Arno
3
config defaults
option input 'DROP'
option output 'DROP'
option forward 'DROP'
option synflood_protect '1'
option drop_invalid '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
option family 'ipv4'
option log '1'
config zone
option name 'dmz'
option input 'DROP'
option output 'DROP'
option forward 'ACCEPT'
list network 'dmz'
option family 'ipv4'
option log '1'
config zone
option name 'internet'
option input 'DROP'
option output 'DROP'
option forward 'ACCEPT'
list network 'internet'
option family 'ipv4'
option log '1'
config forwarding
option src 'lan'
option dest 'dmz'
config forwarding
option src 'lan'
option dest 'internet'
config forwarding
option src 'dmz'
option dest 'internet'
config forwarding
option src 'internet'
option dest 'dmz'
config rule
option dest 'internet'
option name 'NTP-out'
list proto 'udp'
option dest_port '123'
option target 'ACCEPT'
option family 'ipv4'
option enabled '1'
config rule
option dest 'dmz'
option name 'ICMP-out dmz'
list proto 'icmp'
option target 'ACCEPT'
option family 'ipv4'
option enabled '1'
config rule
option dest 'internet'
option name 'ICMP-out internet'
list proto 'icmp'
option target 'ACCEPT'
option family 'ipv4'
option enabled '1'
config rule
option dest 'internet'
option name 'HTTPS-out'
option family 'ipv4'
list proto 'tcp'
option dest_port '443'
option target 'ACCEPT'
option enabled '1'
config rule
option dest 'internet'
option name 'Remote logging'
list proto 'udp'
list dest_ip 'xxx.xxx.xxx.xxx'
option dest_port 'xxxx'
option target 'ACCEPT'
option family 'ipv4'
option enabled '1'
config rule
option src 'internet'
option dest 'lan'
option name 'Established-to-LAN'
option family 'ipv4'
option target 'ACCEPT'
option enabled '1'
list proto 'all'
option log '1'