EdgeRouter X - Ubiquiti - (ER X)

firewall {
all-ping enable
broadcast-ping disable
ipv6-name WAN6_IN {
default-action drop
description "WAN inbound ipv6 traffic forwarded to LAN"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action accept
description "Allow ICMPv6"
protocol icmpv6
}
rule 30 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
}
ipv6-name WAN6_LOCAL {
default-action drop
description "WAN inbound ipv6 traffic to the router"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
rule 30 {
action accept
description "Allow ICMPv6"
protocol icmpv6
}
rule 40 {
action accept
description "Allow DHCPv6 client/server"
destination {
port 546
}
protocol udp
source {
port 547
}
}
}
ipv6-name WANv6_IN {
default-action drop
description "WAN inbound traffic forwarded to LAN"
enable-default-log
rule 10 {
action accept
description "Allow established/related sessions"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
}
ipv6-name WANv6_LOCAL {
default-action drop
description "WAN inbound traffic to the router"
enable-default-log
rule 10 {
action accept
description "Allow established/related sessions"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
rule 30 {
action accept
description "Allow IPv6 icmp"
protocol ipv6-icmp
}
rule 40 {
action accept
description "allow dhcpv6"
destination {
port 546
}
protocol udp
source {
port 547
}
}
}
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
name WAN_IN {
default-action drop
description "WAN to internal"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
}
name WAN_LOCAL {
default-action drop
description "WAN to router"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
}
options {
mss-clamp {
mss 1412
}
mss-clamp6 {
interface-type pppoe
mss 1432
}
}
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
}
interfaces {
ethernet eth0 {
description Local
duplex auto
speed auto
}
ethernet eth1 {
description Local
duplex auto
speed auto
}
ethernet eth2 {
description Local
duplex auto
speed auto
}
ethernet eth3 {
description Local
duplex auto
speed auto
}
ethernet eth4 {
description "Internet (PPPoE)"
duplex auto
poe {
output off
}
pppoe 0 {
default-route auto
dhcpv6-pd {
pd 0 {
interface switch0 {
host-address ::1
prefix-id :0
service slaac
}
prefix-length 56
}
rapid-commit enable
}
firewall {
in {
ipv6-name WAN6_IN
name WAN_IN
}
local {
ipv6-name WAN6_LOCAL
name WAN_LOCAL
}
}
ipv6 {
dup-addr-detect-transmits 1
enable {
}
}
mtu 1492
name-server auto
password XXXXXXX
user-id XXXXXX
}
speed auto
}
loopback lo {
}
switch switch0 {
address 192.168.3.1/24
description LocalX
ipv6 {
dup-addr-detect-transmits 1
router-advert {
cur-hop-limit 64
link-mtu 0
managed-flag false
max-interval 600
other-config-flag true
prefix ::/64 {
autonomous-flag true
on-link-flag true
valid-lifetime 86400
}
reachable-time 0
retrans-timer 0
send-advert true
}
}
mtu 1500
switch-port {
interface eth0 {
}
interface eth1 {
}
interface eth2 {
}
interface eth3 {
}
vlan-aware disable
}
}
}
port-forward {
auto-firewall enable
hairpin-nat enable
lan-interface switch0
rule 1 {
description remotedesktop
forward-to {
address 192.168.3.6
port 3389
}
original-port 3389
protocol tcp_udp
}
wan-interface pppoe0
}
service {
dhcp-server {
disabled false
hostfile-update disable
shared-network-name LAN {
authoritative enable
subnet 192.168.3.0/24 {
default-router 192.168.3.1
dns-server 192.168.3.1
domain-name ubnt
lease 86400
start 192.168.3.10 {
stop 192.168.3.254
}
static-mapping Desktop {
ip-address 192.168.3.6
mac-address 00:19:66:38:c3:01
}
static-mapping HIK-DVR {
ip-address 192.168.3.5
mac-address C0:51:7E:56:85:6E
}
static-mapping IndoorAC-Lite {
ip-address 192.168.3.3
mac-address f0:9f:c2:33:f4:db
}
static-mapping OutdoorAC-Mesh {
ip-address 192.168.3.4
mac-address 78:8A:20:20:9F:C1
}
static-mapping US-8-60W {
ip-address 192.168.3.2
mac-address b4:fb:e4:8c:df:0b
}
}
}
static-arp disable
use-dnsmasq enable
}
dns {
forwarding {
cache-size 500
listen-on switch0
name-server 193.231.252.1
name-server 213.154.124.1
name-server 2a02:2f0c:8000:8::1
name-server 2a02:2f0c:8000:3::1
name-server 1.1.1.1
name-server 1.0.0.1
name-server 2606:4700:4700::1111
name-server 2606:4700:4700::1001
name-server 9.9.9.9
name-server 149.112.112.112
name-server 2620:fe::fe
name-server 2620:fe::9
system
}
}
gui {
http-port 80
https-port 443
older-ciphers enable
}
nat {
rule 5010 {
description "masquerade for WAN"
outbound-interface pppoe0
type masquerade
}
}
ssh {
port 22
protocol-version v2
}
unms {
disable
}
upnp {
}
upnp2 {
listen-on switch0
nat-pmp enable
secure-mode enable
wan pppoe0
}
}
system {
analytics-handler {
send-analytics-report true
}
crash-handler {
send-crash-report true
}
domain-name ubnt
host-name ERX
ip {
override-hostname-ip 192.168.3.1
}
login {
user admin {
authentication {
encrypted-password ****************
plaintext-password ****************
}
full-name Admin
level admin
}
}
name-server 127.0.0.1
ntp {
server 0.ubnt.pool.ntp.org {
}
server 1.ubnt.pool.ntp.org {
}
server 2.ubnt.pool.ntp.org {
}
server 3.ubnt.pool.ntp.org {
}
}
offload {
hwnat enable
ipsec enable
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
time-zone Europe/Bucharest
traffic-analysis {
dpi disable
export disable
}
}
++
admin@ERX:~$ show dns forwarding nameservers
-----------------------------------------------
   Nameservers configured for DNS forwarding
-----------------------------------------------
193.231.252.1 available via 'statically configured'
213.154.124.1 available via 'statically configured'
2a02:2f0c:8000:8::1 available via 'statically configured'
2a02:2f0c:8000:3::1 available via 'statically configured'
1.1.1.1 available via 'statically configured'
1.0.0.1 available via 'statically configured'
2606:4700:4700::1111 available via 'statically configured'
2606:4700:4700::1001 available via 'statically configured'
9.9.9.9 available via 'statically configured'
149.112.112.112 available via 'statically configured'
2620:fe::fe available via 'statically configured'
2620:fe::9 available via 'statically configured'
127.0.0.1 available via 'optionally configured'  <-- e ok sa apara aici la configured?
-----------------------------------------------
Nameservers NOT configured for DNS forwarding
-----------------------------------------------
2001:4860:4860::64 available via 'system' <--  de unde au aparut astea 2? inainte sa fac update de firmware, nu erau aici
2001:4860:4860::6464 available via 'system'

configure
set interfaces ethernet eth4 pppoe 0 ipv6 enable
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 prefix-length 56
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd rapid-commit enable
set interfaces ethernet eth4 pppoe 0 name-server auto

set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0 host-address '::1'
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0 prefix-id ':1'
set interfaces ethernet eth4 pppoe 0 dhcpv6-pd pd 0 interface switch0 service slaac

set interfaces switch switch0 ipv6 dup-addr-detect-transmits 1
set interfaces switch switch0 ipv6 router-advert cur-hop-limit 64
set interfaces switch switch0 ipv6 router-advert link-mtu 0
set interfaces switch switch0 ipv6 router-advert managed-flag false
set interfaces switch switch0 ipv6 router-advert max-interval 600
set interfaces switch switch0 ipv6 router-advert other-config-flag true
set interfaces switch switch0 ipv6 router-advert prefix '::/64' autonomous-flag true
set interfaces switch switch0 ipv6 router-advert prefix '::/64' on-link-flag true
set interfaces switch switch0 ipv6 router-advert prefix '::/64' valid-lifetime 86400
set interfaces switch switch0 ipv6 router-advert reachable-time 0
set interfaces switch switch0 ipv6 router-advert retrans-timer 0
set interfaces switch switch0 ipv6 router-advert send-advert true