config: ``` set firewall all-ping enable set firewall broadcast-ping disable set firewall ipv6-name WANv6_IN default-action drop set firewall ipv6-name WANv6_IN description 'WAN inbound traffic forwarded to LAN' set firewall ipv6-name WANv6_IN enable-default-log set firewall ipv6-name WANv6_IN rule 10 action accept set firewall ipv6-name WANv6_IN rule 10 description 'Allow established/related sessions' set firewall ipv6-name WANv6_IN rule 10 state established enable set firewall ipv6-name WANv6_IN rule 10 state related enable set firewall ipv6-name WANv6_IN rule 20 action drop set firewall ipv6-name WANv6_IN rule 20 description 'Drop invalid state' set firewall ipv6-name WANv6_IN rule 20 state invalid enable set firewall ipv6-name WANv6_LOCAL default-action drop set firewall ipv6-name WANv6_LOCAL description 'WAN inbound traffic to the router' set firewall ipv6-name WANv6_LOCAL enable-default-log set firewall ipv6-name WANv6_LOCAL rule 10 action accept set firewall ipv6-name WANv6_LOCAL rule 10 description 'Allow established/related sessions' set firewall ipv6-name WANv6_LOCAL rule 10 state established enable set firewall ipv6-name WANv6_LOCAL rule 10 state related enable set firewall ipv6-name WANv6_LOCAL rule 20 action drop set firewall ipv6-name WANv6_LOCAL rule 20 description 'Drop invalid state' set firewall ipv6-name WANv6_LOCAL rule 20 state invalid enable set firewall ipv6-name WANv6_LOCAL rule 30 action accept set firewall ipv6-name WANv6_LOCAL rule 30 description 'Allow IPv6 icmp' set firewall ipv6-name WANv6_LOCAL rule 30 protocol ipv6-icmp set firewall ipv6-name WANv6_LOCAL rule 40 action accept set firewall ipv6-name WANv6_LOCAL rule 40 description 'allow dhcpv6' set firewall ipv6-name WANv6_LOCAL rule 40 destination port 546 set firewall ipv6-name WANv6_LOCAL rule 40 protocol udp set firewall ipv6-name WANv6_LOCAL rule 40 source port 547 set firewall ipv6-receive-redirects disable set firewall ipv6-src-route disable set firewall ip-src-route disable set firewall log-martians enable set firewall name WAN_IN default-action drop set firewall name WAN_IN description 'WAN to internal' set firewall name WAN_IN rule 10 action accept set firewall name WAN_IN rule 10 description 'Allow established/related' set firewall name WAN_IN rule 10 state established enable set firewall name WAN_IN rule 10 state related enable set firewall name WAN_IN rule 20 action drop set firewall name WAN_IN rule 20 description 'Drop invalid state' set firewall name WAN_IN rule 20 state invalid enable set firewall name WAN_LOCAL default-action drop set firewall name WAN_LOCAL description 'WAN to router' set firewall name WAN_LOCAL rule 10 action accept set firewall name WAN_LOCAL rule 10 description 'Allow established/related' set firewall name WAN_LOCAL rule 10 state established enable set firewall name WAN_LOCAL rule 10 state related enable set firewall name WAN_LOCAL rule 20 action drop set firewall name WAN_LOCAL rule 20 description 'Drop invalid state' set firewall name WAN_LOCAL rule 20 state invalid enable set firewall options mss-clamp mss 1412 set firewall receive-redirects disable set firewall send-redirects enable set firewall source-validation disable set firewall syn-cookies enable set interfaces ethernet eth0 description Local set interfaces ethernet eth0 duplex auto set interfaces ethernet eth0 speed auto set interfaces ethernet eth1 description Local set interfaces ethernet eth1 duplex auto set interfaces ethernet eth1 speed auto set interfaces ethernet eth2 description Local set interfaces ethernet eth2 duplex auto set interfaces ethernet eth2 speed auto set interfaces ethernet eth3 description Local set interfaces ethernet eth3 duplex auto set interfaces ethernet eth3 speed auto set interfaces ethernet eth4 description 'Internet (PPPoE)' set interfaces ethernet eth4 duplex auto set interfaces ethernet eth4 poe output off set interfaces ethernet eth4 pppoe 0 default-route auto set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0 host-address '::1' set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0 prefix-id ':1' set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0 service slaac set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 prefix-length /60 set interfaces ethernet eth4 pppoe 0 dhcpv6-pd rapid-commit enable set interfaces ethernet eth4 pppoe 0 firewall in ipv6-name WANv6_IN set interfaces ethernet eth4 pppoe 0 firewall in name WAN_IN set interfaces ethernet eth4 pppoe 0 firewall local ipv6-name WANv6_LOCAL set interfaces ethernet eth4 pppoe 0 firewall local name WAN_LOCAL set interfaces ethernet eth4 pppoe 0 ipv6 address autoconf set interfaces ethernet eth4 pppoe 0 ipv6 dup-addr-detect-transmits 1 set interfaces ethernet eth4 pppoe 0 ipv6 enable set interfaces ethernet eth4 pppoe 0 mtu 1492 set interfaces ethernet eth4 pppoe 0 name-server auto set interfaces ethernet eth4 pppoe 0 password 32867410 set interfaces ethernet eth4 pppoe 0 user-id 02004536188@163.gd set interfaces ethernet eth4 speed auto set interfaces loopback lo set interfaces switch switch0 address 192.168.66.254/24 set interfaces switch switch0 description Local set interfaces switch switch0 mtu 1500 set interfaces switch switch0 switch-port interface eth0 set interfaces switch switch0 switch-port interface eth1 set interfaces switch switch0 switch-port interface eth2 set interfaces switch switch0 switch-port interface eth3 set interfaces switch switch0 switch-port vlan-aware disable set port-forward auto-firewall enable set port-forward hairpin-nat enable set port-forward lan-interface eth0 # FIX-01 (2026-08-07): 公网 SSH 端口转发已删除，改用 WireGuard 管理；原规则为 ssh 58222 → 192.168.66.32:22 # set port-forward rule 1 description ssh # set port-forward rule 1 forward-to address 192.168.66.32 # set port-forward rule 1 forward-to port 22 # set port-forward rule 1 original-port 58222 # set port-forward rule 1 protocol tcp_udp set port-forward rule 2 description trasmission set port-forward rule 2 forward-to address 192.168.66.32 set port-forward rule 2 forward-to port 51413 set port-forward rule 2 original-port 51413 set port-forward rule 2 protocol tcp_udp set port-forward wan-interface pppoe0 set service dhcp-server disabled false set service dhcp-server hostfile-update disable set service dhcp-server shared-network-name LAN authoritative enable set service dhcp-server shared-network-name LAN disable set service dhcp-server shared-network-name LAN subnet 192.168.66.0/24 default-router 192.168.66.254 set service dhcp-server shared-network-name LAN subnet 192.168.66.0/24 dns-server 192.168.66.254 set service dhcp-server shared-network-name LAN subnet 192.168.66.0/24 lease 86400 set service dhcp-server shared-network-name LAN subnet 192.168.66.0/24 start 192.168.66.38 stop 192.168.66.243 set service dhcp-server static-arp disable set service dhcp-server use-dnsmasq disable set service dns dynamic interface pppoe0 service custom-noip host-name windyboycn.ddns.net set service dns dynamic interface pppoe0 service custom-noip login windyboy@gmail.com set service dns dynamic interface pppoe0 service custom-noip password windyboycn.ddns.net set service dns dynamic interface pppoe0 service custom-noip protocol noip set service dns dynamic interface pppoe0 service custom-noip server noip.com set service dns dynamic interface pppoe0 web dyndns set service dns forwarding cache-size 150 set service dns forwarding listen-on switch0 set service gui http-port 80 set service gui https-port 443 set service gui older-ciphers enable set service nat rule 5010 description 'masquerade for WAN' set service nat rule 5010 outbound-interface pppoe0 set service nat rule 5010 type masquerade set service ssh port 22 set service ssh protocol-version v2 set service unms connection 'wss://zhiqiang.uisp.com:443+rfvfxRFhpehdfXaaA2ZtrzF9BGA_bL4juvRundNAa20AAAAA+allowUntrustedCertificate' set service upnp2 listen-on switch0 set service upnp2 nat-pmp enable set service upnp2 secure-mode enable set service upnp2 wan pppoe0 set system analytics-handler send-analytics-report false set system crash-handler send-crash-report false set system domain-name windy.me set system host-name gw set system login user ubnt authentication encrypted-password '$5$9KWfs5EFP4KMyg2o$Yo/k5.qqqwouiQmjREDv8ycdl0qe.2vCsO7wzXrpmT.' set system login user ubnt authentication plaintext-password '' set system login user ubnt full-name 'ubnt default user' set system login user ubnt level admin set system login user zhiqiang authentication encrypted-password '$5$L0plc3edYo79BfZU$iRzWJAYLFOL4ZiipVCxeIrVqOxpJlJxsqOTQhWURcH5' set system login user zhiqiang level admin set system ntp server 0.ubnt.pool.ntp.org set system ntp server 1.ubnt.pool.ntp.org set system ntp server 2.ubnt.pool.ntp.org set system ntp server 3.ubnt.pool.ntp.org set system offload hwnat enable set system offload ipsec enable set system syslog global facility all level notice set system syslog global facility protocols level debug set system time-zone Asia/Shanghai ``` new : 下面是更新后的配置脚本及详细执行步骤。在此版本中： 1. **端口转发已移除**：不再包含 `port-forward` 相关配置项。 2. **UPnP 保留**：仍有 UPnP 配置，以实现动态端口映射功能。 3. **网关 IP 依然为 .254**：内网 VLAN 网段的网关为 192.168.55.254 和 192.168.66.254。 4. 外网 PPPoE、IPv6 防火墙、IPv4 防火墙、NAT、DDNS、DNS、NTP、SSH、UNMS、UPnP、GUI 等保留原先配置。 请在执行 `reset configuration` 后，使用默认用户名密码 (`ubnt/ubnt`) 登录路由器，然后按照下方步骤执行配置脚本。 --- ### 执行步骤 1. **重置配置（如有需要）**： 登录 CLI 后执行： ```bash reset configuration ``` 等待重置完成后路由器将恢复出厂默认。 2. **登录路由器**： 使用默认帐号登录： - 用户名：`ubnt` - 密码：`ubnt` 3. **进入配置模式**： ```bash configure ``` 4. **粘贴下方配置命令**（可一次性全部复制粘贴）： ```bash # 基本防护与系统配置 set firewall all-ping enable set firewall broadcast-ping disable set firewall ipv6-receive-redirects disable set firewall ipv6-src-route disable set firewall ip-src-route disable set firewall log-martians enable set firewall options mss-clamp mss 1412 set firewall receive-redirects disable set firewall send-redirects enable set firewall source-validation disable set firewall syn-cookies enable # IPv6防火墙 - WANv6_IN set firewall ipv6-name WANv6_IN default-action drop set firewall ipv6-name WANv6_IN description 'WAN inbound traffic forwarded to LAN' set firewall ipv6-name WANv6_IN enable-default-log set firewall ipv6-name WANv6_IN rule 10 action accept set firewall ipv6-name WANv6_IN rule 10 description 'Allow established/related sessions' set firewall ipv6-name WANv6_IN rule 10 state established enable set firewall ipv6-name WANv6_IN rule 10 state related enable set firewall ipv6-name WANv6_IN rule 20 action drop set firewall ipv6-name WANv6_IN rule 20 description 'Drop invalid state' set firewall ipv6-name WANv6_IN rule 20 state invalid enable # IPv6防火墙 - WANv6_LOCAL set firewall ipv6-name WANv6_LOCAL default-action drop set firewall ipv6-name WANv6_LOCAL description 'WAN inbound traffic to the router' set firewall ipv6-name WANv6_LOCAL enable-default-log set firewall ipv6-name WANv6_LOCAL rule 10 action accept set firewall ipv6-name WANv6_LOCAL rule 10 description 'Allow established/related sessions' set firewall ipv6-name WANv6_LOCAL rule 10 state established enable set firewall ipv6-name WANv6_LOCAL rule 10 state related enable set firewall ipv6-name WANv6_LOCAL rule 20 action drop set firewall ipv6-name WANv6_LOCAL rule 20 description 'Drop invalid state' set firewall ipv6-name WANv6_LOCAL rule 20 state invalid enable set firewall ipv6-name WANv6_LOCAL rule 30 action accept set firewall ipv6-name WANv6_LOCAL rule 30 description 'Allow IPv6 icmp' set firewall ipv6-name WANv6_LOCAL rule 30 protocol ipv6-icmp set firewall ipv6-name WANv6_LOCAL rule 40 action accept set firewall ipv6-name WANv6_LOCAL rule 40 description 'allow dhcpv6' set firewall ipv6-name WANv6_LOCAL rule 40 destination port 546 set firewall ipv6-name WANv6_LOCAL rule 40 protocol udp set firewall ipv6-name WANv6_LOCAL rule 40 source port 547 # IPv4防火墙 - WAN_IN set firewall name WAN_IN default-action drop set firewall name WAN_IN description 'WAN to internal' set firewall name WAN_IN rule 10 action accept set firewall name WAN_IN rule 10 description 'Allow established/related' set firewall name WAN_IN rule 10 state established enable set firewall name WAN_IN rule 10 state related enable set firewall name WAN_IN rule 20 action drop set firewall name WAN_IN rule 20 description 'Drop invalid state' set firewall name WAN_IN rule 20 state invalid enable # IPv4防火墙 - WAN_LOCAL set firewall name WAN_LOCAL default-action drop set firewall name WAN_LOCAL description 'WAN to router' set firewall name WAN_LOCAL rule 10 action accept set firewall name WAN_LOCAL rule 10 description 'Allow established/related' set firewall name WAN_LOCAL rule 10 state established enable set firewall name WAN_LOCAL rule 10 state related enable set firewall name WAN_LOCAL rule 20 action drop set firewall name WAN_LOCAL rule 20 description 'Drop invalid state' set firewall name WAN_LOCAL rule 20 state invalid enable # 接口设置 set interfaces ethernet eth0 description Local set interfaces ethernet eth0 duplex auto set interfaces ethernet eth0 speed auto set interfaces ethernet eth1 description Local set interfaces ethernet eth1 duplex auto set interfaces ethernet eth1 speed auto set interfaces ethernet eth2 description Local set interfaces ethernet eth2 duplex auto set interfaces ethernet eth2 speed auto set interfaces ethernet eth3 description Local set interfaces ethernet eth3 duplex auto set interfaces ethernet eth3 speed auto set interfaces ethernet eth4 description 'Internet (PPPoE)' set interfaces ethernet eth4 duplex auto set interfaces ethernet eth4 poe output off set interfaces ethernet eth4 speed auto # PPPoE配置 set interfaces ethernet eth4 pppoe 0 user-id '02004536188@163.gd' set interfaces ethernet eth4 pppoe 0 password '32867410' set interfaces ethernet eth4 pppoe 0 default-route auto set interfaces ethernet eth4 pppoe 0 mtu 1492 set interfaces ethernet eth4 pppoe 0 name-server auto set interfaces ethernet eth4 pppoe 0 ipv6 enable set interfaces ethernet eth4 pppoe 0 ipv6 address autoconf set interfaces ethernet eth4 pppoe 0 ipv6 dup-addr-detect-transmits 1 set interfaces ethernet eth4 pppoe 0 firewall in ipv6-name WANv6_IN set interfaces ethernet eth4 pppoe 0 firewall in name WAN_IN set interfaces ethernet eth4 pppoe 0 firewall local ipv6-name WANv6_LOCAL set interfaces ethernet eth4 pppoe 0 firewall local name WAN_LOCAL set interfaces ethernet eth4 pppoe 0 dhcpv6-pd prefix-length /60 set interfaces ethernet eth4 pppoe 0 dhcpv6-pd rapid-commit enable # 内网交换机 VLAN 配置 set interfaces switch switch0 description 'Local Switch' set interfaces switch switch0 mtu 1500 #set interfaces switch switch0 vlan-aware enable # VLAN 55: eth0, eth1 set interfaces switch switch0 switch-port interface eth0 vlan pvid 55 set interfaces switch switch0 switch-port interface eth1 vlan pvid 55 # VLAN 66: eth2, eth3 set interfaces switch switch0 switch-port interface eth2 vlan pvid 66 set interfaces switch switch0 switch-port interface eth3 vlan pvid 66 # VLAN子接口，并使用.254作为网关 set interfaces switch switch0 vif 55 address 192.168.55.254/24 set interfaces switch switch0 vif 55 description 'LAN1 - 192.168.55.0/24' set interfaces switch switch0 vif 66 address 192.168.66.254/24 set interfaces switch switch0 vif 66 description 'LAN2 - 192.168.66.0/24' # IPv6前缀分配到VLAN子接口 set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0.55 prefix-id ':1' set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0.55 service slaac set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0.66 prefix-id ':2' set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0.66 service slaac # NAT 配置 set service nat rule 5010 description 'masquerade for WAN' set service nat rule 5010 outbound-interface pppoe0 set service nat rule 5010 type masquerade # DHCP 服务，网关和DNS服务器为 .254 set service dhcp-server disabled false set service dhcp-server hostfile-update disable # VLAN55 DHCP set service dhcp-server shared-network-name LAN55 authoritative enable set service dhcp-server shared-network-name LAN55 subnet 192.168.55.0/24 default-router 192.168.55.254 set service dhcp-server shared-network-name LAN55 subnet 192.168.55.0/24 dns-server 192.168.66.36 set service dhcp-server shared-network-name LAN55 subnet 192.168.55.0/24 lease 86400 set service dhcp-server shared-network-name LAN55 subnet 192.168.55.0/24 start 192.168.55.100 stop 192.168.55.200 # VLAN66 DHCP set service dhcp-server shared-network-name LAN66 authoritative enable set service dhcp-server shared-network-name LAN66 subnet 192.168.66.0/24 default-router 192.168.66.254 set service dhcp-server shared-network-name LAN66 subnet 192.168.66.0/24 dns-server 192.168.66.36 set service dhcp-server shared-network-name LAN66 subnet 192.168.66.0/24 lease 86400 set service dhcp-server shared-network-name LAN66 subnet 192.168.66.0/24 start 192.168.66.100 stop 192.168.66.200 set service dhcp-server static-arp disable set service dhcp-server use-dnsmasq disable # DDNS 配置 set service dns dynamic interface pppoe0 service custom-noip host-name 'windyboycn.ddns.net' set service dns dynamic interface pppoe0 service custom-noip login 'windyboy@gmail.com' set service dns dynamic interface pppoe0 service custom-noip password 'windyboycn.ddns.net' set service dns dynamic interface pppoe0 service custom-noip protocol noip set service dns dynamic interface pppoe0 service custom-noip server noip.com set service dns dynamic interface pppoe0 web dyndns # DNS 转发 set service dns forwarding cache-size 150 set service dns forwarding listen-on switch0 # GUI set service gui http-port 80 set service gui https-port 443 set service gui older-ciphers enable # 移除端口转发相关配置（无 port-forward 相关命令） # SSH set service ssh port 22 set service ssh protocol-version v2 # UNMS set service unms connection 'wss://zhiqiang.uisp.com:443+rfvfxRFhpehdfXaaA2ZtrzF9BGA_bL4juvRundNAa20AAAAA+allowUntrustedCertificate' # UPnP 保留 set service upnp2 listen-on switch0 set service upnp2 nat-pmp enable set service upnp2 secure-mode enable set service upnp2 wan pppoe0 # 系统配置 set system analytics-handler send-analytics-report false set system crash-handler send-crash-report false set system domain-name 'windy.me' set system host-name 'gw' set system login user ubnt authentication encrypted-password '$5$9KWfs5EFP4KMyg2o$Yo/k5.qqqwouiQmjREDv8ycdl0qe.2vCsO7wzXrpmT.' set system login user ubnt authentication plaintext-password '' set system login user ubnt full-name 'ubnt default user' set system login user ubnt level admin set system login user zhiqiang authentication encrypted-password '$5$L0plc3edYo79BfZU$iRzWJAYLFOL4ZiipVCxeIrVqOxpJlJxsqOTQhWURcH5' set system login user zhiqiang level admin set system ntp server 0.ubnt.pool.ntp.org set system ntp server 1.ubnt.pool.ntp.org set system ntp server 2.ubnt.pool.ntp.org set system ntp server 3.ubnt.pool.ntp.org set system offload hwnat enable set system offload ipsec enable set system syslog global facility all level notice set system syslog global facility protocols level debug set system time-zone Asia/Shanghai ``` 5. **提交并保存配置**： ```bash commit save exit ``` 6. **验证**： - `eth0`、`eth1` 接的设备应获取 `192.168.55.x` 地址，网关为 `192.168.55.254` - `eth2`、`eth3` 接的设备应获取 `192.168.66.x` 地址，网关为 `192.168.66.254` - 测试外网访问（IPv4、IPv6） - 确认 UPnP 正常（适配支持 UPnP 的内网设备应该可以动态映射端口到外网） - 确认防火墙与 NAT 正常工作 --- 以上步骤确保在不需要端口转发配置的情况下，保留原有的 UPnP、外网 PPPoE、IPv6 防火墙、IPv4 防火墙、DHCP、DNS、DDNS、NTP、SSH、UNMS、GUI 等功能，满足你的最新要求。 ubnt new pass: ``` windyboy ``` ``` set firewall name LAN_IN rule 30 action accept set firewall name LAN_IN rule 30 description 'Allow 55 to 66' set firewall name LAN_IN rule 30 source address 192.168.55.0/24 set firewall name LAN_IN rule 30 destination address 192.168.66.0/24 ``` ``` set firewall name LAN_IN rule 40 action accept set firewall name LAN_IN rule 40 description 'Allow 66 to 55' set firewall name LAN_IN rule 40 source address 192.168.66.0/24 set firewall name LAN_IN rule 40 destination address 192.168.55.0/24 ``` ``` set interfaces switch switch0 switch-port interface eth1 set interfaces switch switch0 switch-port interface eth2 set interfaces switch switch0 switch-port interface eth3 ``` ``` configure set service nat rule 5020 description 'masquerade for LAN 55' set service nat rule 5020 outbound-interface pppoe0 set service nat rule 5020 source address 192.168.55.0/24 set service nat rule 5020 type masquerade commit save ``` ``` firewall { all-ping enable broadcast-ping disable ipv6-name WANv6_IN { default-action drop description "WAN inbound traffic forwarded to LAN" enable-default-log rule 10 { action accept description "Allow established/related sessions" state { established enable related enable } } rule 20 { action drop description "Drop invalid state" state { invalid enable } } } ipv6-name WANv6_LOCAL { default-action drop description "WAN inbound traffic to the router" enable-default-log rule 10 { action accept description "Allow established/related sessions" state { established enable related enable } } rule 20 { action drop description "Drop invalid state" state { invalid enable } } rule 30 { action accept description "Allow IPv6 icmp" protocol ipv6-icmp } rule 40 { action accept description "allow dhcpv6" destination { port 546 } protocol udp source { port 547 } } } ipv6-receive-redirects disable ipv6-src-route disable ip-src-route disable log-martians enable name LAN_IN { default-action drop rule 10 { action accept description "Allow established/related sessions" state { established enable related enable } } rule 20 { action drop description "Drop invalid states" state { invalid enable } } rule 40 { action accept description "Allow 66 to 55" destination { address 192.168.55.0/24 } source { address 192.168.66.0/24 } } } name LAN_OUT { default-action drop rule 10 { action accept description "Allow internet access" destination { address 0.0.0.0/0 } } } name WAN_IN { default-action drop description "WAN to internal" rule 10 { action accept description "Allow established/related" state { established enable related enable } } rule 20 { action drop description "Drop invalid state" state { invalid enable } } } name WAN_LOCAL { default-action drop description "WAN to router" rule 10 { action accept description "Allow established/related" state { established enable related enable } } rule 20 { action drop description "Drop invalid state" state { invalid enable } } } options { mss-clamp { mss 1412 } } receive-redirects disable send-redirects enable source-validation disable syn-cookies enable } interfaces { ethernet eth0 { address 192.168.66.254/24 description "Local 2" duplex auto speed auto } ethernet eth1 { description Local duplex auto speed auto } ethernet eth2 { description Local duplex auto speed auto } ethernet eth3 { description Local duplex auto speed auto } ethernet eth4 { description "Internet (PPPoE)" duplex auto poe { output off } pppoe 0 { default-route auto dhcpv6-pd { pd 0 { interface eth0 { host-address ::1 prefix-id :1 service slaac } interface switch0 { host-address ::1 prefix-id :2 service slaac } prefix-length /60 } rapid-commit enable } firewall { in { ipv6-name WANv6_IN name WAN_IN } local { ipv6-name WANv6_LOCAL name WAN_LOCAL } } ipv6 { address { autoconf } dup-addr-detect-transmits 1 enable { } } mtu 1492 name-server auto password **************** user-id 02004536188@163.gd } speed auto } loopback lo { } switch switch0 { address 192.168.55.254/24 description Local mtu 1500 switch-port { interface eth1 { } interface eth2 { } interface eth3 { } } } } port-forward { auto-firewall enable hairpin-nat enable lan-interface switch0 lan-interface eth0 rule 1 { description hass forward-to { address 192.168.55.200 port 8123 } original-port 8123 protocol tcp_udp } rule 2 { description transmission forward-to { address 192.168.66.51 port 51413 } original-port 51413 protocol tcp_udp } # FIX-01 (2026-08-07): 公网 SSH 端口转发已删除，改用 WireGuard 管理；原规则为 ssh 5822 → 192.168.66.32:22 # rule 3 { # description ssh # forward-to { # address 192.168.66.32 # port 22 # } # original-port 5822 # protocol tcp_udp # } rule 4 { description openvpn forward-to { address 192.168.66.32 port 1194 } original-port 1194 protocol tcp_udp } wan-interface pppoe0 } service { dhcp-server { disabled false hostfile-update disable shared-network-name LAN1 { authoritative enable subnet 192.168.66.0/24 { default-router 192.168.66.254 dns-server 192.168.66.36 lease 86400 start 192.168.66.38 { stop 192.168.66.243 } static-mapping gfw { ip-address 192.168.66.1 mac-address 3e:b3:96:69:11:9c } static-mapping hp-nas { ip-address 192.168.66.32 mac-address a0:1d:48:c7:77:a8 } static-mapping pihole { ip-address 192.168.66.36 mac-address ae:1d:5a:1e:77:8a } static-mapping pve { ip-address 192.168.66.26 mac-address a8:b8:e0:00:6e:eb } static-mapping transmission { ip-address 192.168.66.51 mac-address a2:1d:48:03:aa:47 } static-mapping ubnt-6 { ip-address 192.168.66.6 mac-address 78:45:58:4d:cc:30 } static-mapping ubnt-app { ip-address 192.168.66.46 mac-address c6:a4:3f:ef:e3:0c } static-mapping windy-pc { ip-address 192.168.66.99 mac-address 04:7c:16:b8:f5:e9 } } } shared-network-name LAN2 { authoritative enable subnet 192.168.55.0/24 { default-router 192.168.55.254 dns-server 192.168.55.254 lease 86400 start 192.168.55.38 { stop 192.168.55.243 } static-mapping Aqara-Hub-M3-10CB { ip-address 192.168.55.248 mac-address 18:c2:3c:45:61:e7 } static-mapping SmartThings-Station { ip-address 192.168.55.48 mac-address 2c:ba:ba:99:e5:2b } static-mapping espressif { ip-address 192.168.55.47 mac-address a0:76:4e:38:6b:3c } static-mapping homeassistant { ip-address 192.168.55.200 mac-address 5c:8a:ae:68:1e:dd } static-mapping midea_e3_0198 { ip-address 192.168.55.42 mac-address b0:96:ea:c4:79:8c } static-mapping oneplus-12 { ip-address 192.168.55.249 mac-address c2:23:b1:c3:4d:bf } static-mapping roborock-wm-a141 { ip-address 192.168.55.43 mac-address b0:4a:39:ce:82:ef } static-mapping samsung-hub { ip-address 192.168.55.251 mac-address c4:82:e1:b7:fa:ff } static-mapping unifi-ac { ip-address 192.168.55.5 mac-address f0:9f:c2:20:04:e9 } static-mapping zbgw7688 { ip-address 192.168.55.60 mac-address 12:00:00:ab:d2:a9 } } } static-arp disable use-dnsmasq disable } dns { forwarding { cache-size 150 listen-on eth0 listen-on switch0 } } gui { http-port 80 https-port 443 older-ciphers enable } nat { rule 5010 { description "masquerade for WAN" log disable outbound-interface pppoe0 protocol all type masquerade } } snmp { community myc { authorization ro } contact null location null } ssh { port 22 protocol-version v2 } unms { connection wss://zhiqiang.uisp.com:443+rfvfxRFhpehdfXaaA2ZtrzF9BGA_bL4juvRundNAa20AAAAA+allowUntrustedCertificate } } system { analytics-handler { send-analytics-report false } crash-handler { send-crash-report false } domain-name windy.me host-name gw login { user ubnt { authentication { encrypted-password **************** plaintext-password **************** } level admin } user zhiqiang { authentication { encrypted-password **************** plaintext-password **************** } full-name "zhiqiang feng" level admin } } ntp { server 0.ubnt.pool.ntp.org { } server 1.ubnt.pool.ntp.org { } server 2.ubnt.pool.ntp.org { } server 3.ubnt.pool.ntp.org { } } syslog { global { facility all { level notice } facility protocols { level debug } } } time-zone Asia/Shanghai } ``` ``` network update wlan0  --ipv4-gateway 192.168.55.254 ``` ``` network update wlan0 --ipv4-method auto --ipv6-method disabled ``` To set up an **IGMP Proxy** on your EdgeRouter X with two LANs, where one is on `eth0` and the other is on `switch0`, while using PPPoE for the WAN connection, follow these detailed steps: ## Step-by-Step Configuration ### 1. Access the EdgeRouter - Connect to your EdgeRouter X via SSH or through the web interface. ### 2. Configure the WAN Connection - Set up your WAN interface (usually `eth0`) for PPPoE. This can typically be done through the web interface or CLI: ```bash configure set interfaces ethernet eth0 pppoe # Add your PPPoE settings here commit; save ``` ### 3. Configure IGMP Proxy - Enter configuration mode: ```bash configure ``` - **Set Up Upstream and Downstream Interfaces**: - For the WAN interface (assuming it is `pppoe0`): ```bash set protocols igmp-proxy interface pppoe0 role upstream set protocols igmp-proxy interface pppoe0 threshold 1 set protocols igmp-proxy interface pppoe0 alt-subnet 0.0.0.0/0 ``` - For the LAN interface on `switch0`: ```bash set protocols igmp-proxy interface switch0 role downstream set protocols igmp-proxy interface switch0 threshold 1 set protocols igmp-proxy interface switch0 alt-subnet 0.0.0.0/0 ``` - For the LAN interface on eth0 ```shell set protocols igmp-proxy interface eth0 role downstream set protocols igmp-proxy interface eth0 threshold 1 set protocols igmp-proxy interface eth0 alt-subnet 0.0.0.0/0 ``` ### 4. Commit and Save Changes - After configuring the IGMP proxy, commit and save your changes: ```bash commit; save; exit ``` ### 5. Verify Configuration - Check if the IGMP proxy is configured correctly: ```bash show protocols igmp-proxy ``` ### Additional Considerations - **Ensure IGMP Snooping is Enabled**: If you are using a managed switch, make sure IGMP snooping is enabled to properly handle multicast traffic. - **Firewall Rules**: Ensure that your firewall rules allow IGMP traffic between the WAN and LAN interfaces. - **Testing**: After configuration, test your IPTV or multicast services to ensure they are functioning correctly. This setup will allow your EdgeRouter X to manage multicast traffic effectively across both LANs while maintaining a stable WAN connection via PPPoE. Citations: [1] https://superuser.com/questions/1184320/how-to-use-nginx-as-a-reverse-proxy-on-a-ubiquiti-router [2] https://community.odido.nl/thuisnetwerk-539/how-to-edgerouter-iptv-internet-342141 [3] https://help.ui.com/hc/en-us/articles/204961694-EdgeRouter-Web-Proxy [4] https://community.ui.com/questions/how-to-setup-a-proxy-server-on-my-router/13b39fe3-ac56-4400-8903-147e97564b8c [5] https://help.uisp.com/hc/en-us/articles/22591218897559-EdgeRouter-IGMP-Proxy [6] https://www.reddit.com/r/Ubiquiti/comments/9a42zg/edgerouter_x_gui_behind_nginx_reverse_proxy/ [7] https://github.com/TimoDJatomika/EdgeRouter-Stuff/blob/master/squidguard.md [8] https://serverfault.com/questions/813087/reverse-proxy-on-ubiquiti-edgerouter-poe