my-vault/01_Projects/Infrastructure/Network/ER-X.md at main

windy/my-vault

Fork 0

Files

T

windyboy 2790f281c5 vault backup: 2026-08-10 17:01:10

2026-08-10 17:01:10 +08:00

37 KiB

Raw Permalink Blame History

config:

set firewall all-ping enable
set firewall broadcast-ping disable
set firewall ipv6-name WANv6_IN default-action drop
set firewall ipv6-name WANv6_IN description 'WAN inbound traffic forwarded to LAN'
set firewall ipv6-name WANv6_IN enable-default-log
set firewall ipv6-name WANv6_IN rule 10 action accept
set firewall ipv6-name WANv6_IN rule 10 description 'Allow established/related sessions'
set firewall ipv6-name WANv6_IN rule 10 state established enable
set firewall ipv6-name WANv6_IN rule 10 state related enable
set firewall ipv6-name WANv6_IN rule 20 action drop
set firewall ipv6-name WANv6_IN rule 20 description 'Drop invalid state'
set firewall ipv6-name WANv6_IN rule 20 state invalid enable
set firewall ipv6-name WANv6_LOCAL default-action drop
set firewall ipv6-name WANv6_LOCAL description 'WAN inbound traffic to the router'
set firewall ipv6-name WANv6_LOCAL enable-default-log
set firewall ipv6-name WANv6_LOCAL rule 10 action accept
set firewall ipv6-name WANv6_LOCAL rule 10 description 'Allow established/related sessions'
set firewall ipv6-name WANv6_LOCAL rule 10 state established enable
set firewall ipv6-name WANv6_LOCAL rule 10 state related enable
set firewall ipv6-name WANv6_LOCAL rule 20 action drop
set firewall ipv6-name WANv6_LOCAL rule 20 description 'Drop invalid state'
set firewall ipv6-name WANv6_LOCAL rule 20 state invalid enable
set firewall ipv6-name WANv6_LOCAL rule 30 action accept
set firewall ipv6-name WANv6_LOCAL rule 30 description 'Allow IPv6 icmp'
set firewall ipv6-name WANv6_LOCAL rule 30 protocol ipv6-icmp
set firewall ipv6-name WANv6_LOCAL rule 40 action accept
set firewall ipv6-name WANv6_LOCAL rule 40 description 'allow dhcpv6'
set firewall ipv6-name WANv6_LOCAL rule 40 destination port 546
set firewall ipv6-name WANv6_LOCAL rule 40 protocol udp
set firewall ipv6-name WANv6_LOCAL rule 40 source port 547
set firewall ipv6-receive-redirects disable
set firewall ipv6-src-route disable
set firewall ip-src-route disable
set firewall log-martians enable
set firewall name WAN_IN default-action drop
set firewall name WAN_IN description 'WAN to internal'
set firewall name WAN_IN rule 10 action accept
set firewall name WAN_IN rule 10 description 'Allow established/related'
set firewall name WAN_IN rule 10 state established enable
set firewall name WAN_IN rule 10 state related enable
set firewall name WAN_IN rule 20 action drop
set firewall name WAN_IN rule 20 description 'Drop invalid state'
set firewall name WAN_IN rule 20 state invalid enable
set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL description 'WAN to router'
set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 description 'Allow established/related'
set firewall name WAN_LOCAL rule 10 state established enable
set firewall name WAN_LOCAL rule 10 state related enable
set firewall name WAN_LOCAL rule 20 action drop
set firewall name WAN_LOCAL rule 20 description 'Drop invalid state'
set firewall name WAN_LOCAL rule 20 state invalid enable
set firewall options mss-clamp mss 1412
set firewall receive-redirects disable
set firewall send-redirects enable
set firewall source-validation disable
set firewall syn-cookies enable
set interfaces ethernet eth0 description Local
set interfaces ethernet eth0 duplex auto
set interfaces ethernet eth0 speed auto
set interfaces ethernet eth1 description Local
set interfaces ethernet eth1 duplex auto
set interfaces ethernet eth1 speed auto
set interfaces ethernet eth2 description Local
set interfaces ethernet eth2 duplex auto
set interfaces ethernet eth2 speed auto
set interfaces ethernet eth3 description Local
set interfaces ethernet eth3 duplex auto
set interfaces ethernet eth3 speed auto
set interfaces ethernet eth4 description 'Internet (PPPoE)'
set interfaces ethernet eth4 duplex auto
set interfaces ethernet eth4 poe output off
set interfaces ethernet eth4 pppoe 0 default-route auto
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0 host-address '::1'
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0 prefix-id ':1'
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0 service slaac
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 prefix-length /60
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd rapid-commit enable
set interfaces ethernet eth4 pppoe 0 firewall in ipv6-name WANv6_IN
set interfaces ethernet eth4 pppoe 0 firewall in name WAN_IN
set interfaces ethernet eth4 pppoe 0 firewall local ipv6-name WANv6_LOCAL
set interfaces ethernet eth4 pppoe 0 firewall local name WAN_LOCAL
set interfaces ethernet eth4 pppoe 0 ipv6 address autoconf
set interfaces ethernet eth4 pppoe 0 ipv6 dup-addr-detect-transmits 1
set interfaces ethernet eth4 pppoe 0 ipv6 enable
set interfaces ethernet eth4 pppoe 0 mtu 1492
set interfaces ethernet eth4 pppoe 0 name-server auto
set interfaces ethernet eth4 pppoe 0 password 32867410
set interfaces ethernet eth4 pppoe 0 user-id 02004536188@163.gd
set interfaces ethernet eth4 speed auto
set interfaces loopback lo
set interfaces switch switch0 address 192.168.66.254/24
set interfaces switch switch0 description Local
set interfaces switch switch0 mtu 1500
set interfaces switch switch0 switch-port interface eth0
set interfaces switch switch0 switch-port interface eth1
set interfaces switch switch0 switch-port interface eth2
set interfaces switch switch0 switch-port interface eth3
set interfaces switch switch0 switch-port vlan-aware disable
set port-forward auto-firewall enable
set port-forward hairpin-nat enable
set port-forward lan-interface eth0
# FIX-01 (2026-08-07): 公网 SSH 端口转发已删除，改用 WireGuard 管理；原规则为 ssh 58222 → 192.168.66.32:22
# set port-forward rule 1 description ssh
# set port-forward rule 1 forward-to address 192.168.66.32
# set port-forward rule 1 forward-to port 22
# set port-forward rule 1 original-port 58222
# set port-forward rule 1 protocol tcp_udp
set port-forward rule 2 description trasmission
set port-forward rule 2 forward-to address 192.168.66.32
set port-forward rule 2 forward-to port 51413
set port-forward rule 2 original-port 51413
set port-forward rule 2 protocol tcp_udp
set port-forward wan-interface pppoe0
set service dhcp-server disabled false
set service dhcp-server hostfile-update disable
set service dhcp-server shared-network-name LAN authoritative enable
set service dhcp-server shared-network-name LAN disable
set service dhcp-server shared-network-name LAN subnet 192.168.66.0/24 default-router 192.168.66.254
set service dhcp-server shared-network-name LAN subnet 192.168.66.0/24 dns-server 192.168.66.254
set service dhcp-server shared-network-name LAN subnet 192.168.66.0/24 lease 86400
set service dhcp-server shared-network-name LAN subnet 192.168.66.0/24 start 192.168.66.38 stop 192.168.66.243
set service dhcp-server static-arp disable
set service dhcp-server use-dnsmasq disable
set service dns dynamic interface pppoe0 service custom-noip host-name windyboycn.ddns.net
set service dns dynamic interface pppoe0 service custom-noip login windyboy@gmail.com
set service dns dynamic interface pppoe0 service custom-noip password windyboycn.ddns.net
set service dns dynamic interface pppoe0 service custom-noip protocol noip
set service dns dynamic interface pppoe0 service custom-noip server noip.com
set service dns dynamic interface pppoe0 web dyndns
set service dns forwarding cache-size 150
set service dns forwarding listen-on switch0
set service gui http-port 80
set service gui https-port 443
set service gui older-ciphers enable
set service nat rule 5010 description 'masquerade for WAN'
set service nat rule 5010 outbound-interface pppoe0
set service nat rule 5010 type masquerade
set service ssh port 22
set service ssh protocol-version v2
set service unms connection 'wss://zhiqiang.uisp.com:443+rfvfxRFhpehdfXaaA2ZtrzF9BGA_bL4juvRundNAa20AAAAA+allowUntrustedCertificate'
set service upnp2 listen-on switch0
set service upnp2 nat-pmp enable
set service upnp2 secure-mode enable
set service upnp2 wan pppoe0
set system analytics-handler send-analytics-report false
set system crash-handler send-crash-report false
set system domain-name windy.me
set system host-name gw
set system login user ubnt authentication encrypted-password '$5$9KWfs5EFP4KMyg2o$Yo/k5.qqqwouiQmjREDv8ycdl0qe.2vCsO7wzXrpmT.'
set system login user ubnt authentication plaintext-password ''
set system login user ubnt full-name 'ubnt default user'
set system login user ubnt level admin
set system login user zhiqiang authentication encrypted-password '$5$L0plc3edYo79BfZU$iRzWJAYLFOL4ZiipVCxeIrVqOxpJlJxsqOTQhWURcH5'
set system login user zhiqiang level admin
set system ntp server 0.ubnt.pool.ntp.org
set system ntp server 1.ubnt.pool.ntp.org
set system ntp server 2.ubnt.pool.ntp.org
set system ntp server 3.ubnt.pool.ntp.org
set system offload hwnat enable
set system offload ipsec enable
set system syslog global facility all level notice
set system syslog global facility protocols level debug
set system time-zone Asia/Shanghai

new :

下面是更新后的配置脚本及详细执行步骤。在此版本中：

端口转发已移除：不再包含 port-forward 相关配置项。
UPnP 保留：仍有 UPnP 配置，以实现动态端口映射功能。
网关 IP 依然为 .254：内网 VLAN 网段的网关为 192.168.55.254 和 192.168.66.254。
外网 PPPoE、IPv6 防火墙、IPv4 防火墙、NAT、DDNS、DNS、NTP、SSH、UNMS、UPnP、GUI 等保留原先配置。

请在执行 reset configuration 后，使用默认用户名密码 (ubnt/ubnt) 登录路由器，然后按照下方步骤执行配置脚本。

执行步骤

重置配置（如有需要）：
登录 CLI 后执行：

reset configuration ```

等待重置完成后路由器将恢复出厂默认。

登录路由器：
使用默认帐号登录：
- 用户名：ubnt
- 密码：ubnt
进入配置模式：
```
configure
```

粘贴下方配置命令（可一次性全部复制粘贴）：

# 基本防护与系统配置
set firewall all-ping enable
set firewall broadcast-ping disable
set firewall ipv6-receive-redirects disable
set firewall ipv6-src-route disable
set firewall ip-src-route disable
set firewall log-martians enable
set firewall options mss-clamp mss 1412
set firewall receive-redirects disable
set firewall send-redirects enable
set firewall source-validation disable
set firewall syn-cookies enable

# IPv6防火墙 - WANv6_IN
set firewall ipv6-name WANv6_IN default-action drop
set firewall ipv6-name WANv6_IN description 'WAN inbound traffic forwarded to LAN'
set firewall ipv6-name WANv6_IN enable-default-log
set firewall ipv6-name WANv6_IN rule 10 action accept
set firewall ipv6-name WANv6_IN rule 10 description 'Allow established/related sessions'
set firewall ipv6-name WANv6_IN rule 10 state established enable
set firewall ipv6-name WANv6_IN rule 10 state related enable
set firewall ipv6-name WANv6_IN rule 20 action drop
set firewall ipv6-name WANv6_IN rule 20 description 'Drop invalid state'
set firewall ipv6-name WANv6_IN rule 20 state invalid enable

# IPv6防火墙 - WANv6_LOCAL
set firewall ipv6-name WANv6_LOCAL default-action drop
set firewall ipv6-name WANv6_LOCAL description 'WAN inbound traffic to the router'
set firewall ipv6-name WANv6_LOCAL enable-default-log
set firewall ipv6-name WANv6_LOCAL rule 10 action accept
set firewall ipv6-name WANv6_LOCAL rule 10 description 'Allow established/related sessions'
set firewall ipv6-name WANv6_LOCAL rule 10 state established enable
set firewall ipv6-name WANv6_LOCAL rule 10 state related enable
set firewall ipv6-name WANv6_LOCAL rule 20 action drop
set firewall ipv6-name WANv6_LOCAL rule 20 description 'Drop invalid state'
set firewall ipv6-name WANv6_LOCAL rule 20 state invalid enable
set firewall ipv6-name WANv6_LOCAL rule 30 action accept
set firewall ipv6-name WANv6_LOCAL rule 30 description 'Allow IPv6 icmp'
set firewall ipv6-name WANv6_LOCAL rule 30 protocol ipv6-icmp
set firewall ipv6-name WANv6_LOCAL rule 40 action accept
set firewall ipv6-name WANv6_LOCAL rule 40 description 'allow dhcpv6'
set firewall ipv6-name WANv6_LOCAL rule 40 destination port 546
set firewall ipv6-name WANv6_LOCAL rule 40 protocol udp
set firewall ipv6-name WANv6_LOCAL rule 40 source port 547

# IPv4防火墙 - WAN_IN
set firewall name WAN_IN default-action drop
set firewall name WAN_IN description 'WAN to internal'
set firewall name WAN_IN rule 10 action accept
set firewall name WAN_IN rule 10 description 'Allow established/related'
set firewall name WAN_IN rule 10 state established enable
set firewall name WAN_IN rule 10 state related enable
set firewall name WAN_IN rule 20 action drop
set firewall name WAN_IN rule 20 description 'Drop invalid state'
set firewall name WAN_IN rule 20 state invalid enable

# IPv4防火墙 - WAN_LOCAL
set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL description 'WAN to router'
set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 description 'Allow established/related'
set firewall name WAN_LOCAL rule 10 state established enable
set firewall name WAN_LOCAL rule 10 state related enable
set firewall name WAN_LOCAL rule 20 action drop
set firewall name WAN_LOCAL rule 20 description 'Drop invalid state'
set firewall name WAN_LOCAL rule 20 state invalid enable

# 接口设置
set interfaces ethernet eth0 description Local
set interfaces ethernet eth0 duplex auto
set interfaces ethernet eth0 speed auto
set interfaces ethernet eth1 description Local
set interfaces ethernet eth1 duplex auto
set interfaces ethernet eth1 speed auto
set interfaces ethernet eth2 description Local
set interfaces ethernet eth2 duplex auto
set interfaces ethernet eth2 speed auto
set interfaces ethernet eth3 description Local
set interfaces ethernet eth3 duplex auto
set interfaces ethernet eth3 speed auto
set interfaces ethernet eth4 description 'Internet (PPPoE)'
set interfaces ethernet eth4 duplex auto
set interfaces ethernet eth4 poe output off
set interfaces ethernet eth4 speed auto

# PPPoE配置
set interfaces ethernet eth4 pppoe 0 user-id '02004536188@163.gd'
set interfaces ethernet eth4 pppoe 0 password '32867410'
set interfaces ethernet eth4 pppoe 0 default-route auto
set interfaces ethernet eth4 pppoe 0 mtu 1492
set interfaces ethernet eth4 pppoe 0 name-server auto
set interfaces ethernet eth4 pppoe 0 ipv6 enable
set interfaces ethernet eth4 pppoe 0 ipv6 address autoconf
set interfaces ethernet eth4 pppoe 0 ipv6 dup-addr-detect-transmits 1
set interfaces ethernet eth4 pppoe 0 firewall in ipv6-name WANv6_IN
set interfaces ethernet eth4 pppoe 0 firewall in name WAN_IN
set interfaces ethernet eth4 pppoe 0 firewall local ipv6-name WANv6_LOCAL
set interfaces ethernet eth4 pppoe 0 firewall local name WAN_LOCAL
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd prefix-length /60
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd rapid-commit enable

# 内网交换机 VLAN 配置
set interfaces switch switch0 description 'Local Switch'
set interfaces switch switch0 mtu 1500
#set interfaces switch switch0 vlan-aware enable
# VLAN 55: eth0, eth1
set interfaces switch switch0 switch-port interface eth0 vlan pvid 55
set interfaces switch switch0 switch-port interface eth1 vlan pvid 55
# VLAN 66: eth2, eth3
set interfaces switch switch0 switch-port interface eth2 vlan pvid 66
set interfaces switch switch0 switch-port interface eth3 vlan pvid 66

# VLAN子接口，并使用.254作为网关
set interfaces switch switch0 vif 55 address 192.168.55.254/24
set interfaces switch switch0 vif 55 description 'LAN1 - 192.168.55.0/24'
set interfaces switch switch0 vif 66 address 192.168.66.254/24
set interfaces switch switch0 vif 66 description 'LAN2 - 192.168.66.0/24'

# IPv6前缀分配到VLAN子接口
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0.55 prefix-id ':1'
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0.55 service slaac
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0.66 prefix-id ':2'
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0.66 service slaac

# NAT 配置
set service nat rule 5010 description 'masquerade for WAN'
set service nat rule 5010 outbound-interface pppoe0
set service nat rule 5010 type masquerade

# DHCP 服务，网关和DNS服务器为 .254
set service dhcp-server disabled false
set service dhcp-server hostfile-update disable

# VLAN55 DHCP
set service dhcp-server shared-network-name LAN55 authoritative enable
set service dhcp-server shared-network-name LAN55 subnet 192.168.55.0/24 default-router 192.168.55.254
set service dhcp-server shared-network-name LAN55 subnet 192.168.55.0/24 dns-server 192.168.66.36
set service dhcp-server shared-network-name LAN55 subnet 192.168.55.0/24 lease 86400
set service dhcp-server shared-network-name LAN55 subnet 192.168.55.0/24 start 192.168.55.100 stop 192.168.55.200

# VLAN66 DHCP
set service dhcp-server shared-network-name LAN66 authoritative enable
set service dhcp-server shared-network-name LAN66 subnet 192.168.66.0/24 default-router 192.168.66.254
set service dhcp-server shared-network-name LAN66 subnet 192.168.66.0/24 dns-server 192.168.66.36
set service dhcp-server shared-network-name LAN66 subnet 192.168.66.0/24 lease 86400
set service dhcp-server shared-network-name LAN66 subnet 192.168.66.0/24 start 192.168.66.100 stop 192.168.66.200

set service dhcp-server static-arp disable
set service dhcp-server use-dnsmasq disable

# DDNS 配置
set service dns dynamic interface pppoe0 service custom-noip host-name 'windyboycn.ddns.net'
set service dns dynamic interface pppoe0 service custom-noip login 'windyboy@gmail.com'
set service dns dynamic interface pppoe0 service custom-noip password 'windyboycn.ddns.net'
set service dns dynamic interface pppoe0 service custom-noip protocol noip
set service dns dynamic interface pppoe0 service custom-noip server noip.com
set service dns dynamic interface pppoe0 web dyndns

# DNS 转发
set service dns forwarding cache-size 150
set service dns forwarding listen-on switch0

# GUI
set service gui http-port 80
set service gui https-port 443
set service gui older-ciphers enable

# 移除端口转发相关配置（无 port-forward 相关命令）

# SSH
set service ssh port 22
set service ssh protocol-version v2

# UNMS
set service unms connection 'wss://zhiqiang.uisp.com:443+rfvfxRFhpehdfXaaA2ZtrzF9BGA_bL4juvRundNAa20AAAAA+allowUntrustedCertificate'

# UPnP 保留
set service upnp2 listen-on switch0
set service upnp2 nat-pmp enable
set service upnp2 secure-mode enable
set service upnp2 wan pppoe0

# 系统配置
set system analytics-handler send-analytics-report false
set system crash-handler send-crash-report false
set system domain-name 'windy.me'
set system host-name 'gw'
set system login user ubnt authentication encrypted-password '$5$9KWfs5EFP4KMyg2o$Yo/k5.qqqwouiQmjREDv8ycdl0qe.2vCsO7wzXrpmT.'
set system login user ubnt authentication plaintext-password ''
set system login user ubnt full-name 'ubnt default user'
set system login user ubnt level admin
set system login user zhiqiang authentication encrypted-password '$5$L0plc3edYo79BfZU$iRzWJAYLFOL4ZiipVCxeIrVqOxpJlJxsqOTQhWURcH5'
set system login user zhiqiang level admin
set system ntp server 0.ubnt.pool.ntp.org
set system ntp server 1.ubnt.pool.ntp.org
set system ntp server 2.ubnt.pool.ntp.org
set system ntp server 3.ubnt.pool.ntp.org
set system offload hwnat enable
set system offload ipsec enable
set system syslog global facility all level notice
set system syslog global facility protocols level debug
set system time-zone Asia/Shanghai

提交并保存配置：
```
commit
save
exit
```
验证：
- eth0、eth1 接的设备应获取 192.168.55.x 地址，网关为 192.168.55.254
- eth2、eth3 接的设备应获取 192.168.66.x 地址，网关为 192.168.66.254
- 测试外网访问（IPv4、IPv6）
- 确认 UPnP 正常（适配支持 UPnP 的内网设备应该可以动态映射端口到外网）
- 确认防火墙与 NAT 正常工作

以上步骤确保在不需要端口转发配置的情况下，保留原有的 UPnP、外网 PPPoE、IPv6 防火墙、IPv4 防火墙、DHCP、DNS、DDNS、NTP、SSH、UNMS、GUI 等功能，满足你的最新要求。

ubnt new pass:

windyboy


set firewall name LAN_IN rule 30 action accept
set firewall name LAN_IN rule 30 description 'Allow 55 to 66'
set firewall name LAN_IN rule 30 source address 192.168.55.0/24
set firewall name LAN_IN rule 30 destination address 192.168.66.0/24

set firewall name LAN_IN rule 40 action accept
set firewall name LAN_IN rule 40 description 'Allow 66 to 55'
set firewall name LAN_IN rule 40 source address 192.168.66.0/24
set firewall name LAN_IN rule 40 destination address 192.168.55.0/24

set interfaces switch switch0 switch-port interface eth1 
set interfaces switch switch0 switch-port interface eth2 
set interfaces switch switch0 switch-port interface eth3

configure
set service nat rule 5020 description 'masquerade for LAN 55'
set service nat rule 5020 outbound-interface pppoe0
set service nat rule 5020 source address 192.168.55.0/24
set service nat rule 5020 type masquerade
commit
save

firewall {
    all-ping enable
    broadcast-ping disable
    ipv6-name WANv6_IN {
        default-action drop
        description "WAN inbound traffic forwarded to LAN"
        enable-default-log
        rule 10 {
            action accept
            description "Allow established/related sessions"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
    }
    ipv6-name WANv6_LOCAL {
        default-action drop
        description "WAN inbound traffic to the router"
        enable-default-log
        rule 10 {
            action accept
            description "Allow established/related sessions"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
        rule 30 {
            action accept
            description "Allow IPv6 icmp"
            protocol ipv6-icmp
        }
        rule 40 {
            action accept
            description "allow dhcpv6"
            destination {
                port 546
            }
            protocol udp
            source {
                port 547
            }
        }
    }
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    name LAN_IN {
        default-action drop
        rule 10 {
            action accept
            description "Allow established/related sessions"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid states"
            state {
                invalid enable
            }
        }
        rule 40 {
            action accept
            description "Allow 66 to 55"
            destination {
                address 192.168.55.0/24
            }
            source {
                address 192.168.66.0/24
            }
        }
    }
    name LAN_OUT {
        default-action drop
        rule 10 {
            action accept
            description "Allow internet access"
            destination {
                address 0.0.0.0/0
            }
        }
    }
    name WAN_IN {
        default-action drop
        description "WAN to internal"
        rule 10 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
    }
    name WAN_LOCAL {
        default-action drop
        description "WAN to router"
        rule 10 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
    }
    options {
        mss-clamp {
            mss 1412
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
}
interfaces {
    ethernet eth0 {
        address 192.168.66.254/24
        description "Local 2"
        duplex auto
        speed auto
    }
    ethernet eth1 {
        description Local
        duplex auto
        speed auto
    }
    ethernet eth2 {
        description Local
        duplex auto
        speed auto
    }
    ethernet eth3 {
        description Local
        duplex auto
        speed auto
    }
    ethernet eth4 {
        description "Internet (PPPoE)"
        duplex auto
        poe {
            output off
        }
        pppoe 0 {
            default-route auto
            dhcpv6-pd {
                pd 0 {
                    interface eth0 {
                        host-address ::1
                        prefix-id :1
                        service slaac
                    }
                    interface switch0 {
                        host-address ::1
                        prefix-id :2
                        service slaac
                    }
                    prefix-length /60
                }
                rapid-commit enable
            }
            firewall {
                in {
                    ipv6-name WANv6_IN
                    name WAN_IN
                }
                local {
                    ipv6-name WANv6_LOCAL
                    name WAN_LOCAL
                }
            }
            ipv6 {
                address {
                    autoconf
                }
                dup-addr-detect-transmits 1
                enable {
                }
            }
            mtu 1492
            name-server auto
            password ****************
            user-id 02004536188@163.gd
        }
        speed auto
    }
    loopback lo {
    }
    switch switch0 {
        address 192.168.55.254/24
        description Local
        mtu 1500
        switch-port {
            interface eth1 {
            }
            interface eth2 {
            }
            interface eth3 {
            }
        }
    }
}
port-forward {
    auto-firewall enable
    hairpin-nat enable
    lan-interface switch0
    lan-interface eth0
    rule 1 {
        description hass
        forward-to {
            address 192.168.55.200
            port 8123
        }
        original-port 8123
        protocol tcp_udp
    }
    rule 2 {
        description transmission
        forward-to {
            address 192.168.66.51
            port 51413
        }
        original-port 51413
        protocol tcp_udp
    }
    # FIX-01 (2026-08-07): 公网 SSH 端口转发已删除，改用 WireGuard 管理；原规则为 ssh 5822 → 192.168.66.32:22
    # rule 3 {
    #     description ssh
    #     forward-to {
    #         address 192.168.66.32
    #         port 22
    #     }
    #     original-port 5822
    #     protocol tcp_udp
    # }
    rule 4 {
        description openvpn
        forward-to {
            address 192.168.66.32
            port 1194
        }
        original-port 1194
        protocol tcp_udp
    }
    wan-interface pppoe0
}
service {
    dhcp-server {
        disabled false
        hostfile-update disable
        shared-network-name LAN1 {
            authoritative enable
            subnet 192.168.66.0/24 {
                default-router 192.168.66.254
                dns-server 192.168.66.36
                lease 86400
                start 192.168.66.38 {
                    stop 192.168.66.243
                }
                static-mapping gfw {
                    ip-address 192.168.66.1
                    mac-address 3e:b3:96:69:11:9c
                }
                static-mapping hp-nas {
                    ip-address 192.168.66.32
                    mac-address a0:1d:48:c7:77:a8
                }
                static-mapping pihole {
                    ip-address 192.168.66.36
                    mac-address ae:1d:5a:1e:77:8a
                }
                static-mapping pve {
                    ip-address 192.168.66.26
                    mac-address a8:b8:e0:00:6e:eb
                }
                static-mapping transmission {
                    ip-address 192.168.66.51
                    mac-address a2:1d:48:03:aa:47
                }
                static-mapping ubnt-6 {
                    ip-address 192.168.66.6
                    mac-address 78:45:58:4d:cc:30
                }
                static-mapping ubnt-app {
                    ip-address 192.168.66.46
                    mac-address c6:a4:3f:ef:e3:0c
                }
                static-mapping windy-pc {
                    ip-address 192.168.66.99
                    mac-address 04:7c:16:b8:f5:e9
                }
            }
        }
        shared-network-name LAN2 {
            authoritative enable
            subnet 192.168.55.0/24 {
                default-router 192.168.55.254
                dns-server 192.168.55.254
                lease 86400
                start 192.168.55.38 {
                    stop 192.168.55.243
                }
                static-mapping Aqara-Hub-M3-10CB {
                    ip-address 192.168.55.248
                    mac-address 18:c2:3c:45:61:e7
                }
                static-mapping SmartThings-Station {
                    ip-address 192.168.55.48
                    mac-address 2c:ba:ba:99:e5:2b
                }
                static-mapping espressif {
                    ip-address 192.168.55.47
                    mac-address a0:76:4e:38:6b:3c
                }
                static-mapping homeassistant {
                    ip-address 192.168.55.200
                    mac-address 5c:8a:ae:68:1e:dd
                }
                static-mapping midea_e3_0198 {
                    ip-address 192.168.55.42
                    mac-address b0:96:ea:c4:79:8c
                }
                static-mapping oneplus-12 {
                    ip-address 192.168.55.249
                    mac-address c2:23:b1:c3:4d:bf
                }
                static-mapping roborock-wm-a141 {
                    ip-address 192.168.55.43
                    mac-address b0:4a:39:ce:82:ef
                }
                static-mapping samsung-hub {
                    ip-address 192.168.55.251
                    mac-address c4:82:e1:b7:fa:ff
                }
                static-mapping unifi-ac {
                    ip-address 192.168.55.5
                    mac-address f0:9f:c2:20:04:e9
                }
                static-mapping zbgw7688 {
                    ip-address 192.168.55.60
                    mac-address 12:00:00:ab:d2:a9
                }
            }
        }
        static-arp disable
        use-dnsmasq disable
    }
    dns {
        forwarding {
            cache-size 150
            listen-on eth0
            listen-on switch0
        }
    }
    gui {
        http-port 80
        https-port 443
        older-ciphers enable
    }
    nat {
        rule 5010 {
            description "masquerade for WAN"
            log disable
            outbound-interface pppoe0
            protocol all
            type masquerade
        }
    }
    snmp {
        community myc {
            authorization ro
        }
        contact null
        location null
    }
    ssh {
        port 22
        protocol-version v2
    }
    unms {
        connection wss://zhiqiang.uisp.com:443+rfvfxRFhpehdfXaaA2ZtrzF9BGA_bL4juvRundNAa20AAAAA+allowUntrustedCertificate
    }
}
system {
    analytics-handler {
        send-analytics-report false
    }
    crash-handler {
        send-crash-report false
    }
    domain-name windy.me
    host-name gw
    login {
        user ubnt {
            authentication {
                encrypted-password ****************
                plaintext-password ****************
            }
            level admin
        }
        user zhiqiang {
            authentication {
                encrypted-password ****************
                plaintext-password ****************
            }
            full-name "zhiqiang feng"
            level admin
        }
    }
    ntp {
        server 0.ubnt.pool.ntp.org {
        }
        server 1.ubnt.pool.ntp.org {
        }
        server 2.ubnt.pool.ntp.org {
        }
        server 3.ubnt.pool.ntp.org {
        }
    }
    syslog {
        global {
            facility all {
                level notice
            }
            facility protocols {
                level debug
            }
        }
    }
    time-zone Asia/Shanghai
}

network update wlan0  --ipv4-gateway 192.168.55.254

network update wlan0 --ipv4-method auto --ipv6-method disabled

To set up an IGMP Proxy on your EdgeRouter X with two LANs, where one is on eth0 and the other is on switch0, while using PPPoE for the WAN connection, follow these detailed steps:

Step-by-Step Configuration

1. Access the EdgeRouter

Connect to your EdgeRouter X via SSH or through the web interface.

2. Configure the WAN Connection

Set up your WAN interface (usually eth0) for PPPoE. This can typically be done through the web interface or CLI:
```
configure
set interfaces ethernet eth0 pppoe  # Add your PPPoE settings here
commit; save
```

3. Configure IGMP Proxy

Enter configuration mode:
```
configure
```

Set Up Upstream and Downstream Interfaces:

For the WAN interface (assuming it is pppoe0):

set protocols igmp-proxy interface pppoe0 role upstream
set protocols igmp-proxy interface pppoe0 threshold 1
set protocols igmp-proxy interface pppoe0 alt-subnet 0.0.0.0/0

For the LAN interface on switch0:

set protocols igmp-proxy interface switch0 role downstream
set protocols igmp-proxy interface switch0 threshold 1
set protocols igmp-proxy interface switch0 alt-subnet 0.0.0.0/0

For the LAN interface on eth0

    set protocols igmp-proxy interface eth0 role downstream
   set protocols igmp-proxy interface eth0 threshold 1
   set protocols igmp-proxy interface eth0 alt-subnet 0.0.0.0/0

4. Commit and Save Changes

After configuring the IGMP proxy, commit and save your changes:
```
commit; save; exit
```

5. Verify Configuration

Check if the IGMP proxy is configured correctly:
```
show protocols igmp-proxy
```

Additional Considerations

Ensure IGMP Snooping is Enabled: If you are using a managed switch, make sure IGMP snooping is enabled to properly handle multicast traffic.
Firewall Rules: Ensure that your firewall rules allow IGMP traffic between the WAN and LAN interfaces.
Testing: After configuration, test your IPTV or multicast services to ensure they are functioning correctly.

This setup will allow your EdgeRouter X to manage multicast traffic effectively across both LANs while maintaining a stable WAN connection via PPPoE.

Citations: [1] https://superuser.com/questions/1184320/how-to-use-nginx-as-a-reverse-proxy-on-a-ubiquiti-router [2] https://community.odido.nl/thuisnetwerk-539/how-to-edgerouter-iptv-internet-342141 [3] https://help.ui.com/hc/en-us/articles/204961694-EdgeRouter-Web-Proxy [4] https://community.ui.com/questions/how-to-setup-a-proxy-server-on-my-router/13b39fe3-ac56-4400-8903-147e97564b8c [5] https://help.uisp.com/hc/en-us/articles/22591218897559-EdgeRouter-IGMP-Proxy [6] https://www.reddit.com/r/Ubiquiti/comments/9a42zg/edgerouter_x_gui_behind_nginx_reverse_proxy/ [7] https://github.com/TimoDJatomika/EdgeRouter-Stuff/blob/master/squidguard.md [8] https://serverfault.com/questions/813087/reverse-proxy-on-ubiquiti-edgerouter-poe

37 KiB Raw Permalink Blame History Unescape Escape