# EdgeRouter Lite DN42 config example

This is the config I (Felicitus) am running on an Ubiquiti EdgeRouter Lite (AS76197).

## Features

- dn42 DNS
- “classic” OpenVPN P2P (including the common “comp-lzo” option)
- BGP
- Some traffic-shaping rules for my very slow 3mbit DSL uplink
- 2 internal: One DN42 network (172.22.117.128/25 for me and my servers as well as a NAT 192.168.42.10/24 for my parents, so that they’re save from dn42 - that network is NOT announced to dn42).
- Firewall to protect my NAS server and monitoring

## Upcoming

- AICCU integration (SIXXS), probably not possible with the config, so `apt-get install aiccu` should do the trick
- dn42 IPv6 routing (probably)

Ask me if you want to know if I have implemented those items already.

# Configuration

    firewall {
        all-ping enable
        broadcast-ping disable
        conntrack-expect-table-size 4096
        conntrack-hash-size 4096
        conntrack-table-size 32768
        conntrack-tcp-loose enable
        ipv6-name ROUTER_V6 {
            default-action drop
            rule 1 {
                action drop
                destination {
                    port 22
                }
                protocol tcp
            }
        }
        ipv6-name WAN_IN_V6 {
            default-action drop
            enable-default-log
            rule 3 {
                action drop
                destination {
                    port 22
                }
                protocol tcp
            }
        }
        ipv6-receive-redirects disable
        ipv6-src-route disable
        ip-src-route disable
        log-martians enable
        name DN42 {
            default-action drop
            rule 100 {
                action drop
                destination {
                    address 172.22.117.181
                }
                source {
                    address !172.22.117.128/25
                }
            }
            rule 101 {
                action drop
                destination {
                    address 172.22.117.182
                }
                source {
                    address !172.22.117.128/25
                }
            }
            rule 102 {
                action drop
                destination {
                    address 172.22.117.183
                }
                source {
                    address !172.22.117.128/25
                }
            }
        }
        name ROUTER_V4 {
            default-action accept
            rule 2 {
                action accept
                protocol icmp
            }
            rule 10 {
                action drop
                destination {
                    port 22
                }
                protocol tcp
            }
        }
        name WAN_IN_V4 {
            default-action drop
            enable-default-log
            rule 1 {
                action accept
                description "allow established connections"
                protocol all
                state {
                    established enable
                    related enable
                }
            }
            rule 2 {
                action drop
                state {
                    invalid enable
                }
            }
            rule 3 {
                action drop
                destination {
                    port 22
                }
                protocol tcp
            }
        }
        receive-redirects disable
        send-redirects enable
        source-validation disable
        syn-cookies enable
    }
    interfaces {
        ethernet eth0 {
            duplex auto
            firewall {
                in {
                    name WAN_IN_V4
                }
            }
            pppoe 0 {
                default-route auto
                firewall {
                    local {
                        ipv6-name ROUTER_V6
                        name ROUTER_V4
                    }
                }
                mtu 1492
                name-server auto
                password 12345678
                traffic-policy {
                }
                user-id some-t-online-crap@t-online.de
            }
            speed auto
        }
        ethernet eth1 {
            address 172.22.117.254/25
            duplex auto
            speed auto
            traffic-policy {
            }
        }
        ethernet eth2 {
            address 192.168.42.1/24
            duplex auto
            speed auto
        }
        loopback lo {
        }
        openvpn vtun0 {
            local-address 172.22.117.254 {
                subnet-mask 255.255.255.128
            }
            local-port 33121
            mode site-to-site
            openvpn-option --comp-lzo
            protocol udp
            remote-address 172.22.117.1
            remote-host 5.9.33.163
            remote-port 33121
            shared-secret-key-file /config/auth/felihome.key
        }
    }
    policy {
        prefix-list vpn-in {
            rule 10 {
                action permit
                ge 22
                le 28
                prefix 172.22.0.0/15
            }
        }
    }
    protocols {
        bgp 76197 {
            neighbor 172.22.117.1 {
                description feli-server
                peer-group dn42
                remote-as 64717
            }
            network 172.22.117.128/25 {
            }
            peer-group dn42 {
                soft-reconfiguration {
                    inbound
                }
            }
        }
    }
    service {
        dhcp-server {
            disabled false
            dynamic-dns-update {
                enable true
            }
            shared-network-name int {
                authoritative disable
                subnet 172.22.117.128/25 {
                    default-router 172.22.117.254
                    dns-server 172.22.117.254
                    domain-name feli-home.felicitus.org
                    lease 86400
                    start 172.22.117.129 {
                        stop 172.22.117.150
                    }
                    static-mapping monitoring {
                        ip-address 172.22.117.183
                        mac-address 52:54:00:20:df:46
                    }
                    static-mapping nas {
                        ip-address 172.22.117.181
                        mac-address e8:39:35:ee:22:7b
                    }
                }
            }
            shared-network-name nat {
                authoritative disable
                subnet 192.168.42.0/24 {
                    default-router 192.168.42.1
                    dns-server 8.8.8.8
                    dns-server 8.8.4.4
                    lease 86400
                    start 192.168.42.10 {
                        stop 192.168.42.100
                    }
                }
            }
        }
        dns {
            forwarding {
                cache-size 150
                listen-on eth1
                listen-on eth2
                name-server 8.8.8.8
                name-server 8.8.4.4
                options server=/dn42/172.23.0.53
                options server=/22.172.in-addr.arpa/172.23.0.53
                options server=/23.172.in-addr.arpa/172.23.0.53
                options rebind-domain-ok=/dn42/
            }
        }
        nat {
            rule 6000 {
                outbound-interface pppoe0
                type masquerade
            }
            rule 7000 {
                outbound-interface eth2
                type masquerade
            }
        }
        ssh {
            port 22
            protocol-version v2
        }
        upnp {
            listen-on eth1 {
                outbound-interface pppoe0
            }
            listen-on eth2 {
                outbound-interface pppoe0
            }
        }
    }
    system {
        host-name ubnt
        login {
            user felicitus {
                authentication {
                    encrypted-password errnope
                    plaintext-password ""
                    public-keys felicitus@felicitus.org {
                        key AAAAB3NzaC1yc2EAAAADAQABAAABAQDPTSLjSY/Be1XJ/klAwLiM1pKSvmbdcOgtgDB6nPcHkgX6JZu7g/Kejfuk4qIKL8GYYUQt7DlGY6n2u5rChWE/6KZJzXcUwS3pXk4LZ5KydWp7ihfvyRtUOBgKkRa1zQv+6KCH9WyR++ArwVTP8KSkrmDe6k7NWAjZqOuIJHG/AbEyTBapTJYjObZ0AM7wlwcB+oRM1BfZCP0Y+PIP2eGJS7Pyb32pITNKk3JuFXgAvbj5OeRrwtpZ9S+/7wIpaUVODPzrVmbC7vOXu/2KJ9aY2BmxUsxRbrvWMmWNiuE0YPt/7lUroK4pH3md3lWRcGUS/uYvhug7yG1yB81nyI15
                        type ssh-rsa
                    }
                }
                level admin
            }
        }
        name-server 172.22.117.254
        ntp {
            server 0.ubnt.pool.ntp.org {
            }
            server 1.ubnt.pool.ntp.org {
            }
            server 2.ubnt.pool.ntp.org {
            }
            server 3.ubnt.pool.ntp.org {
            }
        }
        syslog {
            global {
                facility all {
                    level notice
                }
                facility protocols {
                    level debug
                }
            }
        }
        time-zone UTC
    }
    traffic-policy {
        shaper client-up-s {
            bandwidth 30kbit
            class 20 {
                bandwidth 100%
                burst 6k
                match TCPACK {
                    ip {
                        protocol tcp
                    }
                    mark 225
                }
                priority 5
                queue-limit 65
                queue-type fair-queue
            }
            class 30 {
                bandwidth 5%
                burst 15k
                ceiling 20%
                match ssh {
                    ip {
                        destination {
                            port 22
                        }
                        dscp lowdelay
                        protocol tcp
                    }
                }
                match ssh-ipv6 {
                    ipv6 {
                        destination {
                            port 22
                        }
                        protocol tcp
                    }
                }
                priority 6
                queue-limit 10
                queue-type fair-queue
            }
            default {
                bandwidth 95%
                burst 15k
                ceiling 100%
                priority 2
                queue-limit 13
                queue-type fair-queue
            }
        }
    }

    /* Warning: Do not remove the following line. */
    /* === vyatta-config-version: "config-management@1:dhcp-relay@1:dhcp-server@4:firewall@4:ipsec@3:nat@3:qos@1:quagga@2:system@4:ubnt-pptp@1:ubnt-util@1:vrrp@1:webgui@1:webproxy@1:zone-policy@1" === */
    /* Release version: v1.3.0.4605130.131011.1754 */