secure-setup/config.boot at master · victor-li/secure-setup · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
firewall {
    all-ping enable
    broadcast-ping disable
    config-trap disable
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    name LAN-IN {
        default-action drop
        rule 10 {
            action accept
            state {
                established enable
                related enable
            }
        }
    }
    name LAN-LOCAL {
        default-action drop
        rule 10 {
            action accept
            state {
                established enable
                related enable
            }
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
    twa-hazards-protection disable
}
interfaces {
    ethernet eth0 {
        address dhcp
        description "Mac Private"
        duplex auto
        smp_affinity auto
        speed auto
    }
    ethernet eth1 {
        address dhcp
        description LAN
        duplex auto
        firewall {
            in {
                name LAN-IN
            }
            local {
                name LAN-LOCAL
            }
        }
        smp_affinity auto
        speed auto
    }
    ethernet eth2 {
        address 10.0.1.1/24
        description "PIA"
        duplex auto
        smp_affinity auto
        speed auto
    }
    loopback lo {
    }
    openvpn vtun1 {
        description "PIA VPN"
        encryption aes128
        mode client
        openvpn-option --comp-lzo
        openvpn-option "--verb 3"
        openvpn-option "--auth-user-pass /config/auth/pia/pia-secret.txt"
        openvpn-option "--script-security 2"
        openvpn-option "--resolv-retry infinite"
        openvpn-option --nobind
        openvpn-option --persist-key
        openvpn-option "--cipher aes-256-cbc"
        openvpn-option "--auth sha256"
        openvpn-option "--reneg-sec 0"
        persistent-tunnel
        protocol tcp-active
        remote-host swiss.privateinternetaccess.com
        remote-port 501
        tls {
            ca-cert-file /config/auth/pia/ca.rsa.4096.crt
            crl-file /config/auth/pia/crl.rsa.4096.pem
        }
    }
}
nat {
    source {
        rule 100 {
            outbound-interface vtun1
            source {
                address 10.0.1.0/24
            }
            translation {
                address masquerade
            }
        }
    }
}
service {
    dhcp-server {
        disabled false
        shared-network-name PIA-LAN {
            authoritative disable
            subnet 10.0.1.0/24 {
                default-router 10.0.1.1
                dns-server 10.0.1.1
                domain-name pia-network
                lease 86400
                start 10.0.1.9 {
                    stop 10.0.1.254
                }
            }
        }
    }
    dns {
        forwarding {
            cache-size 0
            listen-on eth2
            name-server 8.8.8.8
            name-server 8.8.4.4
        }
    }
    ssh {
        port 22
    }
}
system {
    config-management {
        commit-revisions 20
    }
    console {
        device ttyS0 {
            speed 9600
        }
    }
    host-name vyos
    login {
        user vyos {
            authentication {
                encrypted-password $6$Pe9B7JL1i7gCig$6tVFJqa7ya0hAtEqUICB9apbmfzEP4T.wJLlU2d5nOKo/gDMa5D4f7i67TE0VoB6Lqime9KiGecAH7QfbKdiy0
                plaintext-password ""
            }
            level admin
        }
    }
    ntp {
        server 0.pool.ntp.org {
        }
        server 1.pool.ntp.org {
        }
        server 2.pool.ntp.org {
        }
    }
    name-server 8.8.8.8
    name-server 8.8.4.4
    package {
        auto-sync 1
        repository community {
            components main
            distribution helium
            password ""
            url http://packages.vyos.net/vyos
            username ""
        }
    }
    syslog {
        global {
            facility all {
                level notice
            }
            facility protocols {
                level debug
            }
        }
    }
    time-zone Europe/Amsterdam
}


/* Warning: Do not remove the following line. */
/* === vyatta-config-version: "cluster@1:config-management@1:conntrack-sync@1:conntrack@1:cron@1:dhcp-relay@1:dhcp-server@4:firewall@5:ipsec@4:nat@4:qos@1:quagga@2:system@6:vrrp@1:wanloadbalance@3:webgui@1:webproxy@1:zone-policy@1" === */
/* Release version: VyOS 1.1.7 */