77 lines
3.2 KiB
YAML
77 lines
3.2 KiB
YAML
# Cron
|
|
logcheck_minute: 45
|
|
|
|
cron_worker:
|
|
- { dst: "/usr/local/sbin/update-dns.sh",
|
|
own: "root", grp: "root", mode: "0755", src: "router/update-dns.sh" }
|
|
|
|
cron_secret:
|
|
- { dst: "/usr/local/etc/update-dns.conf",
|
|
own: "root", grp: "root", mode: "0755", src: "router/update-dns.conf.j2" }
|
|
|
|
# Network interfaces
|
|
nft_nic_lan: "ens160"
|
|
nft_lan_ip4: "192.168.110.0/24"
|
|
nft_lan_ip6: "fdaa:aaaa:aaaa:aaaa::/64"
|
|
nft_nic_wan: "ens192"
|
|
nft_backend: { ipv4: "192.168.110.11", ipv6: "fdaa:aaaa:aaaa:aaaa::11" }
|
|
|
|
# for LAN
|
|
nft_lan_allow_elements:
|
|
- { proto_port: "tcp . 22", comment: "SSH" }
|
|
- { proto_port: "tcp . 53", comment: "DNS" }
|
|
- { proto_port: "udp . 53", comment: "DNS" }
|
|
- { proto_port: "udp . 67", comment: "DHCP" }
|
|
- { proto_port: "udp . 123", comment: "NTP" }
|
|
- { proto_port: "tcp . 389", comment: "LDAP" }
|
|
- { proto_port: "udp . 389", comment: "LDAP" }
|
|
- { proto_port: "tcp . 636", comment: "LDAPS" }
|
|
- { proto_port: "tcp . 88", comment: "Kerberos Authentication" }
|
|
- { proto_port: "udp . 88", comment: "Kerberos" }
|
|
- { proto_port: "tcp . 464", comment: "Kerberos kpasswd" }
|
|
- { proto_port: "udp . 464", comment: "Kerberos kpasswd" }
|
|
- { proto_port: "tcp . 135", comment: "Microsoft RPC Endpoint Mapper" }
|
|
- { proto_port: "udp . 137", comment: "NetBIOS Name Service(WINS)" }
|
|
- { proto_port: "udp . 138", comment: "NetBIOS Datagram Service" }
|
|
- { proto_port: "tcp . 139", comment: "NetBIOS Session Service" }
|
|
- { proto_port: "tcp . 445", comment: "Microsoft-DS(SMB over TCP)" }
|
|
- { proto_port: "tcp . 49152-49200", comment: "Windows RPC Dynamic Ports" }
|
|
- { proto_port: "tcp . 3268", comment: "Active Directory Global Catalog" }
|
|
- { proto_port: "tcp . 3269", comment: "Active Directory Global Catalog SSL" }
|
|
|
|
# for WAN
|
|
nft_wan_allow_elements:
|
|
- { proto_port: "tcp . 22", comment: "SSH" }
|
|
|
|
# for FWD(for white list mode)
|
|
nft_fwd_allow_elements:
|
|
- { proto_port: "tcp . 22", comment: "SSH" }
|
|
- { proto_port: "tcp . 25", comment: "SMTP" }
|
|
- { proto_port: "tcp . 53", comment: "DNS" }
|
|
- { proto_port: "udp . 53", comment: "DNS" }
|
|
- { proto_port: "udp . 123", comment: "NTP" }
|
|
- { proto_port: "tcp . 80", comment: "HTTP" }
|
|
- { proto_port: "tcp . 443", comment: "HTTPS" }
|
|
- { proto_port: "udp . 443", comment: "HTTPS" }
|
|
- { proto_port: "tcp . 43", comment: "whois" }
|
|
- { proto_port: "udp . 33434-33534", comment: "traceroute" }
|
|
|
|
# for FWD(for black list mode)
|
|
nft_fwd_block_elements:
|
|
- { proto_port: "tcp . 135", comment: "Microsoft RPC Endpoint Mapper" }
|
|
- { proto_port: "udp . 137", comment: "NetBIOS Name Service(WINS)" }
|
|
- { proto_port: "udp . 138", comment: "NetBIOS Datagram Service" }
|
|
- { proto_port: "tcp . 139", comment: "NetBIOS Session Service" }
|
|
- { proto_port: "tcp . 445", comment: "Microsoft-DS(SMB over TCP)" }
|
|
|
|
# for DNAT
|
|
nft_nat_allow_elements:
|
|
- { proto_port: "tcp . 25", comment: "SMTP" }
|
|
- { proto_port: "tcp . 80", comment: "HTTP" }
|
|
- { proto_port: "tcp . 443", comment: "HTTPS" }
|
|
|
|
# silent dorp
|
|
nft_invalid_silent_elements:
|
|
- { proto_port: "tcp . 0-65535 . 445", comment: "Microsoft-DS(SMB over TCP)" }
|
|
- { proto_port: "tcp . 0-65535 . 49152-49200",comment: "Windows RPC Dynamic Ports" }
|