1039 lines
37 KiB
Markdown
1039 lines
37 KiB
Markdown
config:
|
||
```
|
||
set firewall all-ping enable
|
||
set firewall broadcast-ping disable
|
||
set firewall ipv6-name WANv6_IN default-action drop
|
||
set firewall ipv6-name WANv6_IN description 'WAN inbound traffic forwarded to LAN'
|
||
set firewall ipv6-name WANv6_IN enable-default-log
|
||
set firewall ipv6-name WANv6_IN rule 10 action accept
|
||
set firewall ipv6-name WANv6_IN rule 10 description 'Allow established/related sessions'
|
||
set firewall ipv6-name WANv6_IN rule 10 state established enable
|
||
set firewall ipv6-name WANv6_IN rule 10 state related enable
|
||
set firewall ipv6-name WANv6_IN rule 20 action drop
|
||
set firewall ipv6-name WANv6_IN rule 20 description 'Drop invalid state'
|
||
set firewall ipv6-name WANv6_IN rule 20 state invalid enable
|
||
set firewall ipv6-name WANv6_LOCAL default-action drop
|
||
set firewall ipv6-name WANv6_LOCAL description 'WAN inbound traffic to the router'
|
||
set firewall ipv6-name WANv6_LOCAL enable-default-log
|
||
set firewall ipv6-name WANv6_LOCAL rule 10 action accept
|
||
set firewall ipv6-name WANv6_LOCAL rule 10 description 'Allow established/related sessions'
|
||
set firewall ipv6-name WANv6_LOCAL rule 10 state established enable
|
||
set firewall ipv6-name WANv6_LOCAL rule 10 state related enable
|
||
set firewall ipv6-name WANv6_LOCAL rule 20 action drop
|
||
set firewall ipv6-name WANv6_LOCAL rule 20 description 'Drop invalid state'
|
||
set firewall ipv6-name WANv6_LOCAL rule 20 state invalid enable
|
||
set firewall ipv6-name WANv6_LOCAL rule 30 action accept
|
||
set firewall ipv6-name WANv6_LOCAL rule 30 description 'Allow IPv6 icmp'
|
||
set firewall ipv6-name WANv6_LOCAL rule 30 protocol ipv6-icmp
|
||
set firewall ipv6-name WANv6_LOCAL rule 40 action accept
|
||
set firewall ipv6-name WANv6_LOCAL rule 40 description 'allow dhcpv6'
|
||
set firewall ipv6-name WANv6_LOCAL rule 40 destination port 546
|
||
set firewall ipv6-name WANv6_LOCAL rule 40 protocol udp
|
||
set firewall ipv6-name WANv6_LOCAL rule 40 source port 547
|
||
set firewall ipv6-receive-redirects disable
|
||
set firewall ipv6-src-route disable
|
||
set firewall ip-src-route disable
|
||
set firewall log-martians enable
|
||
set firewall name WAN_IN default-action drop
|
||
set firewall name WAN_IN description 'WAN to internal'
|
||
set firewall name WAN_IN rule 10 action accept
|
||
set firewall name WAN_IN rule 10 description 'Allow established/related'
|
||
set firewall name WAN_IN rule 10 state established enable
|
||
set firewall name WAN_IN rule 10 state related enable
|
||
set firewall name WAN_IN rule 20 action drop
|
||
set firewall name WAN_IN rule 20 description 'Drop invalid state'
|
||
set firewall name WAN_IN rule 20 state invalid enable
|
||
set firewall name WAN_LOCAL default-action drop
|
||
set firewall name WAN_LOCAL description 'WAN to router'
|
||
set firewall name WAN_LOCAL rule 10 action accept
|
||
set firewall name WAN_LOCAL rule 10 description 'Allow established/related'
|
||
set firewall name WAN_LOCAL rule 10 state established enable
|
||
set firewall name WAN_LOCAL rule 10 state related enable
|
||
set firewall name WAN_LOCAL rule 20 action drop
|
||
set firewall name WAN_LOCAL rule 20 description 'Drop invalid state'
|
||
set firewall name WAN_LOCAL rule 20 state invalid enable
|
||
set firewall options mss-clamp mss 1412
|
||
set firewall receive-redirects disable
|
||
set firewall send-redirects enable
|
||
set firewall source-validation disable
|
||
set firewall syn-cookies enable
|
||
set interfaces ethernet eth0 description Local
|
||
set interfaces ethernet eth0 duplex auto
|
||
set interfaces ethernet eth0 speed auto
|
||
set interfaces ethernet eth1 description Local
|
||
set interfaces ethernet eth1 duplex auto
|
||
set interfaces ethernet eth1 speed auto
|
||
set interfaces ethernet eth2 description Local
|
||
set interfaces ethernet eth2 duplex auto
|
||
set interfaces ethernet eth2 speed auto
|
||
set interfaces ethernet eth3 description Local
|
||
set interfaces ethernet eth3 duplex auto
|
||
set interfaces ethernet eth3 speed auto
|
||
set interfaces ethernet eth4 description 'Internet (PPPoE)'
|
||
set interfaces ethernet eth4 duplex auto
|
||
set interfaces ethernet eth4 poe output off
|
||
set interfaces ethernet eth4 pppoe 0 default-route auto
|
||
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0 host-address '::1'
|
||
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0 prefix-id ':1'
|
||
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0 service slaac
|
||
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 prefix-length /60
|
||
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd rapid-commit enable
|
||
set interfaces ethernet eth4 pppoe 0 firewall in ipv6-name WANv6_IN
|
||
set interfaces ethernet eth4 pppoe 0 firewall in name WAN_IN
|
||
set interfaces ethernet eth4 pppoe 0 firewall local ipv6-name WANv6_LOCAL
|
||
set interfaces ethernet eth4 pppoe 0 firewall local name WAN_LOCAL
|
||
set interfaces ethernet eth4 pppoe 0 ipv6 address autoconf
|
||
set interfaces ethernet eth4 pppoe 0 ipv6 dup-addr-detect-transmits 1
|
||
set interfaces ethernet eth4 pppoe 0 ipv6 enable
|
||
set interfaces ethernet eth4 pppoe 0 mtu 1492
|
||
set interfaces ethernet eth4 pppoe 0 name-server auto
|
||
set interfaces ethernet eth4 pppoe 0 password 32867410
|
||
set interfaces ethernet eth4 pppoe 0 user-id 02004536188@163.gd
|
||
set interfaces ethernet eth4 speed auto
|
||
set interfaces loopback lo
|
||
set interfaces switch switch0 address 192.168.66.254/24
|
||
set interfaces switch switch0 description Local
|
||
set interfaces switch switch0 mtu 1500
|
||
set interfaces switch switch0 switch-port interface eth0
|
||
set interfaces switch switch0 switch-port interface eth1
|
||
set interfaces switch switch0 switch-port interface eth2
|
||
set interfaces switch switch0 switch-port interface eth3
|
||
set interfaces switch switch0 switch-port vlan-aware disable
|
||
set port-forward auto-firewall enable
|
||
set port-forward hairpin-nat enable
|
||
set port-forward lan-interface eth0
|
||
# FIX-01 (2026-08-07): 公网 SSH 端口转发已删除，改用 WireGuard 管理；原规则为 ssh 58222 → 192.168.66.32:22
|
||
# set port-forward rule 1 description ssh
|
||
# set port-forward rule 1 forward-to address 192.168.66.32
|
||
# set port-forward rule 1 forward-to port 22
|
||
# set port-forward rule 1 original-port 58222
|
||
# set port-forward rule 1 protocol tcp_udp
|
||
set port-forward rule 2 description trasmission
|
||
set port-forward rule 2 forward-to address 192.168.66.32
|
||
set port-forward rule 2 forward-to port 51413
|
||
set port-forward rule 2 original-port 51413
|
||
set port-forward rule 2 protocol tcp_udp
|
||
set port-forward wan-interface pppoe0
|
||
set service dhcp-server disabled false
|
||
set service dhcp-server hostfile-update disable
|
||
set service dhcp-server shared-network-name LAN authoritative enable
|
||
set service dhcp-server shared-network-name LAN disable
|
||
set service dhcp-server shared-network-name LAN subnet 192.168.66.0/24 default-router 192.168.66.254
|
||
set service dhcp-server shared-network-name LAN subnet 192.168.66.0/24 dns-server 192.168.66.254
|
||
set service dhcp-server shared-network-name LAN subnet 192.168.66.0/24 lease 86400
|
||
set service dhcp-server shared-network-name LAN subnet 192.168.66.0/24 start 192.168.66.38 stop 192.168.66.243
|
||
set service dhcp-server static-arp disable
|
||
set service dhcp-server use-dnsmasq disable
|
||
set service dns dynamic interface pppoe0 service custom-noip host-name windyboycn.ddns.net
|
||
set service dns dynamic interface pppoe0 service custom-noip login windyboy@gmail.com
|
||
set service dns dynamic interface pppoe0 service custom-noip password windyboycn.ddns.net
|
||
set service dns dynamic interface pppoe0 service custom-noip protocol noip
|
||
set service dns dynamic interface pppoe0 service custom-noip server noip.com
|
||
set service dns dynamic interface pppoe0 web dyndns
|
||
set service dns forwarding cache-size 150
|
||
set service dns forwarding listen-on switch0
|
||
set service gui http-port 80
|
||
set service gui https-port 443
|
||
set service gui older-ciphers enable
|
||
set service nat rule 5010 description 'masquerade for WAN'
|
||
set service nat rule 5010 outbound-interface pppoe0
|
||
set service nat rule 5010 type masquerade
|
||
set service ssh port 22
|
||
set service ssh protocol-version v2
|
||
set service unms connection 'wss://zhiqiang.uisp.com:443+rfvfxRFhpehdfXaaA2ZtrzF9BGA_bL4juvRundNAa20AAAAA+allowUntrustedCertificate'
|
||
set service upnp2 listen-on switch0
|
||
set service upnp2 nat-pmp enable
|
||
set service upnp2 secure-mode enable
|
||
set service upnp2 wan pppoe0
|
||
set system analytics-handler send-analytics-report false
|
||
set system crash-handler send-crash-report false
|
||
set system domain-name windy.me
|
||
set system host-name gw
|
||
set system login user ubnt authentication encrypted-password '$5$9KWfs5EFP4KMyg2o$Yo/k5.qqqwouiQmjREDv8ycdl0qe.2vCsO7wzXrpmT.'
|
||
set system login user ubnt authentication plaintext-password ''
|
||
set system login user ubnt full-name 'ubnt default user'
|
||
set system login user ubnt level admin
|
||
set system login user zhiqiang authentication encrypted-password '$5$L0plc3edYo79BfZU$iRzWJAYLFOL4ZiipVCxeIrVqOxpJlJxsqOTQhWURcH5'
|
||
set system login user zhiqiang level admin
|
||
set system ntp server 0.ubnt.pool.ntp.org
|
||
set system ntp server 1.ubnt.pool.ntp.org
|
||
set system ntp server 2.ubnt.pool.ntp.org
|
||
set system ntp server 3.ubnt.pool.ntp.org
|
||
set system offload hwnat enable
|
||
set system offload ipsec enable
|
||
set system syslog global facility all level notice
|
||
set system syslog global facility protocols level debug
|
||
set system time-zone Asia/Shanghai
|
||
|
||
```
|
||
|
||
|
||
|
||
new :
|
||
|
||
下面是更新后的配置脚本及详细执行步骤。在此版本中：
|
||
|
||
1. **端口转发已移除**：不再包含 `port-forward` 相关配置项。
|
||
2. **UPnP 保留**：仍有 UPnP 配置，以实现动态端口映射功能。
|
||
3. **网关 IP 依然为 .254**：内网 VLAN 网段的网关为 192.168.55.254 和 192.168.66.254。
|
||
4. 外网 PPPoE、IPv6 防火墙、IPv4 防火墙、NAT、DDNS、DNS、NTP、SSH、UNMS、UPnP、GUI 等保留原先配置。
|
||
|
||
请在执行 `reset configuration` 后，使用默认用户名密码 (`ubnt/ubnt`) 登录路由器，然后按照下方步骤执行配置脚本。
|
||
|
||
---
|
||
|
||
### 执行步骤
|
||
|
||
1. **重置配置（如有需要）**：
|
||
登录 CLI 后执行：
|
||
|
||
```bash
|
||
reset configuration
|
||
```
|
||
|
||
等待重置完成后路由器将恢复出厂默认。
|
||
|
||
2. **登录路由器**：
|
||
使用默认帐号登录：
|
||
|
||
- 用户名：`ubnt`
|
||
- 密码：`ubnt`
|
||
3. **进入配置模式**：
|
||
|
||
```bash
|
||
configure
|
||
```
|
||
|
||
4. **粘贴下方配置命令**（可一次性全部复制粘贴）：
|
||
|
||
```bash
|
||
# 基本防护与系统配置
|
||
set firewall all-ping enable
|
||
set firewall broadcast-ping disable
|
||
set firewall ipv6-receive-redirects disable
|
||
set firewall ipv6-src-route disable
|
||
set firewall ip-src-route disable
|
||
set firewall log-martians enable
|
||
set firewall options mss-clamp mss 1412
|
||
set firewall receive-redirects disable
|
||
set firewall send-redirects enable
|
||
set firewall source-validation disable
|
||
set firewall syn-cookies enable
|
||
|
||
# IPv6防火墙 - WANv6_IN
|
||
set firewall ipv6-name WANv6_IN default-action drop
|
||
set firewall ipv6-name WANv6_IN description 'WAN inbound traffic forwarded to LAN'
|
||
set firewall ipv6-name WANv6_IN enable-default-log
|
||
set firewall ipv6-name WANv6_IN rule 10 action accept
|
||
set firewall ipv6-name WANv6_IN rule 10 description 'Allow established/related sessions'
|
||
set firewall ipv6-name WANv6_IN rule 10 state established enable
|
||
set firewall ipv6-name WANv6_IN rule 10 state related enable
|
||
set firewall ipv6-name WANv6_IN rule 20 action drop
|
||
set firewall ipv6-name WANv6_IN rule 20 description 'Drop invalid state'
|
||
set firewall ipv6-name WANv6_IN rule 20 state invalid enable
|
||
|
||
# IPv6防火墙 - WANv6_LOCAL
|
||
set firewall ipv6-name WANv6_LOCAL default-action drop
|
||
set firewall ipv6-name WANv6_LOCAL description 'WAN inbound traffic to the router'
|
||
set firewall ipv6-name WANv6_LOCAL enable-default-log
|
||
set firewall ipv6-name WANv6_LOCAL rule 10 action accept
|
||
set firewall ipv6-name WANv6_LOCAL rule 10 description 'Allow established/related sessions'
|
||
set firewall ipv6-name WANv6_LOCAL rule 10 state established enable
|
||
set firewall ipv6-name WANv6_LOCAL rule 10 state related enable
|
||
set firewall ipv6-name WANv6_LOCAL rule 20 action drop
|
||
set firewall ipv6-name WANv6_LOCAL rule 20 description 'Drop invalid state'
|
||
set firewall ipv6-name WANv6_LOCAL rule 20 state invalid enable
|
||
set firewall ipv6-name WANv6_LOCAL rule 30 action accept
|
||
set firewall ipv6-name WANv6_LOCAL rule 30 description 'Allow IPv6 icmp'
|
||
set firewall ipv6-name WANv6_LOCAL rule 30 protocol ipv6-icmp
|
||
set firewall ipv6-name WANv6_LOCAL rule 40 action accept
|
||
set firewall ipv6-name WANv6_LOCAL rule 40 description 'allow dhcpv6'
|
||
set firewall ipv6-name WANv6_LOCAL rule 40 destination port 546
|
||
set firewall ipv6-name WANv6_LOCAL rule 40 protocol udp
|
||
set firewall ipv6-name WANv6_LOCAL rule 40 source port 547
|
||
|
||
# IPv4防火墙 - WAN_IN
|
||
set firewall name WAN_IN default-action drop
|
||
set firewall name WAN_IN description 'WAN to internal'
|
||
set firewall name WAN_IN rule 10 action accept
|
||
set firewall name WAN_IN rule 10 description 'Allow established/related'
|
||
set firewall name WAN_IN rule 10 state established enable
|
||
set firewall name WAN_IN rule 10 state related enable
|
||
set firewall name WAN_IN rule 20 action drop
|
||
set firewall name WAN_IN rule 20 description 'Drop invalid state'
|
||
set firewall name WAN_IN rule 20 state invalid enable
|
||
|
||
# IPv4防火墙 - WAN_LOCAL
|
||
set firewall name WAN_LOCAL default-action drop
|
||
set firewall name WAN_LOCAL description 'WAN to router'
|
||
set firewall name WAN_LOCAL rule 10 action accept
|
||
set firewall name WAN_LOCAL rule 10 description 'Allow established/related'
|
||
set firewall name WAN_LOCAL rule 10 state established enable
|
||
set firewall name WAN_LOCAL rule 10 state related enable
|
||
set firewall name WAN_LOCAL rule 20 action drop
|
||
set firewall name WAN_LOCAL rule 20 description 'Drop invalid state'
|
||
set firewall name WAN_LOCAL rule 20 state invalid enable
|
||
|
||
# 接口设置
|
||
set interfaces ethernet eth0 description Local
|
||
set interfaces ethernet eth0 duplex auto
|
||
set interfaces ethernet eth0 speed auto
|
||
set interfaces ethernet eth1 description Local
|
||
set interfaces ethernet eth1 duplex auto
|
||
set interfaces ethernet eth1 speed auto
|
||
set interfaces ethernet eth2 description Local
|
||
set interfaces ethernet eth2 duplex auto
|
||
set interfaces ethernet eth2 speed auto
|
||
set interfaces ethernet eth3 description Local
|
||
set interfaces ethernet eth3 duplex auto
|
||
set interfaces ethernet eth3 speed auto
|
||
set interfaces ethernet eth4 description 'Internet (PPPoE)'
|
||
set interfaces ethernet eth4 duplex auto
|
||
set interfaces ethernet eth4 poe output off
|
||
set interfaces ethernet eth4 speed auto
|
||
|
||
# PPPoE配置
|
||
set interfaces ethernet eth4 pppoe 0 user-id '02004536188@163.gd'
|
||
set interfaces ethernet eth4 pppoe 0 password '32867410'
|
||
set interfaces ethernet eth4 pppoe 0 default-route auto
|
||
set interfaces ethernet eth4 pppoe 0 mtu 1492
|
||
set interfaces ethernet eth4 pppoe 0 name-server auto
|
||
set interfaces ethernet eth4 pppoe 0 ipv6 enable
|
||
set interfaces ethernet eth4 pppoe 0 ipv6 address autoconf
|
||
set interfaces ethernet eth4 pppoe 0 ipv6 dup-addr-detect-transmits 1
|
||
set interfaces ethernet eth4 pppoe 0 firewall in ipv6-name WANv6_IN
|
||
set interfaces ethernet eth4 pppoe 0 firewall in name WAN_IN
|
||
set interfaces ethernet eth4 pppoe 0 firewall local ipv6-name WANv6_LOCAL
|
||
set interfaces ethernet eth4 pppoe 0 firewall local name WAN_LOCAL
|
||
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd prefix-length /60
|
||
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd rapid-commit enable
|
||
|
||
# 内网交换机 VLAN 配置
|
||
set interfaces switch switch0 description 'Local Switch'
|
||
set interfaces switch switch0 mtu 1500
|
||
#set interfaces switch switch0 vlan-aware enable
|
||
# VLAN 55: eth0, eth1
|
||
set interfaces switch switch0 switch-port interface eth0 vlan pvid 55
|
||
set interfaces switch switch0 switch-port interface eth1 vlan pvid 55
|
||
# VLAN 66: eth2, eth3
|
||
set interfaces switch switch0 switch-port interface eth2 vlan pvid 66
|
||
set interfaces switch switch0 switch-port interface eth3 vlan pvid 66
|
||
|
||
# VLAN子接口，并使用.254作为网关
|
||
set interfaces switch switch0 vif 55 address 192.168.55.254/24
|
||
set interfaces switch switch0 vif 55 description 'LAN1 - 192.168.55.0/24'
|
||
set interfaces switch switch0 vif 66 address 192.168.66.254/24
|
||
set interfaces switch switch0 vif 66 description 'LAN2 - 192.168.66.0/24'
|
||
|
||
# IPv6前缀分配到VLAN子接口
|
||
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0.55 prefix-id ':1'
|
||
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0.55 service slaac
|
||
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0.66 prefix-id ':2'
|
||
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0.66 service slaac
|
||
|
||
# NAT 配置
|
||
set service nat rule 5010 description 'masquerade for WAN'
|
||
set service nat rule 5010 outbound-interface pppoe0
|
||
set service nat rule 5010 type masquerade
|
||
|
||
# DHCP 服务，网关和DNS服务器为 .254
|
||
set service dhcp-server disabled false
|
||
set service dhcp-server hostfile-update disable
|
||
|
||
# VLAN55 DHCP
|
||
set service dhcp-server shared-network-name LAN55 authoritative enable
|
||
set service dhcp-server shared-network-name LAN55 subnet 192.168.55.0/24 default-router 192.168.55.254
|
||
set service dhcp-server shared-network-name LAN55 subnet 192.168.55.0/24 dns-server 192.168.66.36
|
||
set service dhcp-server shared-network-name LAN55 subnet 192.168.55.0/24 lease 86400
|
||
set service dhcp-server shared-network-name LAN55 subnet 192.168.55.0/24 start 192.168.55.100 stop 192.168.55.200
|
||
|
||
# VLAN66 DHCP
|
||
set service dhcp-server shared-network-name LAN66 authoritative enable
|
||
set service dhcp-server shared-network-name LAN66 subnet 192.168.66.0/24 default-router 192.168.66.254
|
||
set service dhcp-server shared-network-name LAN66 subnet 192.168.66.0/24 dns-server 192.168.66.36
|
||
set service dhcp-server shared-network-name LAN66 subnet 192.168.66.0/24 lease 86400
|
||
set service dhcp-server shared-network-name LAN66 subnet 192.168.66.0/24 start 192.168.66.100 stop 192.168.66.200
|
||
|
||
set service dhcp-server static-arp disable
|
||
set service dhcp-server use-dnsmasq disable
|
||
|
||
# DDNS 配置
|
||
set service dns dynamic interface pppoe0 service custom-noip host-name 'windyboycn.ddns.net'
|
||
set service dns dynamic interface pppoe0 service custom-noip login 'windyboy@gmail.com'
|
||
set service dns dynamic interface pppoe0 service custom-noip password 'windyboycn.ddns.net'
|
||
set service dns dynamic interface pppoe0 service custom-noip protocol noip
|
||
set service dns dynamic interface pppoe0 service custom-noip server noip.com
|
||
set service dns dynamic interface pppoe0 web dyndns
|
||
|
||
# DNS 转发
|
||
set service dns forwarding cache-size 150
|
||
set service dns forwarding listen-on switch0
|
||
|
||
# GUI
|
||
set service gui http-port 80
|
||
set service gui https-port 443
|
||
set service gui older-ciphers enable
|
||
|
||
# 移除端口转发相关配置（无 port-forward 相关命令）
|
||
|
||
# SSH
|
||
set service ssh port 22
|
||
set service ssh protocol-version v2
|
||
|
||
# UNMS
|
||
set service unms connection 'wss://zhiqiang.uisp.com:443+rfvfxRFhpehdfXaaA2ZtrzF9BGA_bL4juvRundNAa20AAAAA+allowUntrustedCertificate'
|
||
|
||
# UPnP 保留
|
||
set service upnp2 listen-on switch0
|
||
set service upnp2 nat-pmp enable
|
||
set service upnp2 secure-mode enable
|
||
set service upnp2 wan pppoe0
|
||
|
||
# 系统配置
|
||
set system analytics-handler send-analytics-report false
|
||
set system crash-handler send-crash-report false
|
||
set system domain-name 'windy.me'
|
||
set system host-name 'gw'
|
||
set system login user ubnt authentication encrypted-password '$5$9KWfs5EFP4KMyg2o$Yo/k5.qqqwouiQmjREDv8ycdl0qe.2vCsO7wzXrpmT.'
|
||
set system login user ubnt authentication plaintext-password ''
|
||
set system login user ubnt full-name 'ubnt default user'
|
||
set system login user ubnt level admin
|
||
set system login user zhiqiang authentication encrypted-password '$5$L0plc3edYo79BfZU$iRzWJAYLFOL4ZiipVCxeIrVqOxpJlJxsqOTQhWURcH5'
|
||
set system login user zhiqiang level admin
|
||
set system ntp server 0.ubnt.pool.ntp.org
|
||
set system ntp server 1.ubnt.pool.ntp.org
|
||
set system ntp server 2.ubnt.pool.ntp.org
|
||
set system ntp server 3.ubnt.pool.ntp.org
|
||
set system offload hwnat enable
|
||
set system offload ipsec enable
|
||
set system syslog global facility all level notice
|
||
set system syslog global facility protocols level debug
|
||
set system time-zone Asia/Shanghai
|
||
|
||
```
|
||
|
||
|
||
5. **提交并保存配置**：
|
||
|
||
```bash
|
||
commit
|
||
save
|
||
exit
|
||
```
|
||
|
||
6. **验证**：
|
||
|
||
- `eth0`、`eth1` 接的设备应获取 `192.168.55.x` 地址，网关为 `192.168.55.254`
|
||
- `eth2`、`eth3` 接的设备应获取 `192.168.66.x` 地址，网关为 `192.168.66.254`
|
||
- 测试外网访问（IPv4、IPv6）
|
||
- 确认 UPnP 正常（适配支持 UPnP 的内网设备应该可以动态映射端口到外网）
|
||
- 确认防火墙与 NAT 正常工作
|
||
|
||
---
|
||
|
||
以上步骤确保在不需要端口转发配置的情况下，保留原有的 UPnP、外网 PPPoE、IPv6 防火墙、IPv4 防火墙、DHCP、DNS、DDNS、NTP、SSH、UNMS、GUI 等功能，满足你的最新要求。
|
||
|
||
|
||
ubnt
|
||
new pass:
|
||
```
|
||
windyboy
|
||
```
|
||
|
||
```
|
||
|
||
set firewall name LAN_IN rule 30 action accept
|
||
set firewall name LAN_IN rule 30 description 'Allow 55 to 66'
|
||
set firewall name LAN_IN rule 30 source address 192.168.55.0/24
|
||
set firewall name LAN_IN rule 30 destination address 192.168.66.0/24
|
||
```
|
||
|
||
|
||
```
|
||
set firewall name LAN_IN rule 40 action accept
|
||
set firewall name LAN_IN rule 40 description 'Allow 66 to 55'
|
||
set firewall name LAN_IN rule 40 source address 192.168.66.0/24
|
||
set firewall name LAN_IN rule 40 destination address 192.168.55.0/24
|
||
```
|
||
|
||
|
||
|
||
```
|
||
set interfaces switch switch0 switch-port interface eth1
|
||
set interfaces switch switch0 switch-port interface eth2
|
||
set interfaces switch switch0 switch-port interface eth3
|
||
```
|
||
|
||
```
|
||
configure
|
||
set service nat rule 5020 description 'masquerade for LAN 55'
|
||
set service nat rule 5020 outbound-interface pppoe0
|
||
set service nat rule 5020 source address 192.168.55.0/24
|
||
set service nat rule 5020 type masquerade
|
||
commit
|
||
save
|
||
```
|
||
|
||
|
||
|
||
```
|
||
firewall {
|
||
all-ping enable
|
||
broadcast-ping disable
|
||
ipv6-name WANv6_IN {
|
||
default-action drop
|
||
description "WAN inbound traffic forwarded to LAN"
|
||
enable-default-log
|
||
rule 10 {
|
||
action accept
|
||
description "Allow established/related sessions"
|
||
state {
|
||
established enable
|
||
related enable
|
||
}
|
||
}
|
||
rule 20 {
|
||
action drop
|
||
description "Drop invalid state"
|
||
state {
|
||
invalid enable
|
||
}
|
||
}
|
||
}
|
||
ipv6-name WANv6_LOCAL {
|
||
default-action drop
|
||
description "WAN inbound traffic to the router"
|
||
enable-default-log
|
||
rule 10 {
|
||
action accept
|
||
description "Allow established/related sessions"
|
||
state {
|
||
established enable
|
||
related enable
|
||
}
|
||
}
|
||
rule 20 {
|
||
action drop
|
||
description "Drop invalid state"
|
||
state {
|
||
invalid enable
|
||
}
|
||
}
|
||
rule 30 {
|
||
action accept
|
||
description "Allow IPv6 icmp"
|
||
protocol ipv6-icmp
|
||
}
|
||
rule 40 {
|
||
action accept
|
||
description "allow dhcpv6"
|
||
destination {
|
||
port 546
|
||
}
|
||
protocol udp
|
||
source {
|
||
port 547
|
||
}
|
||
}
|
||
}
|
||
ipv6-receive-redirects disable
|
||
ipv6-src-route disable
|
||
ip-src-route disable
|
||
log-martians enable
|
||
name LAN_IN {
|
||
default-action drop
|
||
rule 10 {
|
||
action accept
|
||
description "Allow established/related sessions"
|
||
state {
|
||
established enable
|
||
related enable
|
||
}
|
||
}
|
||
rule 20 {
|
||
action drop
|
||
description "Drop invalid states"
|
||
state {
|
||
invalid enable
|
||
}
|
||
}
|
||
rule 40 {
|
||
action accept
|
||
description "Allow 66 to 55"
|
||
destination {
|
||
address 192.168.55.0/24
|
||
}
|
||
source {
|
||
address 192.168.66.0/24
|
||
}
|
||
}
|
||
}
|
||
name LAN_OUT {
|
||
default-action drop
|
||
rule 10 {
|
||
action accept
|
||
description "Allow internet access"
|
||
destination {
|
||
address 0.0.0.0/0
|
||
}
|
||
}
|
||
}
|
||
name WAN_IN {
|
||
default-action drop
|
||
description "WAN to internal"
|
||
rule 10 {
|
||
action accept
|
||
description "Allow established/related"
|
||
state {
|
||
established enable
|
||
related enable
|
||
}
|
||
}
|
||
rule 20 {
|
||
action drop
|
||
description "Drop invalid state"
|
||
state {
|
||
invalid enable
|
||
}
|
||
}
|
||
}
|
||
name WAN_LOCAL {
|
||
default-action drop
|
||
description "WAN to router"
|
||
rule 10 {
|
||
action accept
|
||
description "Allow established/related"
|
||
state {
|
||
established enable
|
||
related enable
|
||
}
|
||
}
|
||
rule 20 {
|
||
action drop
|
||
description "Drop invalid state"
|
||
state {
|
||
invalid enable
|
||
}
|
||
}
|
||
}
|
||
options {
|
||
mss-clamp {
|
||
mss 1412
|
||
}
|
||
}
|
||
receive-redirects disable
|
||
send-redirects enable
|
||
source-validation disable
|
||
syn-cookies enable
|
||
}
|
||
interfaces {
|
||
ethernet eth0 {
|
||
address 192.168.66.254/24
|
||
description "Local 2"
|
||
duplex auto
|
||
speed auto
|
||
}
|
||
ethernet eth1 {
|
||
description Local
|
||
duplex auto
|
||
speed auto
|
||
}
|
||
ethernet eth2 {
|
||
description Local
|
||
duplex auto
|
||
speed auto
|
||
}
|
||
ethernet eth3 {
|
||
description Local
|
||
duplex auto
|
||
speed auto
|
||
}
|
||
ethernet eth4 {
|
||
description "Internet (PPPoE)"
|
||
duplex auto
|
||
poe {
|
||
output off
|
||
}
|
||
pppoe 0 {
|
||
default-route auto
|
||
dhcpv6-pd {
|
||
pd 0 {
|
||
interface eth0 {
|
||
host-address ::1
|
||
prefix-id :1
|
||
service slaac
|
||
}
|
||
interface switch0 {
|
||
host-address ::1
|
||
prefix-id :2
|
||
service slaac
|
||
}
|
||
prefix-length /60
|
||
}
|
||
rapid-commit enable
|
||
}
|
||
firewall {
|
||
in {
|
||
ipv6-name WANv6_IN
|
||
name WAN_IN
|
||
}
|
||
local {
|
||
ipv6-name WANv6_LOCAL
|
||
name WAN_LOCAL
|
||
}
|
||
}
|
||
ipv6 {
|
||
address {
|
||
autoconf
|
||
}
|
||
dup-addr-detect-transmits 1
|
||
enable {
|
||
}
|
||
}
|
||
mtu 1492
|
||
name-server auto
|
||
password ****************
|
||
user-id 02004536188@163.gd
|
||
}
|
||
speed auto
|
||
}
|
||
loopback lo {
|
||
}
|
||
switch switch0 {
|
||
address 192.168.55.254/24
|
||
description Local
|
||
mtu 1500
|
||
switch-port {
|
||
interface eth1 {
|
||
}
|
||
interface eth2 {
|
||
}
|
||
interface eth3 {
|
||
}
|
||
}
|
||
}
|
||
}
|
||
port-forward {
|
||
auto-firewall enable
|
||
hairpin-nat enable
|
||
lan-interface switch0
|
||
lan-interface eth0
|
||
rule 1 {
|
||
description hass
|
||
forward-to {
|
||
address 192.168.55.200
|
||
port 8123
|
||
}
|
||
original-port 8123
|
||
protocol tcp_udp
|
||
}
|
||
rule 2 {
|
||
description transmission
|
||
forward-to {
|
||
address 192.168.66.51
|
||
port 51413
|
||
}
|
||
original-port 51413
|
||
protocol tcp_udp
|
||
}
|
||
# FIX-01 (2026-08-07): 公网 SSH 端口转发已删除，改用 WireGuard 管理；原规则为 ssh 5822 → 192.168.66.32:22
|
||
# rule 3 {
|
||
# description ssh
|
||
# forward-to {
|
||
# address 192.168.66.32
|
||
# port 22
|
||
# }
|
||
# original-port 5822
|
||
# protocol tcp_udp
|
||
# }
|
||
rule 4 {
|
||
description openvpn
|
||
forward-to {
|
||
address 192.168.66.32
|
||
port 1194
|
||
}
|
||
original-port 1194
|
||
protocol tcp_udp
|
||
}
|
||
wan-interface pppoe0
|
||
}
|
||
service {
|
||
dhcp-server {
|
||
disabled false
|
||
hostfile-update disable
|
||
shared-network-name LAN1 {
|
||
authoritative enable
|
||
subnet 192.168.66.0/24 {
|
||
default-router 192.168.66.254
|
||
dns-server 192.168.66.36
|
||
lease 86400
|
||
start 192.168.66.38 {
|
||
stop 192.168.66.243
|
||
}
|
||
static-mapping gfw {
|
||
ip-address 192.168.66.1
|
||
mac-address 3e:b3:96:69:11:9c
|
||
}
|
||
static-mapping hp-nas {
|
||
ip-address 192.168.66.32
|
||
mac-address a0:1d:48:c7:77:a8
|
||
}
|
||
static-mapping pihole {
|
||
ip-address 192.168.66.36
|
||
mac-address ae:1d:5a:1e:77:8a
|
||
}
|
||
static-mapping pve {
|
||
ip-address 192.168.66.26
|
||
mac-address a8:b8:e0:00:6e:eb
|
||
}
|
||
static-mapping transmission {
|
||
ip-address 192.168.66.51
|
||
mac-address a2:1d:48:03:aa:47
|
||
}
|
||
static-mapping ubnt-6 {
|
||
ip-address 192.168.66.6
|
||
mac-address 78:45:58:4d:cc:30
|
||
}
|
||
static-mapping ubnt-app {
|
||
ip-address 192.168.66.46
|
||
mac-address c6:a4:3f:ef:e3:0c
|
||
}
|
||
static-mapping windy-pc {
|
||
ip-address 192.168.66.99
|
||
mac-address 04:7c:16:b8:f5:e9
|
||
}
|
||
}
|
||
}
|
||
shared-network-name LAN2 {
|
||
authoritative enable
|
||
subnet 192.168.55.0/24 {
|
||
default-router 192.168.55.254
|
||
dns-server 192.168.55.254
|
||
lease 86400
|
||
start 192.168.55.38 {
|
||
stop 192.168.55.243
|
||
}
|
||
static-mapping Aqara-Hub-M3-10CB {
|
||
ip-address 192.168.55.248
|
||
mac-address 18:c2:3c:45:61:e7
|
||
}
|
||
static-mapping SmartThings-Station {
|
||
ip-address 192.168.55.48
|
||
mac-address 2c:ba:ba:99:e5:2b
|
||
}
|
||
static-mapping espressif {
|
||
ip-address 192.168.55.47
|
||
mac-address a0:76:4e:38:6b:3c
|
||
}
|
||
static-mapping homeassistant {
|
||
ip-address 192.168.55.200
|
||
mac-address 5c:8a:ae:68:1e:dd
|
||
}
|
||
static-mapping midea_e3_0198 {
|
||
ip-address 192.168.55.42
|
||
mac-address b0:96:ea:c4:79:8c
|
||
}
|
||
static-mapping oneplus-12 {
|
||
ip-address 192.168.55.249
|
||
mac-address c2:23:b1:c3:4d:bf
|
||
}
|
||
static-mapping roborock-wm-a141 {
|
||
ip-address 192.168.55.43
|
||
mac-address b0:4a:39:ce:82:ef
|
||
}
|
||
static-mapping samsung-hub {
|
||
ip-address 192.168.55.251
|
||
mac-address c4:82:e1:b7:fa:ff
|
||
}
|
||
static-mapping unifi-ac {
|
||
ip-address 192.168.55.5
|
||
mac-address f0:9f:c2:20:04:e9
|
||
}
|
||
static-mapping zbgw7688 {
|
||
ip-address 192.168.55.60
|
||
mac-address 12:00:00:ab:d2:a9
|
||
}
|
||
}
|
||
}
|
||
static-arp disable
|
||
use-dnsmasq disable
|
||
}
|
||
dns {
|
||
forwarding {
|
||
cache-size 150
|
||
listen-on eth0
|
||
listen-on switch0
|
||
}
|
||
}
|
||
gui {
|
||
http-port 80
|
||
https-port 443
|
||
older-ciphers enable
|
||
}
|
||
nat {
|
||
rule 5010 {
|
||
description "masquerade for WAN"
|
||
log disable
|
||
outbound-interface pppoe0
|
||
protocol all
|
||
type masquerade
|
||
}
|
||
}
|
||
snmp {
|
||
community myc {
|
||
authorization ro
|
||
}
|
||
contact null
|
||
location null
|
||
}
|
||
ssh {
|
||
port 22
|
||
protocol-version v2
|
||
}
|
||
unms {
|
||
connection wss://zhiqiang.uisp.com:443+rfvfxRFhpehdfXaaA2ZtrzF9BGA_bL4juvRundNAa20AAAAA+allowUntrustedCertificate
|
||
}
|
||
}
|
||
system {
|
||
analytics-handler {
|
||
send-analytics-report false
|
||
}
|
||
crash-handler {
|
||
send-crash-report false
|
||
}
|
||
domain-name windy.me
|
||
host-name gw
|
||
login {
|
||
user ubnt {
|
||
authentication {
|
||
encrypted-password ****************
|
||
plaintext-password ****************
|
||
}
|
||
level admin
|
||
}
|
||
user zhiqiang {
|
||
authentication {
|
||
encrypted-password ****************
|
||
plaintext-password ****************
|
||
}
|
||
full-name "zhiqiang feng"
|
||
level admin
|
||
}
|
||
}
|
||
ntp {
|
||
server 0.ubnt.pool.ntp.org {
|
||
}
|
||
server 1.ubnt.pool.ntp.org {
|
||
}
|
||
server 2.ubnt.pool.ntp.org {
|
||
}
|
||
server 3.ubnt.pool.ntp.org {
|
||
}
|
||
}
|
||
syslog {
|
||
global {
|
||
facility all {
|
||
level notice
|
||
}
|
||
facility protocols {
|
||
level debug
|
||
}
|
||
}
|
||
}
|
||
time-zone Asia/Shanghai
|
||
}
|
||
|
||
```
|
||
|
||
|
||
```
|
||
network update wlan0 --ipv4-gateway 192.168.55.254
|
||
```
|
||
|
||
|
||
|
||
```
|
||
network update wlan0 --ipv4-method auto --ipv6-method disabled
|
||
```
|
||
|
||
|
||
To set up an **IGMP Proxy** on your EdgeRouter X with two LANs, where one is on `eth0` and the other is on `switch0`, while using PPPoE for the WAN connection, follow these detailed steps:
|
||
|
||
## Step-by-Step Configuration
|
||
|
||
### 1. Access the EdgeRouter
|
||
|
||
- Connect to your EdgeRouter X via SSH or through the web interface.
|
||
|
||
### 2. Configure the WAN Connection
|
||
|
||
- Set up your WAN interface (usually `eth0`) for PPPoE. This can typically be done through the web interface or CLI:
|
||
```bash
|
||
configure
|
||
set interfaces ethernet eth0 pppoe # Add your PPPoE settings here
|
||
commit; save
|
||
```
|
||
|
||
### 3. Configure IGMP Proxy
|
||
|
||
- Enter configuration mode:
|
||
```bash
|
||
configure
|
||
```
|
||
|
||
- **Set Up Upstream and Downstream Interfaces**:
|
||
- For the WAN interface (assuming it is `pppoe0`):
|
||
```bash
|
||
set protocols igmp-proxy interface pppoe0 role upstream
|
||
set protocols igmp-proxy interface pppoe0 threshold 1
|
||
set protocols igmp-proxy interface pppoe0 alt-subnet 0.0.0.0/0
|
||
```
|
||
|
||
|
||
- For the LAN interface on `switch0`:
|
||
|
||
```bash
|
||
set protocols igmp-proxy interface switch0 role downstream
|
||
set protocols igmp-proxy interface switch0 threshold 1
|
||
set protocols igmp-proxy interface switch0 alt-subnet 0.0.0.0/0
|
||
```
|
||
- For the LAN interface on eth0
|
||
```shell
|
||
set protocols igmp-proxy interface eth0 role downstream
|
||
set protocols igmp-proxy interface eth0 threshold 1
|
||
set protocols igmp-proxy interface eth0 alt-subnet 0.0.0.0/0
|
||
```
|
||
|
||
### 4. Commit and Save Changes
|
||
|
||
- After configuring the IGMP proxy, commit and save your changes:
|
||
```bash
|
||
commit; save; exit
|
||
```
|
||
|
||
### 5. Verify Configuration
|
||
|
||
- Check if the IGMP proxy is configured correctly:
|
||
```bash
|
||
show protocols igmp-proxy
|
||
```
|
||
|
||
### Additional Considerations
|
||
|
||
- **Ensure IGMP Snooping is Enabled**: If you are using a managed switch, make sure IGMP snooping is enabled to properly handle multicast traffic.
|
||
|
||
- **Firewall Rules**: Ensure that your firewall rules allow IGMP traffic between the WAN and LAN interfaces.
|
||
|
||
- **Testing**: After configuration, test your IPTV or multicast services to ensure they are functioning correctly.
|
||
|
||
This setup will allow your EdgeRouter X to manage multicast traffic effectively across both LANs while maintaining a stable WAN connection via PPPoE.
|
||
|
||
Citations:
|
||
[1] https://superuser.com/questions/1184320/how-to-use-nginx-as-a-reverse-proxy-on-a-ubiquiti-router
|
||
[2] https://community.odido.nl/thuisnetwerk-539/how-to-edgerouter-iptv-internet-342141
|
||
[3] https://help.ui.com/hc/en-us/articles/204961694-EdgeRouter-Web-Proxy
|
||
[4] https://community.ui.com/questions/how-to-setup-a-proxy-server-on-my-router/13b39fe3-ac56-4400-8903-147e97564b8c
|
||
[5] https://help.uisp.com/hc/en-us/articles/22591218897559-EdgeRouter-IGMP-Proxy
|
||
[6] https://www.reddit.com/r/Ubiquiti/comments/9a42zg/edgerouter_x_gui_behind_nginx_reverse_proxy/
|
||
[7] https://github.com/TimoDJatomika/EdgeRouter-Stuff/blob/master/squidguard.md
|
||
[8] https://serverfault.com/questions/813087/reverse-proxy-on-ubiquiti-edgerouter-poe |