firewall {
    all-ping enable
    broadcast-ping disable
    group {
        port-group Emule {
            description "Emule Port"
            port 4662
            port 4672
        }
        port-group Exchange {
            description "Exchange port"
            port 80
            port 443
            port 25
        }
        port-group FTP_Video {
            description "FTP Video Port"
            port 21
            port 20
        }
        port-group SIP {
            description "SIP Port"
            port 5060
            port 5061
            port 123
            port 514
            port 1194
            port 3386
            port 3480
            port 110
            port 53
            port 443
        }
        port-group Torrent {
            description "Torrent Port"
            port 16881
            port 6881
        }
    }
    ipv6-name WANv6_IN {
        default-action drop
        description "WANv6 inbound traffic forwarded to LAN"
        rule 10 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
        rule 30 {
            action accept
            description "Allow ICMPv6"
            protocol icmpv6
        }
    }
    ipv6-name WANv6_LOCAL {
        default-action drop
        description "WANv6 inbound traffic to the router"
        rule 10 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
        rule 30 {
            action accept
            description "Allow ICMPv6"
            protocol icmpv6
        }
        rule 40 {
            action accept
            description "Allow DHCPv6 Client/server"
            destination {
                port 546
            }
            protocol udp
            source {
                port 547
            }
        }
        rule 50 {
            action accept
            description "Allow DHCPv6 Relaying"
            destination {
                port 547
            }
            protocol udp
            source {
                port 547
            }
        }
    }
    ipv6-name WANv6_OUT {
        default-action accept
        description "WANv6 outbound traffic"
    }
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    name WAN_IN {
        default-action drop
        description "packets from Internet to LAN"
        enable-default-log
        rule 10 {
            action accept
            description "Allow established sessions"
            log disable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related disable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            log disable
            protocol all
            state {
                established disable
                invalid enable
                new disable
                related disable
            }
        }
    }
    name WAN_LOCAL {
        default-action drop
        description "packets from Internet to the router"
        rule 10 {
            action accept
            description "Allow established/related"
            log disable
            protocol all
            state {
                established enable
                invalid enable
                new disable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            log disable
            protocol all
            state {
                established disable
                invalid enable
                new disable
                related disable
            }
        }
    }
    name WAN_OUT {
        default-action accept
        description "Internal to WAN"
        rule 10 {
            action accept
            description "Allow established/related"
            log disable
            state {
                established enable
                related enable
            }
        }
        rule 20 {
			action reject
            description "Reject invalid state"
            state {
                invalid enable
            }
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
}
interfaces {
    ethernet eth0 {
        address dhcp
        description LAN0_Internal_Network
        duplex auto
        speed auto
        vif 10 {
            address 10.10.0.1/24
            address dhcpv6
            description "Vlan Pfsense"
            ip {
                enable-proxy-arp
            }
            ipv6 {
                dup-addr-detect-transmits 1
                router-advert {
                    cur-hop-limit 64
                    link-mtu 0
                    managed-flag false
                    max-interval 600
                    other-config-flag false
                    prefix ::/64 {
                        autonomous-flag true
                        on-link-flag true
                        valid-lifetime 2592000
                    }
                    reachable-time 0
                    retrans-timer 0
                    send-advert true
                }
            }
            mtu 1500
        }
    }
    ethernet eth1 {
        address dhcp
        description LAN1_Internet_ONT
        dhcp-options {
            default-route update
            default-route-distance 210
            name-server update
        }
        duplex auto
        speed auto
        vif 832 {
            address dhcp
            description "Internet Orange DHCP"
            dhcp-options {
                client-option "send vendor-class-identifier "sagem";"
                client-option "send user-class "\053FSVDSL_livebox.Internet.softathome.Livebox4";"
                client-option "request subnet-mask, routers, domain-name-servers, domain-name, broadcast-address, dhcp-lease-time, dhcp-renewal-time, dhcp-rebinding-time, domain-search, rfc3118-auth, SIP,V-I;"
                client-option "send dhcp-client-identifier 1:30:7C:B2:F8:A5:B3;"
                client-option "send rfc3118-auth 00:00:00:00:00:00:00:00:00:00:00:1a:09:00:00:05:58:01:03:41:01:0d:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx;"
                default-route update
                default-route-distance 210
                global-option "option rfc3118-auth code 90 = string;"
                global-option "option SIP code 120 =string;"
                global-option "option V-I code 125 =string;"
                name-server update
            }
            dhcpv6-pd {
                pd 0 {
                    interface eth0.10 {
                        host-address ::1
                        prefix-id ::1
                    }
                    interface eth2.832 {
                        host-address ::1
                        prefix-id ::3
                    }
                    prefix-length 56
                }
                prefix-only
                rapid-commit enable
            }
            egress-qos "0:0 1:0 2:0 3:0 4:0 5:0 6:6 7:0"
            firewall {
                in {
                    ipv6-name WANv6_IN
                    name WAN_IN
                }
                local {
                    ipv6-name WANv6_LOCAL
                    name WAN_LOCAL
                }
                out {
                    ipv6-name WANv6_OUT
                    name WAN_OUT
                }
            }
            ipv6 {
                address {
                    autoconf
                }
                dup-addr-detect-transmits 1
            }
        }
        vif 840 {
            address 10.10.2.254/32
            description "VLAN TV Canal 1 - Zap"
            egress-qos "0:5 1:5 2:5 3:5 4:5 5:5 6:5 7:5"
        }
    }
    ethernet eth2 {
        address 10.10.1.1/24
        description LAN2_Livebox
        duplex auto
        speed auto
        vif 832 {
            address 10.10.1.254/24
            description Voip
        }
    }
    ethernet eth3 {
        address 10.10.4.1/24
        description LAN_ETH3
        disable
        duplex auto
        speed auto
    }
    loopback lo {
    }
}
protocols {
    igmp-proxy {
        disable-quickleave
        interface eth0 {
            alt-subnet 0.0.0.0/0
            role downstream
            threshold 1
        }
        interface eth1 {
            role disabled
            threshold 1
        }
        interface eth1.832 {
            role disabled
            threshold 1
        }
        interface eth1.840 {
            alt-subnet 0.0.0.0/0
            role upstream
            threshold 1
        }
        interface eth2 {
            role disabled
            threshold 1
        }
    }
    static {
        route 10.20.0.0/16 {
            next-hop 10.10.0.2 {
            }
        }
        route6 ::/0 {
            next-hop fe80::ba0:bab {
				distance 1
                interface eth1.832
            }
        }
        route6 2a01:xx:xx:d202::/64 {
            next-hop fe80::250:56ff:fe97:c099 {
                interface eth0.10
            }
        }
    }
}
service {
    dhcp-server {
        disabled false
        global-parameters "option rfc3118-auth code 90 = string;"
        global-parameters "option SIP code 120 = string;"
        global-parameters "option Vendor-specific code 125 = string;"
        global-parameters "option vendor-class-identifier code 60 = string;"
        global-parameters "option arhitecture-type code 93 = unsigned integer 16;"
        hostfile-update disable
        shared-network-name LAN_LIVEBOX_DHCP {
            authoritative enable
            subnet 10.10.1.0/24 {
                default-router 10.10.1.254
                dns-server 80.10.246.3
                dns-server 81.253.149.10
                lease 86400
                start 10.10.1.2 {
                    stop 10.10.1.253
                }
                static-mapping Galaxy-S10 {
                    ip-address 10.10.1.10
                    mac-address d4:53:83:f3:d4:ec
                }
                subnet-parameters "option Vendor-specific 00:00:05:58:0c:01:0a:00:01:00:00:00:ff:ff:ff:ff:ff;"
                subnet-parameters "option SIP 00:06:73:62:63:74:33:67:03:50:55:54:06:61:63:63:65:73:73:11:6f:72:61:6e:67:65:2d:6d:75:6c:74:69:6d:65:64:69:61:03:6e:65:74:00;"
                subnet-parameters "option domain-search "PUT.access.orange-multimedia.net.";"
                subnet-parameters "option domain-name "orange.fr";"
                subnet-parameters "option rfc3118-auth 00:00:00:00:00:00:00:00:00:00:00:64:68:63:70:6c:69:76:65:62:6f:78:66:72:32:35:30;"
            }
        }
        static-arp disable
        use-dnsmasq disable
    }
    gui {
        http-port 80
        https-port 443
        older-ciphers enable
    }
    nat {
        rule 5001 {
            description "Masquerading outgoing connections"
            log disable
            outbound-interface eth1.832
            protocol all
            type masquerade
        }
        rule 5002 {
            description "Masquerading TV"
            log disable
            outbound-interface eth1.838
            protocol all
            type masquerade
        }
    }
    ssh {
        port 22
        protocol-version v2
    }
    ubnt-discover {
        disable
    }
    upnp2 {
        listen-on eth0
        nat-pmp enable
        port 34651
        secure-mode enable
        wan eth1.832
    }
}
system {
    analytics-handler {
        send-analytics-report true
    }
    config-management {
        commit-revisions 1
    }
    conntrack {
        expect-table-size 4096
        hash-size 4096
        table-size 32768
        tcp {
            half-open-connections 512
            loose disable
            max-retrans 3
        }
    }
    crash-handler {
        send-crash-report true
    }
    host-name Routeur
    login {
        user ubnt {
            authentication {
                encrypted-password xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
                public-keys pfsense {
                    key xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
                    type ssh-rsa
                }
            }
            level admin
        }
    }
    name-server 10.20.50.1
    name-server 10.20.50.2
    ntp {
        server 0.fr.pool.ntp.org {
        }
        server 1.fr.pool.ntp.org {
        }
        server 2.fr.pool.ntp.org {
        }
        server 3.fr.pool.ntp.org {
        }
    }
    offload {
        hwnat disable
        ipv4 {
            forwarding disable
        }
    }
    syslog {
        global {
            facility all {
                level notice
            }
        }
    }
    time-zone Europe/Paris
    traffic-analysis {
        dpi enable
        export enable
    }
}
traffic-control {
    optimized-queue {
        policy global
        policy queues
    }
}


/* Warning: Do not remove the following line. */
/* === vyatta-config-version: "config-management@1:conntrack@1:cron@1:dhcp-relay@1:dhcp-server@4:firewall@5:ipsec@5:nat@3:qos@1:quagga@2:suspend@1:system@5:ubnt-l2tp@1:ubnt-pptp@1:ubnt-udapi-server@1:ubnt-unms@2:ubnt-util@1:vrrp@1:vyatta-netflow@1:webgui@1:webproxy@1:zone-policy@1" === */
/* Release version: v2.0.9-hotfix.6.5574652.221230.1020 */