# Cron
logcheck_minute: 45

cron_worker:
  - { dst: "/usr/local/sbin/update-dns.sh",
        own: "root", grp: "root", mode: "0755", src: "router/update-dns.sh" }

cron_secret:
  - { dst: "/usr/local/etc/update-dns.conf",
        own: "root", grp: "root", mode: "0755", src: "router/update-dns.conf.j2" }

# Network interfaces
nft_nic_lan: "ens160"
nft_lan_ip4: "192.168.110.0/24"
nft_lan_ip6: "fdaa:aaaa:aaaa:aaaa::/64"
nft_nic_wan: "ens192"
nft_backend: { ipv4: "192.168.110.11", ipv6: "fdaa:aaaa:aaaa:aaaa::11" }

# for LAN
nft_lan_allow_elements:
  - { proto_port: "tcp . 22",			comment: "SSH" }
  - { proto_port: "tcp . 53",			comment: "DNS" }
  - { proto_port: "udp . 53",			comment: "DNS" }
  - { proto_port: "udp . 67",			comment: "DHCP" }
  - { proto_port: "udp . 123",			comment: "NTP" }
  - { proto_port: "tcp . 389",			comment: "LDAP" }
  - { proto_port: "udp . 389",			comment: "LDAP" }
  - { proto_port: "tcp . 636",			comment: "LDAPS" }
  - { proto_port: "tcp . 88",			comment: "Kerberos Authentication" }
  - { proto_port: "udp . 88",			comment: "Kerberos" }
  - { proto_port: "tcp . 464",			comment: "Kerberos kpasswd" }
  - { proto_port: "udp . 464",			comment: "Kerberos kpasswd" }
  - { proto_port: "tcp . 135",			comment: "Microsoft RPC Endpoint Mapper" }
  - { proto_port: "udp . 137",			comment: "NetBIOS Name Service(WINS)" }
  - { proto_port: "udp . 138",			comment: "NetBIOS Datagram Service" }
  - { proto_port: "tcp . 139",			comment: "NetBIOS Session Service" }
  - { proto_port: "tcp . 445",			comment: "Microsoft-DS(SMB over TCP)" }
  - { proto_port: "tcp . 49152-49200",		comment: "Windows RPC Dynamic Ports" }
  - { proto_port: "tcp . 3268",			comment: "Active Directory Global Catalog" }
  - { proto_port: "tcp . 3269",			comment: "Active Directory Global Catalog SSL" }

# for WAN
nft_wan_allow_elements:
  - { proto_port: "tcp . 22",			comment: "SSH" }

# for FWD(for white list mode)
nft_fwd_allow_elements:
  - { proto_port: "tcp . 22",			comment: "SSH" }
  - { proto_port: "tcp . 25",			comment: "SMTP" }
  - { proto_port: "tcp . 53",			comment: "DNS" }
  - { proto_port: "udp . 53",			comment: "DNS" }
  - { proto_port: "udp . 123",			comment: "NTP" }
  - { proto_port: "tcp . 80",			comment: "HTTP" }
  - { proto_port: "tcp . 443",			comment: "HTTPS" }
  - { proto_port: "udp . 443",			comment: "HTTPS" }
  - { proto_port: "tcp . 43",			comment: "whois" }
  - { proto_port: "udp . 33434-33534",		comment: "traceroute" }

# for FWD(for black list mode)
nft_fwd_block_elements:
  - { proto_port: "tcp . 135",			comment: "Microsoft RPC Endpoint Mapper" }
  - { proto_port: "udp . 137",			comment: "NetBIOS Name Service(WINS)" }
  - { proto_port: "udp . 138",			comment: "NetBIOS Datagram Service" }
  - { proto_port: "tcp . 139",			comment: "NetBIOS Session Service" }
  - { proto_port: "tcp . 445",			comment: "Microsoft-DS(SMB over TCP)" }

# for DNAT
nft_nat_allow_elements:
  - { proto_port: "tcp . 25",			comment: "SMTP" }
  - { proto_port: "tcp . 80",			comment: "HTTP" }
  - { proto_port: "tcp . 443",			comment: "HTTPS" }

# silent dorp
nft_invalid_silent_elements:
  - { proto_port: "tcp . 0-65535 . 445",	comment: "Microsoft-DS(SMB over TCP)" }
  - { proto_port: "tcp . 0-65535 . 49152-49200",comment: "Windows RPC Dynamic Ports" }