6_LOCAL rule 40 destination port 546
set firewall ipv6-name WANv6_LOCAL rule 40 protocol udp
set firewall ipv6-name WANv6_LOCAL rule 40 source port 547
set firewall ipv6-receive-redirects disable
set firewall ipv6-src-route disable
set firewall ip-src-route disable
set firewall log-martians enable
set firewall name WAN_IN default-action drop
set firewall name WAN_IN description 'WAN to internal'
set firewall name WAN_IN rule 10 action accept
set firewall name WAN_IN rule 10 description 'Allow established/related'
set firewall name WAN_IN rule 10 state established enable
set firewall name WAN_IN rule 10 state related enable
set firewall name WAN_IN rule 20 action drop
set firewall name WAN_IN rule 20 description 'Drop invalid state'
set firewall name WAN_IN rule 20 state invalid enable
set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL description 'WAN to router'
set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 description 'Allow established/related'
set firewall name WAN_LOCAL rule 10 state established enable
set firewall name WAN_LOCAL rule 10 state related enable
set firewall name WAN_LOCAL rule 20 action drop
set firewall name WAN_LOCAL rule 20 description 'Drop invalid state'
set firewall name WAN_LOCAL rule 20 state invalid enable
set firewall options mss-clamp mss 1412
set firewall receive-redirects disable
set firewall send-redirects enable
set firewall source-validation disable
set firewall syn-cookies enable
set interfaces ethernet eth0 description Local
set interfaces ethernet eth0 duplex auto
set interfaces ethernet eth0 speed auto
set interfaces ethernet eth1 description Local
set interfaces ethernet eth1 duplex auto
set interfaces ethernet eth1 speed auto
set interfaces ethernet eth2 description Local
set interfaces ethernet eth2 duplex auto
set interfaces ethernet eth2 speed auto
set interfaces ethernet eth3 description Local
set interfaces ethernet eth3 duplex auto
set interfaces ethernet eth3 speed auto
set interfaces ethernet eth4 description 'Internet (PPPoE)'
set interfaces ethernet eth4 duplex auto
set interfaces ethernet eth4 poe output off
set interfaces ethernet eth4 pppoe 0 default-route auto
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0 host-address '::1'
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0 prefix-id ':1'
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0 service slaac
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 prefix-length /60
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd rapid-commit enable
set interfaces ethernet eth4 pppoe 0 firewall in ipv6-name WANv6_IN
set interfaces ethernet eth4 pppoe 0 firewall in name WAN_IN
set interfaces ethernet eth4 pppoe 0 firewall local ipv6-name WANv6_LOCAL
set interfaces ethernet eth4 pppoe 0 firewall local name WAN_LOCAL
set interfaces ethernet eth4 pppoe 0 ipv6 address autoconf
set interfaces ethernet eth4 pppoe 0 ipv6 dup-addr-detect-transmits 1
set interfaces ethernet eth4 pppoe 0 ipv6 enable
set interfaces ethernet eth4 pppoe 0 mtu 1492
set interfaces ethernet eth4 pppoe 0 name-server auto
set interfaces ethernet eth4 pppoe 0 password 32867410
set interfaces ethernet eth4 pppoe 0 user-id 02004536188@163.gd
set interfaces ethernet eth4 speed auto
set interfaces loopback lo
set interfaces switch switch0 address 192.168.66.254/24
set interfaces switch switch0 description Local
set interfaces switch switch0 mtu 1500
set interfaces switch switch0 switch-port interface eth0
set interfaces switch switch0 switch-port interface eth1
set interfaces switch switch0 switch-port interface eth2
set interfaces switch switch0 switch-port interface eth3
set interfaces switch switch0 switch-port vlan-aware disable
set port-forward auto-firewall enable
set port-forward hairpin-nat enable
set port-forward lan-interface eth0
set port-forward rule 1 description ssh
set port-forward rule 1 forward-to address 192.168.66.32
set port-forward rule 1 forward-to port 22
set port-forward rule 1 original-port 58222
set port-forward rule 1 protocol tcp_udp
set port-forward rule 2 description trasmission
set port-forward rule 2 forward-to address 192.168.66.32
set port-forward rule 2 forward-to port 51413
set port-forward rule 2 original-port 51413
set port-forward rule 2 protocol tcp_udp
set port-forward wan-interface pppoe0
set service dhcp-server disabled false
set service dhcp-server hostfile-update disable
set service dhcp-server shared-network-name LAN authoritative enable
set service dhcp-server shared-network-name LAN disable
set service dhcp-server shared-network-name LAN subnet 192.168.66.0/24 default-router 192.168.66.254
set service dhcp-server shared-network-name LAN subnet 192.168.66.0/24 dns-server 192.168.66.254
set service dhcp-server shared-network-name LAN subnet 192.168.66.0/24 lease 86400
set service dhcp-server shared-network-name LAN subnet 192.168.66.0/24 start 192.168.66.38 stop 192.168.66.243
set service dhcp-server static-arp disable
set service dhcp-server use-dnsmasq disable
set service dns dynamic interface pppoe0 service custom-noip host-name windyboycn.ddns.net
set service dns dynamic interface pppoe0 service custom-noip login windyboy@gmail.com
set service dns dynamic interface pppoe0 service custom-noip password windyboycn.ddns.net
set service dns dynamic interface pppoe0 service custom-noip protocol noip
set service dns dynamic interface pppoe0 service custom-noip server noip.com
set service dns dynamic interface pppoe0 web dyndns
set service dns forwarding cache-size 150
set service dns forwarding listen-on switch0
set service gui http-port 80
set service gui https-port 443
set service gui older-ciphers enable
set service nat rule 5010 description 'masquerade for WAN'
set service nat rule 5010 outbound-interface pppoe0
set service nat rule 5010 type masquerade
set service ssh port 22
set service ssh protocol-version v2
set service unms connection 'wss://zhiqiang.uisp.com:443+rfvfxRFhpehdfXaaA2ZtrzF9BGA_bL4juvRundNAa20AAAAA+allowUntrustedCertificate'
set service upnp2 listen-on switch0
set service upnp2 nat-pmp enable
set service upnp2 secure-mode enable
set service upnp2 wan pppoe0
set system analytics-handler send-analytics-report false
set system crash-handler send-crash-report false
set system domain-name windy.me
set system host-name gw
set system login user ubnt authentication encrypted-password '$5$9KWfs5EFP4KMyg2o$Yo/k5.qqqwouiQmjREDv8ycdl0qe.2vCsO7wzXrpmT.'
set system login user ubnt authentication plaintext-password ''
set system login user ubnt full-name 'ubnt default user'
set system login user ubnt level admin
set system login user zhiqiang authentication encrypted-password '$5$L0plc3edYo79BfZU$iRzWJAYLFOL4ZiipVCxeIrVqOxpJlJxsqOTQhWURcH5'
set system login user zhiqiang level admin
set system ntp server 0.ubnt.pool.ntp.org
set system ntp server 1.ubnt.pool.ntp.org
set system ntp server 2.ubnt.pool.ntp.org
set system ntp server 3.ubnt.pool.ntp.org
set system offload hwnat enable
set system offload ipsec enable
set system syslog global facility all level notice
set system syslog global facility protocols level debug
set system time-zone Asia/Shanghai
```
new :
下面是更新后的配置脚本及详细执行步骤。在此版本中：
1. **端口转发已移除**：不再包含 `port-forward` 相关配置项。
2. **UPnP 保留**：仍有 UPnP 配置，以实现动态端口映射功能。
3. **网关 IP 依然为 .254**：内网 VLAN 网段的网关为 192.168.55.254 和 192.168.66.254。
4. 外网 PPPoE、IPv6 防火墙、IPv4 防火墙、NAT、DDNS、DNS、NTP、SSH、UNMS、UPnP、GUI 等保留原先配置。
请在执行 `reset configuration` 后，使用默认用户名密码 (`ubnt/ubnt`) 登录路由器，然后按照下方步骤执行配置脚本。
---
### 执行步骤
1. **重置配置（如有需要）**：
登录 CLI 后执行：
```bash
reset configuration
```
等待重置完成后路由器将恢复出厂默认。
2. **登录路由器**：
使用默认帐号登录：
- 用户名：`ubnt`
- 密码：`ubnt`
3. **进入配置模式**：
```bash
configure
```
4. **粘贴下方配置命令**（可一次性全部复制粘贴）：
```bash
# 基本防护与系统配置
set firewall all-ping enable
set firewall broadcast-ping disable
set firewall ipv6-receive-redirects disable
set firewall ipv6-src-route disable
set firewall ip-src-route disable
set firewall log-martians enable
set firewall options mss-clamp mss 1412
set firewall receive-redirects disable
set firewall send-redirects enable
set firewall source-validation disable
set firewall syn-cookies enable
# IPv6防火墙 - WANv6_IN
set firewall ipv6-name WANv6_IN default-action drop
set firewall ipv6-name WANv6_IN description 'WAN inbound traffic forwarded to LAN'
set firewall ipv6-name WANv6_IN enable-default-log
set firewall ipv6-name WANv6_IN rule 10 action accept
set firewall ipv6-name WANv6_IN rule 10 description 'Allow established/related sessions'
set firewall ipv6-name WANv6_IN rule 10 state established enable
set firewall ipv6-name WANv6_IN rule 10 state related enable
set firewall ipv6-name WANv6_IN rule 20 action drop
set firewall ipv6-name WANv6_IN rule 20 description 'Drop invalid state'
set firewall ipv6-name WANv6_IN rule 20 state invalid enable
# IPv6防火墙 - WANv6_LOCAL
set firewall ipv6-name WANv6_LOCAL default-action drop
set firewall ipv6-name WANv6_LOCAL description 'WAN inbound traffic to the router'
set firewall ipv6-name WANv6_LOCAL enable-default-log
set firewall ipv6-name WANv6_LOCAL rule 10 action accept
set firewall ipv6-name WANv6_LOCAL rule 10 description 'Allow established/related sessions'
set firewall ipv6-name WANv6_LOCAL rule 10 state established enable
set firewall ipv6-name WANv6_LOCAL rule 10 state related enable
set firewall ipv6-name WANv6_LOCAL rule 20 action drop
set firewall ipv6-name WANv6_LOCAL rule 20 description 'Drop invalid state'
set firewall ipv6-name WANv6_LOCAL rule 20 state invalid enable
set firewall ipv6-name WANv6_LOCAL rule 30 action accept
set firewall ipv6-name WANv6_LOCAL rule 30 description 'Allow IPv6 icmp'
set firewall ipv6-name WANv6_LOCAL rule 30 protocol ipv6-icmp
set firewall ipv6-name WANv6_LOCAL rule 40 action accept
set firewall ipv6-name WANv6_LOCAL rule 40 description 'allow dhcpv6'
set firewall ipv6-name WANv6_LOCAL rule 40 destination port 546
set firewall ipv6-name WANv6_LOCAL rule 40 protocol udp
set firewall ipv6-name WANv6_LOCAL rule 40 source port 547
# IPv4防火墙 - WAN_IN
set firewall name WAN_IN default-action drop
set firewall name WAN_IN description 'WAN to internal'
set firewall name WAN_IN rule 10 action accept
set firewall name WAN_IN rule 10 description 'Allow established/related'
set firewall name WAN_IN rule 10 state established enable
set firewall name WAN_IN rule 10 state related enable
set firewall name WAN_IN rule 20 action drop
set firewall name WAN_IN rule 20 description 'Drop invalid state'
set firewall name WAN_IN rule 20 state invalid enable
# IPv4防火墙 - WAN_LOCAL
set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL description 'WAN to router'
set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 description 'Allow established/related'
set firewall name WAN_LOCAL rule 10 state established enable
set firewall name WAN_LOCAL rule 10 state related enable
set firewall name WAN_LOCAL rule 20 action drop
set firewall name WAN_LOCAL rule 20 description 'Drop invalid state'
set firewall name WAN_LOCAL rule 20 state invalid enable
# 接口设置
set interfaces ethernet eth0 description Local
set interfaces ethernet eth0 duplex auto
set interfaces ethernet eth0 speed auto
set interfaces ethernet eth1 description Local
set interfaces ethernet eth1 duplex auto
set interfaces ethernet eth1 speed auto
set interfaces ethernet eth2 description Local
set interfaces ethernet eth2 duplex auto
set interfaces ethernet eth2 speed auto
set interfaces ethernet eth3 description Local
set interfaces ethernet eth3 duplex auto
set interfaces ethernet eth3 speed auto
set interfaces ethernet eth4 description 'Internet (PPPoE)'
set interfaces ethernet eth4 duplex auto
set interfaces ethernet eth4 poe output off
set interfaces ethernet eth4 speed auto
# PPPoE配置
set interfaces ethernet eth4 pppoe 0 user-id '02004536188@163.gd'
set interfaces ethernet eth4 pppoe 0 password '32867410'
set interfaces ethernet eth4 pppoe 0 default-route auto
set interfaces ethernet eth4 pppoe 0 mtu 1492
set interfaces ethernet eth4 pppoe 0 name-server auto
set interfaces ethernet eth4 pppoe 0 ipv6 enable
set interfaces ethernet eth4 pppoe 0 ipv6 address autoconf
set interfaces ethernet eth4 pppoe 0 ipv6 dup-addr-detect-transmits 1
set interfaces ethernet eth4 pppoe 0 firewall in ipv6-name WANv6_IN
set interfaces ethernet eth4 pppoe 0 firewall in name WAN_IN
set interfaces ethernet eth4 pppoe 0 firewall local ipv6-name WANv6_LOCAL
set interfaces ethernet eth4 pppoe 0 firewall local name WAN_LOCAL
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd prefix-length /60
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd rapid-commit enable
# 内网交换机 VLAN 配置
set interfaces switch switch0 description 'Local Switch'
set interfaces switch switch0 mtu 1500
#set interfaces switch switch0 vlan-aware enable
# VLAN 55: eth0, eth1
set interfaces switch switch0 switch-port interface eth0 vlan pvid 55
set interfaces switch switch0 switch-port interface eth1 vlan pvid 55
# VLAN 66: eth2, eth3
set interfaces switch switch0 switch-port interface eth2 vlan pvid 66
set interfaces switch switch0 switch-port interface eth3 vlan pvid 66
# VLAN子接口，并使用.254作为网关
set interfaces switch switch0 vif 55 address 192.168.55.254/24
set interfaces switch switch0 vif 55 description 'LAN1 - 192.168.55.0/24'
set interfaces switch switch0 vif 66 address 192.168.66.254/24
set interfaces switch switch0 vif 66 description 'LAN2 - 192.168.66.0/24'
# IPv6前缀分配到VLAN子接口
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0.55 prefix-id ':1'
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0.55 service slaac
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0.66 prefix-id ':2'
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0.66 service slaac
# NAT 配置
set service nat rule 5010 description 'masquerade for WAN'
set service nat rule 5010 outbound-interface pppoe0
set service nat rule 5010 type masquerade
# DHCP 服务，网关和DNS服务器为 .254
set service dhcp-server disabled false
set service dhcp-server hostfile-update disable
# VLAN55 DHCP
set service dhcp-server shared-network-name LAN55 authoritative enable
set service dhcp-server shared-network-name LAN55 subnet 192.168.55.0/24 default-router 192.168.55.254
set service dhcp-server shared-network-name LAN55 subnet 192.168.55.0/24 dns-server 192.168.66.36
set service dhcp-server shared-network-name LAN55 subnet 192.168.55.0/24 lease 86400
set service dhcp-server shared-network-name LAN55 subnet 192.168.55.0/24 start 192.168.55.100 stop 192.168.55.200
# VLAN66 DHCP
set service dhcp-server shared-network-name LAN66 authoritative enable
set service dhcp-server shared-network-name LAN66 subnet 192.168.66.0/24 default-router 192.168.66.254
set service dhcp-server shared-network-name LAN66 subnet 192.168.66.0/24 dns-server 192.168.66.36
set service dhcp-server shared-network-name LAN66 subnet 192.168.66.0/24 lease 86400
set service dhcp-server shared-network-name LAN66 subnet 192.168.66.0/24 start 192.168.66.100 stop 192.168.66.200
set service dhcp-server static-arp disable
set service dhcp-server use-dnsmasq disable
# DDNS 配置
set service dns dynamic interface pppoe0 service custom-noip host-name 'windyboycn.ddns.net'
set service dns dynamic interface pppoe0 service custom-noip login 'windyboy@gmail.com'
set service dns dynamic interface pppoe0 service custom-noip password 'windyboycn.ddns.net'
set service dns dynamic interface pppoe0 service custom-noip protocol noip
set service dns dynamic interface pppoe0 service custom-noip server noip.com
set service dns dynamic interface pppoe0 web dyndns
# DNS 转发
set service dns forwarding cache-size 150
set service dns forwarding listen-on switch0
# GUI
set service gui http-port 80
set service gui https-port 443
set service gui older-ciphers enable
# 移除端口转发相关配置（无 port-forward 相关命令）
# SSH
set service ssh port 22
set service ssh protocol-version v2
# UNMS
set service unms connection 'wss://zhiqiang.uisp.com:443+rfvfxRFhpehdfXaaA2ZtrzF9BGA_bL4juvRundNAa20AAAAA+allowUntrustedCertificate'
# UPnP 保留
set service upnp2 listen-on switch0
set service upnp2 nat-pmp enable
set service upnp2 secure-mode enable
set service upnp2 wan pppoe0
# 系统配置
set system analytics-handler send-analytics-report false
set system crash-handler send-crash-report false
set system domain-name 'windy.me'
set system host-name 'gw'
set system login user ubnt authentication encrypted-password '$5$9KWfs5EFP4KMyg2o$Yo/k5.qqqwouiQmjREDv8ycdl0qe.2vCsO7wzXrpmT.'
set system login user ubnt authentication plaintext-password ''
set system login user ubnt full-name 'ubnt default user'
set system login user ubnt level admin
set system login user zhiqiang authentication encrypted-password '$5$L0plc3edYo79BfZU$iRzWJAYLFOL4ZiipVCxeIrVqOxpJlJxsqOTQhWURcH5'
set system login user zhiqiang level admin
set system ntp server 0.ubnt.pool.ntp.org
set system ntp server 1.ubnt.pool.ntp.org
set system ntp server 2.ubnt.pool.ntp.org
set system ntp server 3.ubnt.pool.ntp.org
set system offload hwnat enable
set system offload ipsec enable
set system syslog global facility all level notice
set system syslog global facility protocols level debug
set system time-zone Asia/Shanghai
```
5. **提交并保存配置**：
```bash
commit
save
exit
```
6. **验证**：
- `eth0`、`eth1` 接的设备应获取 `192.168.55.x` 地址，网关为 `192.168.55.254`
- `eth2`、`eth3` 接的设备应获取 `192.168.66.x` 地址，网关为 `192.168.66.254`
- 测试外网访问（IPv4、IPv6）
- 确认 UPnP 正常（适配支持 UPnP 的内网设备应该可以动态映射端口到外网）
- 确认防火墙与 NAT 正常工作
---
以上步骤确保在不需要端口转发配置的情况下，保留原有的 UPnP、外网 PPPoE、IPv6 防火墙、IPv4 防火墙、DHCP、DNS、DDNS、NTP、SSH、UNMS、GUI 等功能，满足你的最新要求。
ubnt
new pass:
```
windyboy
```
```
set firewall name LAN_IN rule 30 action accept
set firewall name LAN_IN rule 30 description 'Allow 55 to 66'
set firewall name LAN_IN rule 30 source address 192.168.55.0/24
set firewall name LAN_IN rule 30 destination address 192.168.66.0/24
```
```
set firewall name LAN_IN rule 40 action accept
set firewall name LAN_IN rule 40 description 'Allow 66 to 55'
set firewall name LAN_IN rule 40 source address 192.168.66.0/24
set firewall name LAN_IN rule 40 destination address 192.168.55.0/24
```
```
set interfaces switch switch0 switch-port interface eth1
set interfaces switch switch0 switch-port interface eth2
set interfaces switch switch0 switch-port interface eth3
```
```
configure
set service nat rule 5020 description 'masquerade for LAN 55'
set service nat rule 5020 outbound-interface pppoe0
set service nat rule 5020 source address 192.168.55.0/24
set service nat rule 5020 type masquerade
commit
save
```
```
firewall {
all-ping enable
broadcast-ping disable
ipv6-name WANv6_IN {
default-action drop
description "WAN inbound traffic forwarded to LAN"
enable-default-log
rule 10 {
action accept
description "Allow established/related sessions"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
}
ipv6-name WANv6_LOCAL {
default-action drop
description "WAN inbound traffic to the router"
enable-default-log
rule 10 {
action accept
description "Allow established/related sessions"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
rule 30 {
action accept
description "Allow IPv6 icmp"
protocol ipv6-icmp
}
rule 40 {
action accept
description "allow dhcpv6"
destination {
port 546
}
protocol udp
source {
port 547
}
}
}
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
name LAN_IN {
default-action drop
rule 10 {
action accept
description "Allow established/related sessions"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid states"
state {
invalid enable
}
}
rule 40 {
action accept
description "Allow 66 to 55"
destination {
address 192.168.55.0/24
}
source {
address 192.168.66.0/24
}
}
}
name LAN_OUT {
default-action drop
rule 10 {
action accept
description "Allow internet access"
destination {
address 0.0.0.0/0
}
}
}
name WAN_IN {
default-action drop
description "WAN to internal"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
}
name WAN_LOCAL {
default-action drop
description "WAN to router"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
}
options {
mss-clamp {
mss 1412
}
}
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
}
interfaces {
ethernet eth0 {
address 192.168.66.254/24
description "Local 2"
duplex auto
speed auto
}
ethernet eth1 {
description Local
duplex auto
speed auto
}
ethernet eth2 {
description Local
duplex auto
speed auto
}
ethernet eth3 {
description Local
duplex auto
speed auto
}
ethernet eth4 {
description "Internet (PPPoE)"
duplex auto
poe {
output off
}
pppoe 0 {
default-route auto
dhcpv6-pd {
pd 0 {
interface eth0 {
host-address ::1
prefix-id :1
service slaac
}
interface switch0 {
host-address ::1
prefix-id :2
service slaac
}
prefix-length /60
}
rapid-commit enable
}
firewall {
in {
ipv6-name WANv6_IN
name WAN_IN
}
local {
ipv6-name WANv6_LOCAL
name WAN_LOCAL
}
}
ipv6 {
address {
autoconf
}
dup-addr-detect-transmits 1
enable {
}
}
mtu 1492
name-server auto
password ****************
user-id 02004536188@163.gd
}
speed auto
}
loopback lo {
}
switch switch0 {
address 192.168.55.254/24
description Local
mtu 1500
switch-port {
interface eth1 {
}
interface eth2 {
}
interface eth3 {
}
}
}
}
port-forward {
auto-firewall enable
hairpin-nat enable
lan-interface switch0
lan-interface eth0
rule 1 {
description hass
forward-to {
address 192.168.55.200
port 8123
}
original-port 8123
protocol tcp_udp
}
rule 2 {
description transmission
forward-to {
address 192.168.66.51
port 51413
}
original-port 51413
protocol tcp_udp
}
rule 3 {
description ssh
forward-to {
address 192.168.66.32
port 22
}
original-port 5822
protocol tcp_udp
}
rule 4 {
description openvpn
forward-to {
address 192.168.66.32
port 1194
}
original-port 1194
protocol tcp_udp
}
wan-interface pppoe0
}
service {
dhcp-server {
disabled false
hostfile-update disable
shared-network-name LAN1 {
authoritative enable
subnet 192.168.66.0/24 {
default-router 192.168.66.254
dns-server 192.168.66.36
lease 86400
start 192.168.66.38 {
stop 192.168.66.243
}
static-mapping gfw {
ip-address 192.168.66.1
mac-address 3e:b3:96:69:11:9c
}
static-mapping hp-nas {
ip-address 192.168.66.32
mac-address a0:1d:48:c7:77:a8
}
static-mapping pihole {
ip-address 192.168.66.36
mac-address ae:1d:5a:1e:77:8a
}
static-mapping pve {
ip-address 192.168.66.26
mac-address a8:b8:e0:00:6e:eb
}
static-mapping transmission {
ip-address 192.168.66.51
mac-address a2:1d:48:03:aa:47
}
static-mapping ubnt-6 {
ip-address 192.168.66.6
mac-address 78:45:58:4d:cc:30
}
static-mapping ubnt-app {
ip-address 192.168.66.46
mac-address c6:a4:3f:ef:e3:0c
}
static-mapping windy-pc {
ip-address 192.168.66.99
mac-address 04:7c:16:b8:f5:e9
}
}
}
shared-network-name LAN2 {
authoritative enable
subnet 192.168.55.0/24 {
default-router 192.168.55.254
dns-server 192.168.55.254
lease 86400
start 192.168.55.38 {
stop 192.168.55.243
}
static-mapping Aqara-Hub-M3-10CB {
ip-address 192.168.55.248
mac-address 18:c2:3c:45:61:e7
}
static-mapping SmartThings-Station {
ip-address 192.168.55.48
mac-address 2c:ba:ba:99:e5:2b
}
static-mapping espressif {
ip-address 192.168.55.47
mac-address a0:76:4e:38:6b:3c
}
static-mapping homeassistant {
ip-address 192.168.55.200
mac-address 5c:8a:ae:68:1e:dd
}
static-mapping midea_e3_0198 {
ip-address 192.168.55.42
mac-address b0:96:ea:c4:79:8c
}
static-mapping oneplus-12 {
ip-address 192.168.55.249
mac-address c2:23:b1:c3:4d:bf
}
static-mapping roborock-wm-a141 {
ip-address 192.168.55.43
mac-address b0:4a:39:ce:82:ef
}
static-mapping samsung-hub {
ip-address 192.168.55.251
mac-address c4:82:e1:b7:fa:ff
}
static-mapping unifi-ac {
ip-address 192.168.55.5
mac-address f0:9f:c2:20:04:e9
}
static-mapping zbgw7688 {
ip-address 192.168.55.60
mac-address 12:00:00:ab:d2:a9
}
}
}
static-arp disable
use-dnsmasq disable
}
dns {
forwarding {
cache-size 150
listen-on eth0
listen-on switch0
}
}
gui {
http-port 80
https-port 443
older-ciphers enable
}
nat {
rule 5010 {
description "masquerade for WAN"
log disable
outbound-interface pppoe0
protocol all
type masquerade
}
}
snmp {
community myc {
authorization ro
}
contact null
location null
}
ssh {
port 22
protocol-version v2
}
unms {
connection wss://zhiqiang.uisp.com:443+rfvfxRFhpehdfXaaA2ZtrzF9BGA_bL4juvRundNAa20AAAAA+allowUntrustedCertificate
}
}
system {
analytics-handler {
send-analytics-report false
}
crash-handler {
send-crash-report false
}
domain-name windy.me
host-name gw
login {
user ubnt {
authentication {
encrypted-password ****************
plaintext-password ****************
}
level admin
}
user zhiqiang {
authentication {
encrypted-password ****************
plaintext-password ****************
}
full-name "zhiqiang feng"
level admin
}
}
ntp {
server 0.ubnt.pool.ntp.org {
}
server 1.ubnt.pool.ntp.org {
}
server 2.ubnt.pool.ntp.org {
}
server 3.ubnt.pool.ntp.org {
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
time-zone Asia/Shanghai
}
```
```
network update wlan0  --ipv4-gateway 192.168.55.254
```
```
network update wlan0 --ipv4-method auto --ipv6-method disabled
```
To set up an **IGMP Proxy** on your EdgeRouter X with two LANs, where one is on `eth0` and the other is on `switch0`, while using PPPoE for the WAN connection, follow these detailed steps:
## Step-by-Step Configuration
### 1. Access the EdgeRouter
- Connect to your EdgeRouter X via SSH or through the web interface.
### 2. Configure the WAN Connection
- Set up your WAN interface (usually `eth0`) for PPPoE. This can typically be done through the web interface or CLI:
```bash
configure
set interfaces ethernet eth0 pppoe # Add your PPPoE settings here
commit; save
```
### 3. Configure IGMP Proxy
- Enter configuration mode:
```bash
configure
```
- **Set Up Upstream and Downstream Interfaces**:
- For the WAN interface (assuming it is `pppoe0`):
```bash
set protocols igmp-proxy interface pppoe0 role upstream
set protocols igmp-proxy interface pppoe0 threshold 1
set protocols igmp-proxy interface pppoe0 alt-subnet 0.0.0.0/0
```
- For the LAN interface on `switch0`:
```bash
set protocols igmp-proxy interface switch0 role downstream
set protocols igmp-proxy interface switch0 threshold 1
set protocols igmp-proxy interface switch0 alt-subnet 0.0.0.0/0
```
- For the LAN interface on eth0
```shell
set protocols igmp-proxy interface eth0 role downstream
set protocols igmp-proxy interface eth0 threshold 1
set protocols igmp-proxy interface eth0 alt-subnet 0.0.0.0/0
```
### 4. Commit and Save Changes
- After configuring the IGMP proxy, commit and save your changes:
```bash
commit; save; exit
```
### 5. Verify Configuration
- Check if the IGMP proxy is configured correctly:
```bash
show protocols igmp-proxy
```
### Additional Considerations
- **Ensure IGMP Snooping is Enabled**: If you are using a managed switch, make sure IGMP snooping is enabled to properly handle multicast traffic.
- **Firewall Rules**: Ensure that your firewall rules allow IGMP traffic between the WAN and LAN interfaces.
- **Testing**: After configuration, test your IPTV or multicast services to ensure they are functioning correctly.
This setup will allow your EdgeRouter X to manage multicast traffic effectively across both LANs while maintaining a stable WAN connection via PPPoE.
Citations:
[1] https://superuser.com/questions/1184320/how-to-use-nginx-as-a-reverse-proxy-on-a-ubiquiti-router
[2] https://community.odido.nl/thuisnetwerk-539/how-to-edgerouter-iptv-internet-342141
[3] https://help.ui.com/hc/en-us/articles/204961694-EdgeRouter-Web-Proxy
[4] https://community.ui.com/questions/how-to-setup-a-proxy-server-on-my-router/13b39fe3-ac56-4400-8903-147e97564b8c
[5] https://help.uisp.com/hc/en-us/articles/22591218897559-EdgeRouter-IGMP-Proxy
[6] https://www.reddit.com/r/Ubiquiti/comments/9a42zg/edgerouter_x_gui_behind_nginx_reverse_proxy/
[7] https://github.com/TimoDJatomika/EdgeRouter-Stuff/blob/master/squidguard.md
[8] https://serverfault.com/questions/813087/reverse-proxy-on-ubiquiti-edgerouter-poe
Reference in New Issue Copy Permalink