mark22k
/
dn42-wiki
дзеркало https://codeberg.org/mark22k/dn42-wiki.git


			
							123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529
							<!DOCTYPE html>
<html lang="en">
    <head>
<meta charset="UTF-8">


<title>EdgeRouter Lite DN42 config example | dn42 wiki</title>

<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta name="robots" content="index, follow">
<meta name="keywords" content="dn42,wiki,routing,bgp">

<link rel="canonical" href="https://dn42.obl.ong/howto/EdgeOS-Config-Example.html">
<link rel="icon" type="image/x-icon" href="/favicon.ico">
<link rel="shortcut icon" type="image/x-icon" href="/favicon.ico">

<link rel="author" type="text/html" href="/docs/people">

<link rel="stylesheet" href="/css/normalize.css">
<link rel="stylesheet" href="/css/simple.min.css">
<link rel="stylesheet" href="/css/style.css">
<link rel="stylesheet" href="/css/menu.css">


</head>
    
    <body>

        <header>


<b>dn42 wiki / EdgeRouter Lite DN42 config example</b>

<div id="dn42_header">
    
    <p><a href="/"><img src="/dn42.png" alt="dn42" /></a></p>

</div>
</header>

        <main>
            <h1 id="edgerouter-lite-dn42-config-example">EdgeRouter Lite DN42 config example</h1>
<p>This is the config I (Felicitus) am running on an Ubiquiti EdgeRouter Lite (AS76197).</p>

<h2 id="features">Features</h2>

<ul>
  <li>dn42 DNS</li>
  <li>“classic” OpenVPN P2P (including the common “comp-lzo” option)</li>
  <li>BGP</li>
  <li>Some traffic-shaping rules for my very slow 3mbit DSL uplink</li>
  <li>2 internal: One DN42 network (172.22.117.128/25 for me and my servers as well as a NAT 192.168.42.10/24 for my parents, so that they’re save from dn42 - that network is NOT announced to dn42).</li>
  <li>Firewall to protect my NAS server and monitoring</li>
</ul>

<h2 id="upcoming">Upcoming</h2>

<ul>
  <li>AICCU integration (SIXXS), probably not possible with the config, so <code class="language-plaintext highlighter-rouge">apt-get install aiccu</code> should do the trick</li>
  <li>dn42 IPv6 routing (probably)</li>
</ul>

<p>Ask me if you want to know if I have implemented those items already.</p>

<h1 id="configuration">Configuration</h1>

<div class="language-conf highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="n">firewall</span> {
    <span class="n">all</span>-<span class="n">ping</span> <span class="n">enable</span>
    <span class="n">broadcast</span>-<span class="n">ping</span> <span class="n">disable</span>
    <span class="n">conntrack</span>-<span class="n">expect</span>-<span class="n">table</span>-<span class="n">size</span> <span class="m">4096</span>
    <span class="n">conntrack</span>-<span class="n">hash</span>-<span class="n">size</span> <span class="m">4096</span>
    <span class="n">conntrack</span>-<span class="n">table</span>-<span class="n">size</span> <span class="m">32768</span>
    <span class="n">conntrack</span>-<span class="n">tcp</span>-<span class="n">loose</span> <span class="n">enable</span>
    <span class="n">ipv6</span>-<span class="n">name</span> <span class="n">ROUTER_V6</span> {
        <span class="n">default</span>-<span class="n">action</span> <span class="n">drop</span>
        <span class="n">rule</span> <span class="m">1</span> {
            <span class="n">action</span> <span class="n">drop</span>
            <span class="n">destination</span> {
                <span class="n">port</span> <span class="m">22</span>
            }
            <span class="n">protocol</span> <span class="n">tcp</span>
        }
    }
    <span class="n">ipv6</span>-<span class="n">name</span> <span class="n">WAN_IN_V6</span> {
        <span class="n">default</span>-<span class="n">action</span> <span class="n">drop</span>
        <span class="n">enable</span>-<span class="n">default</span>-<span class="n">log</span>
        <span class="n">rule</span> <span class="m">3</span> {
            <span class="n">action</span> <span class="n">drop</span>
            <span class="n">destination</span> {
                <span class="n">port</span> <span class="m">22</span>
            }
            <span class="n">protocol</span> <span class="n">tcp</span>
        }
    }
    <span class="n">ipv6</span>-<span class="n">receive</span>-<span class="n">redirects</span> <span class="n">disable</span>
    <span class="n">ipv6</span>-<span class="n">src</span>-<span class="n">route</span> <span class="n">disable</span>
    <span class="n">ip</span>-<span class="n">src</span>-<span class="n">route</span> <span class="n">disable</span>
    <span class="n">log</span>-<span class="n">martians</span> <span class="n">enable</span>
    <span class="n">name</span> <span class="n">DN42</span> {
        <span class="n">default</span>-<span class="n">action</span> <span class="n">drop</span>
        <span class="n">rule</span> <span class="m">100</span> {
            <span class="n">action</span> <span class="n">drop</span>
            <span class="n">destination</span> {
                <span class="n">address</span> <span class="m">172</span>.<span class="m">22</span>.<span class="m">117</span>.<span class="m">181</span>
            }
            <span class="n">source</span> {
                <span class="n">address</span> !<span class="m">172</span>.<span class="m">22</span>.<span class="m">117</span>.<span class="m">128</span>/<span class="m">25</span>
            }
        }
        <span class="n">rule</span> <span class="m">101</span> {
            <span class="n">action</span> <span class="n">drop</span>
            <span class="n">destination</span> {
                <span class="n">address</span> <span class="m">172</span>.<span class="m">22</span>.<span class="m">117</span>.<span class="m">182</span>
            }
            <span class="n">source</span> {
                <span class="n">address</span> !<span class="m">172</span>.<span class="m">22</span>.<span class="m">117</span>.<span class="m">128</span>/<span class="m">25</span>
            }
        }
        <span class="n">rule</span> <span class="m">102</span> {
            <span class="n">action</span> <span class="n">drop</span>
            <span class="n">destination</span> {
                <span class="n">address</span> <span class="m">172</span>.<span class="m">22</span>.<span class="m">117</span>.<span class="m">183</span>
            }
            <span class="n">source</span> {
                <span class="n">address</span> !<span class="m">172</span>.<span class="m">22</span>.<span class="m">117</span>.<span class="m">128</span>/<span class="m">25</span>
            }
        }
    }
    <span class="n">name</span> <span class="n">ROUTER_V4</span> {
        <span class="n">default</span>-<span class="n">action</span> <span class="n">accept</span>
        <span class="n">rule</span> <span class="m">2</span> {
            <span class="n">action</span> <span class="n">accept</span>
            <span class="n">protocol</span> <span class="n">icmp</span>
        }
        <span class="n">rule</span> <span class="m">10</span> {
            <span class="n">action</span> <span class="n">drop</span>
            <span class="n">destination</span> {
                <span class="n">port</span> <span class="m">22</span>
            }
            <span class="n">protocol</span> <span class="n">tcp</span>
        }
    }
    <span class="n">name</span> <span class="n">WAN_IN_V4</span> {
        <span class="n">default</span>-<span class="n">action</span> <span class="n">drop</span>
        <span class="n">enable</span>-<span class="n">default</span>-<span class="n">log</span>
        <span class="n">rule</span> <span class="m">1</span> {
            <span class="n">action</span> <span class="n">accept</span>
            <span class="n">description</span> <span class="s2">"allow established connections"</span>
            <span class="n">protocol</span> <span class="n">all</span>
            <span class="n">state</span> {
                <span class="n">established</span> <span class="n">enable</span>
                <span class="n">related</span> <span class="n">enable</span>
            }
        }
        <span class="n">rule</span> <span class="m">2</span> {
            <span class="n">action</span> <span class="n">drop</span>
            <span class="n">state</span> {
                <span class="n">invalid</span> <span class="n">enable</span>
            }
        }
        <span class="n">rule</span> <span class="m">3</span> {
            <span class="n">action</span> <span class="n">drop</span>
            <span class="n">destination</span> {
                <span class="n">port</span> <span class="m">22</span>
            }
            <span class="n">protocol</span> <span class="n">tcp</span>
        }
    }
    <span class="n">receive</span>-<span class="n">redirects</span> <span class="n">disable</span>
    <span class="n">send</span>-<span class="n">redirects</span> <span class="n">enable</span>
    <span class="n">source</span>-<span class="n">validation</span> <span class="n">disable</span>
    <span class="n">syn</span>-<span class="n">cookies</span> <span class="n">enable</span>
}
<span class="n">interfaces</span> {
    <span class="n">ethernet</span> <span class="n">eth0</span> {
        <span class="n">duplex</span> <span class="n">auto</span>
        <span class="n">firewall</span> {
            <span class="n">in</span> {
                <span class="n">name</span> <span class="n">WAN_IN_V4</span>
            }
        }
        <span class="n">pppoe</span> <span class="m">0</span> {
            <span class="n">default</span>-<span class="n">route</span> <span class="n">auto</span>
            <span class="n">firewall</span> {
                <span class="n">local</span> {
                    <span class="n">ipv6</span>-<span class="n">name</span> <span class="n">ROUTER_V6</span>
                    <span class="n">name</span> <span class="n">ROUTER_V4</span>
                }
            }
            <span class="n">mtu</span> <span class="m">1492</span>
            <span class="n">name</span>-<span class="n">server</span> <span class="n">auto</span>
            <span class="n">password</span> <span class="m">12345678</span>
            <span class="n">traffic</span>-<span class="n">policy</span> {
            }
            <span class="n">user</span>-<span class="n">id</span> <span class="n">some</span>-<span class="n">t</span>-<span class="n">online</span>-<span class="n">crap</span>@<span class="n">t</span>-<span class="n">online</span>.<span class="n">de</span>
        }
        <span class="n">speed</span> <span class="n">auto</span>
    }
    <span class="n">ethernet</span> <span class="n">eth1</span> {
        <span class="n">address</span> <span class="m">172</span>.<span class="m">22</span>.<span class="m">117</span>.<span class="m">254</span>/<span class="m">25</span>
        <span class="n">duplex</span> <span class="n">auto</span>
        <span class="n">speed</span> <span class="n">auto</span>
        <span class="n">traffic</span>-<span class="n">policy</span> {
        }
    }
    <span class="n">ethernet</span> <span class="n">eth2</span> {
        <span class="n">address</span> <span class="m">192</span>.<span class="m">168</span>.<span class="m">42</span>.<span class="m">1</span>/<span class="m">24</span>
        <span class="n">duplex</span> <span class="n">auto</span>
        <span class="n">speed</span> <span class="n">auto</span>
    }
    <span class="n">loopback</span> <span class="n">lo</span> {
    }
    <span class="n">openvpn</span> <span class="n">vtun0</span> {
        <span class="n">local</span>-<span class="n">address</span> <span class="m">172</span>.<span class="m">22</span>.<span class="m">117</span>.<span class="m">254</span> {
            <span class="n">subnet</span>-<span class="n">mask</span> <span class="m">255</span>.<span class="m">255</span>.<span class="m">255</span>.<span class="m">128</span>
        }
        <span class="n">local</span>-<span class="n">port</span> <span class="m">33121</span>
        <span class="n">mode</span> <span class="n">site</span>-<span class="n">to</span>-<span class="n">site</span>
        <span class="n">openvpn</span>-<span class="n">option</span> --<span class="n">comp</span>-<span class="n">lzo</span>
        <span class="n">protocol</span> <span class="n">udp</span>
        <span class="n">remote</span>-<span class="n">address</span> <span class="m">172</span>.<span class="m">22</span>.<span class="m">117</span>.<span class="m">1</span>
        <span class="n">remote</span>-<span class="n">host</span> <span class="m">5</span>.<span class="m">9</span>.<span class="m">33</span>.<span class="m">163</span>
        <span class="n">remote</span>-<span class="n">port</span> <span class="m">33121</span>
        <span class="n">shared</span>-<span class="n">secret</span>-<span class="n">key</span>-<span class="n">file</span> /<span class="n">config</span>/<span class="n">auth</span>/<span class="n">felihome</span>.<span class="n">key</span>
    }
}
<span class="n">policy</span> {
    <span class="n">prefix</span>-<span class="n">list</span> <span class="n">vpn</span>-<span class="n">in</span> {
        <span class="n">rule</span> <span class="m">10</span> {
            <span class="n">action</span> <span class="n">permit</span>
            <span class="n">ge</span> <span class="m">22</span>
            <span class="n">le</span> <span class="m">28</span>
            <span class="n">prefix</span> <span class="m">172</span>.<span class="m">22</span>.<span class="m">0</span>.<span class="m">0</span>/<span class="m">15</span>
        }
    }
}
<span class="n">protocols</span> {
    <span class="n">bgp</span> <span class="m">76197</span> {
        <span class="n">neighbor</span> <span class="m">172</span>.<span class="m">22</span>.<span class="m">117</span>.<span class="m">1</span> {
            <span class="n">description</span> <span class="n">feli</span>-<span class="n">server</span>
            <span class="n">peer</span>-<span class="n">group</span> <span class="n">dn42</span>
            <span class="n">remote</span>-<span class="n">as</span> <span class="m">64717</span>
        }
        <span class="n">network</span> <span class="m">172</span>.<span class="m">22</span>.<span class="m">117</span>.<span class="m">128</span>/<span class="m">25</span> {
        }
        <span class="n">peer</span>-<span class="n">group</span> <span class="n">dn42</span> {
            <span class="n">soft</span>-<span class="n">reconfiguration</span> {
                <span class="n">inbound</span>
            }
        }
    }
}
<span class="n">service</span> {
    <span class="n">dhcp</span>-<span class="n">server</span> {
        <span class="n">disabled</span> <span class="n">false</span>
        <span class="n">dynamic</span>-<span class="n">dns</span>-<span class="n">update</span> {
            <span class="n">enable</span> <span class="n">true</span>
        }
        <span class="n">shared</span>-<span class="n">network</span>-<span class="n">name</span> <span class="n">int</span> {
            <span class="n">authoritative</span> <span class="n">disable</span>
            <span class="n">subnet</span> <span class="m">172</span>.<span class="m">22</span>.<span class="m">117</span>.<span class="m">128</span>/<span class="m">25</span> {
                <span class="n">default</span>-<span class="n">router</span> <span class="m">172</span>.<span class="m">22</span>.<span class="m">117</span>.<span class="m">254</span>
                <span class="n">dns</span>-<span class="n">server</span> <span class="m">172</span>.<span class="m">22</span>.<span class="m">117</span>.<span class="m">254</span>
                <span class="n">domain</span>-<span class="n">name</span> <span class="n">feli</span>-<span class="n">home</span>.<span class="n">felicitus</span>.<span class="n">org</span>
                <span class="n">lease</span> <span class="m">86400</span>
                <span class="n">start</span> <span class="m">172</span>.<span class="m">22</span>.<span class="m">117</span>.<span class="m">129</span> {
                    <span class="n">stop</span> <span class="m">172</span>.<span class="m">22</span>.<span class="m">117</span>.<span class="m">150</span>
                }
                <span class="n">static</span>-<span class="n">mapping</span> <span class="n">monitoring</span> {
                    <span class="n">ip</span>-<span class="n">address</span> <span class="m">172</span>.<span class="m">22</span>.<span class="m">117</span>.<span class="m">183</span>
                    <span class="n">mac</span>-<span class="n">address</span> <span class="m">52</span>:<span class="m">54</span>:<span class="m">00</span>:<span class="m">20</span>:<span class="n">df</span>:<span class="m">46</span>
                }
                <span class="n">static</span>-<span class="n">mapping</span> <span class="n">nas</span> {
                    <span class="n">ip</span>-<span class="n">address</span> <span class="m">172</span>.<span class="m">22</span>.<span class="m">117</span>.<span class="m">181</span>
                    <span class="n">mac</span>-<span class="n">address</span> <span class="n">e8</span>:<span class="m">39</span>:<span class="m">35</span>:<span class="n">ee</span>:<span class="m">22</span>:<span class="m">7</span><span class="n">b</span>
                }
            }
        }
        <span class="n">shared</span>-<span class="n">network</span>-<span class="n">name</span> <span class="n">nat</span> {
            <span class="n">authoritative</span> <span class="n">disable</span>
            <span class="n">subnet</span> <span class="m">192</span>.<span class="m">168</span>.<span class="m">42</span>.<span class="m">0</span>/<span class="m">24</span> {
                <span class="n">default</span>-<span class="n">router</span> <span class="m">192</span>.<span class="m">168</span>.<span class="m">42</span>.<span class="m">1</span>
                <span class="n">dns</span>-<span class="n">server</span> <span class="m">8</span>.<span class="m">8</span>.<span class="m">8</span>.<span class="m">8</span>
                <span class="n">dns</span>-<span class="n">server</span> <span class="m">8</span>.<span class="m">8</span>.<span class="m">4</span>.<span class="m">4</span>
                <span class="n">lease</span> <span class="m">86400</span>
                <span class="n">start</span> <span class="m">192</span>.<span class="m">168</span>.<span class="m">42</span>.<span class="m">10</span> {
                    <span class="n">stop</span> <span class="m">192</span>.<span class="m">168</span>.<span class="m">42</span>.<span class="m">100</span>
                }
            }
        }
    }
    <span class="n">dns</span> {
        <span class="n">forwarding</span> {
            <span class="n">cache</span>-<span class="n">size</span> <span class="m">150</span>
            <span class="n">listen</span>-<span class="n">on</span> <span class="n">eth1</span>
            <span class="n">listen</span>-<span class="n">on</span> <span class="n">eth2</span>
            <span class="n">name</span>-<span class="n">server</span> <span class="m">8</span>.<span class="m">8</span>.<span class="m">8</span>.<span class="m">8</span>
            <span class="n">name</span>-<span class="n">server</span> <span class="m">8</span>.<span class="m">8</span>.<span class="m">4</span>.<span class="m">4</span>
            <span class="n">options</span> <span class="n">server</span>=/<span class="n">dn42</span>/<span class="m">172</span>.<span class="m">23</span>.<span class="m">0</span>.<span class="m">53</span>
            <span class="n">options</span> <span class="n">server</span>=/<span class="m">22</span>.<span class="m">172</span>.<span class="n">in</span>-<span class="n">addr</span>.<span class="n">arpa</span>/<span class="m">172</span>.<span class="m">23</span>.<span class="m">0</span>.<span class="m">53</span>
            <span class="n">options</span> <span class="n">server</span>=/<span class="m">23</span>.<span class="m">172</span>.<span class="n">in</span>-<span class="n">addr</span>.<span class="n">arpa</span>/<span class="m">172</span>.<span class="m">23</span>.<span class="m">0</span>.<span class="m">53</span>
            <span class="n">options</span> <span class="n">rebind</span>-<span class="n">domain</span>-<span class="n">ok</span>=/<span class="n">dn42</span>/
        }
    }
    <span class="n">nat</span> {
        <span class="n">rule</span> <span class="m">6000</span> {
            <span class="n">outbound</span>-<span class="n">interface</span> <span class="n">pppoe0</span>
            <span class="n">type</span> <span class="n">masquerade</span>
        }
        <span class="n">rule</span> <span class="m">7000</span> {
            <span class="n">outbound</span>-<span class="n">interface</span> <span class="n">eth2</span>
            <span class="n">type</span> <span class="n">masquerade</span>
        }
    }
    <span class="n">ssh</span> {
        <span class="n">port</span> <span class="m">22</span>
        <span class="n">protocol</span>-<span class="n">version</span> <span class="n">v2</span>
    }
    <span class="n">upnp</span> {
        <span class="n">listen</span>-<span class="n">on</span> <span class="n">eth1</span> {
            <span class="n">outbound</span>-<span class="n">interface</span> <span class="n">pppoe0</span>
        }
        <span class="n">listen</span>-<span class="n">on</span> <span class="n">eth2</span> {
            <span class="n">outbound</span>-<span class="n">interface</span> <span class="n">pppoe0</span>
        }
    }
}
<span class="n">system</span> {
    <span class="n">host</span>-<span class="n">name</span> <span class="n">ubnt</span>
    <span class="n">login</span> {
        <span class="n">user</span> <span class="n">felicitus</span> {
            <span class="n">authentication</span> {
                <span class="n">encrypted</span>-<span class="n">password</span> <span class="n">errnope</span>
                <span class="n">plaintext</span>-<span class="n">password</span> <span class="s2">""</span>
                <span class="n">public</span>-<span class="n">keys</span> <span class="n">felicitus</span>@<span class="n">felicitus</span>.<span class="n">org</span> {
                    <span class="n">key</span> <span class="n">AAAAB3NzaC1yc2EAAAADAQABAAABAQDPTSLjSY</span>/<span class="n">Be1XJ</span>/<span class="n">klAwLiM1pKSvmbdcOgtgDB6nPcHkgX6JZu7g</span>/<span class="n">Kejfuk4qIKL8GYYUQt7DlGY6n2u5rChWE</span>/<span class="m">6</span><span class="n">KZJzXcUwS3pXk4LZ5KydWp7ihfvyRtUOBgKkRa1zQv</span>+<span class="m">6</span><span class="n">KCH9WyR</span>++<span class="n">ArwVTP8KSkrmDe6k7NWAjZqOuIJHG</span>/<span class="n">AbEyTBapTJYjObZ0AM7wlwcB</span>+<span class="n">oRM1BfZCP0Y</span>+<span class="n">PIP2eGJS7Pyb32pITNKk3JuFXgAvbj5OeRrwtpZ9S</span>+/<span class="m">7</span><span class="n">wIpaUVODPzrVmbC7vOXu</span>/<span class="m">2</span><span class="n">KJ9aY2BmxUsxRbrvWMmWNiuE0YPt</span>/<span class="m">7</span><span class="n">lUroK4pH3md3lWRcGUS</span>/<span class="n">uYvhug7yG1yB81nyI15</span>
                    <span class="n">type</span> <span class="n">ssh</span>-<span class="n">rsa</span>
                }
            }
            <span class="n">level</span> <span class="n">admin</span>
        }
    }
    <span class="n">name</span>-<span class="n">server</span> <span class="m">172</span>.<span class="m">22</span>.<span class="m">117</span>.<span class="m">254</span>
    <span class="n">ntp</span> {
        <span class="n">server</span> <span class="m">0</span>.<span class="n">ubnt</span>.<span class="n">pool</span>.<span class="n">ntp</span>.<span class="n">org</span> {
        }
        <span class="n">server</span> <span class="m">1</span>.<span class="n">ubnt</span>.<span class="n">pool</span>.<span class="n">ntp</span>.<span class="n">org</span> {
        }
        <span class="n">server</span> <span class="m">2</span>.<span class="n">ubnt</span>.<span class="n">pool</span>.<span class="n">ntp</span>.<span class="n">org</span> {
        }
        <span class="n">server</span> <span class="m">3</span>.<span class="n">ubnt</span>.<span class="n">pool</span>.<span class="n">ntp</span>.<span class="n">org</span> {
        }
    }
    <span class="n">syslog</span> {
        <span class="n">global</span> {
            <span class="n">facility</span> <span class="n">all</span> {
                <span class="n">level</span> <span class="n">notice</span>
            }
            <span class="n">facility</span> <span class="n">protocols</span> {
                <span class="n">level</span> <span class="n">debug</span>
            }
        }
    }
    <span class="n">time</span>-<span class="n">zone</span> <span class="n">UTC</span>
}
<span class="n">traffic</span>-<span class="n">policy</span> {
    <span class="n">shaper</span> <span class="n">client</span>-<span class="n">up</span>-<span class="n">s</span> {
        <span class="n">bandwidth</span> <span class="m">30</span><span class="n">kbit</span>
        <span class="n">class</span> <span class="m">20</span> {
            <span class="n">bandwidth</span> <span class="m">100</span>%
            <span class="n">burst</span> <span class="m">6</span><span class="n">k</span>
            <span class="n">match</span> <span class="n">TCPACK</span> {
                <span class="n">ip</span> {
                    <span class="n">protocol</span> <span class="n">tcp</span>
                }
                <span class="n">mark</span> <span class="m">225</span>
            }
            <span class="n">priority</span> <span class="m">5</span>
            <span class="n">queue</span>-<span class="n">limit</span> <span class="m">65</span>
            <span class="n">queue</span>-<span class="n">type</span> <span class="n">fair</span>-<span class="n">queue</span>
        }
        <span class="n">class</span> <span class="m">30</span> {
            <span class="n">bandwidth</span> <span class="m">5</span>%
            <span class="n">burst</span> <span class="m">15</span><span class="n">k</span>
            <span class="n">ceiling</span> <span class="m">20</span>%
            <span class="n">match</span> <span class="n">ssh</span> {
                <span class="n">ip</span> {
                    <span class="n">destination</span> {
                        <span class="n">port</span> <span class="m">22</span>
                    }
                    <span class="n">dscp</span> <span class="n">lowdelay</span>
                    <span class="n">protocol</span> <span class="n">tcp</span>
                }
            }
            <span class="n">match</span> <span class="n">ssh</span>-<span class="n">ipv6</span> {
                <span class="n">ipv6</span> {
                    <span class="n">destination</span> {
                        <span class="n">port</span> <span class="m">22</span>
                    }
                    <span class="n">protocol</span> <span class="n">tcp</span>
                }
            }
            <span class="n">priority</span> <span class="m">6</span>
            <span class="n">queue</span>-<span class="n">limit</span> <span class="m">10</span>
            <span class="n">queue</span>-<span class="n">type</span> <span class="n">fair</span>-<span class="n">queue</span>
        }
        <span class="n">default</span> {
            <span class="n">bandwidth</span> <span class="m">95</span>%
            <span class="n">burst</span> <span class="m">15</span><span class="n">k</span>
            <span class="n">ceiling</span> <span class="m">100</span>%
            <span class="n">priority</span> <span class="m">2</span>
            <span class="n">queue</span>-<span class="n">limit</span> <span class="m">13</span>
            <span class="n">queue</span>-<span class="n">type</span> <span class="n">fair</span>-<span class="n">queue</span>
        }
    }
}


/* <span class="n">Warning</span>: <span class="n">Do</span> <span class="n">not</span> <span class="n">remove</span> <span class="n">the</span> <span class="n">following</span> <span class="n">line</span>. */
/* === <span class="n">vyatta</span>-<span class="n">config</span>-<span class="n">version</span>: <span class="s2">"config-management@1:dhcp-relay@1:dhcp-server@4:firewall@4:ipsec@3:nat@3:qos@1:quagga@2:system@4:ubnt-pptp@1:ubnt-util@1:vrrp@1:webgui@1:webproxy@1:zone-policy@1"</span> === */
/* <span class="n">Release</span> <span class="n">version</span>: <span class="n">v1</span>.<span class="m">3</span>.<span class="m">0</span>.<span class="m">4605130</span>.<span class="m">131011</span>.<span class="m">1754</span> */
</code></pre></div></div>


            <div id="menu-container" class="menu-container">
                <hr>
                <div id="menu" class="menu">
                    
                    <ul>
  <li><a href="/Home">Home</a>
    <ul>
      <li><a href="/howto/Getting-Started">Getting Started</a></li>
      <li><a href="/howto/Registry-Authentication">Registry Authentication</a></li>
      <li><a href="/howto/Address-Space">Address Space</a></li>
      <li><a href="/howto/BGP-communities">BGP communities</a></li>
      <li><a href="/FAQ">FAQ</a></li>
    </ul>
  </li>
  <li>How-To
    <ul>
      <li><a href="/howto/wireguard">Wireguard</a></li>
      <li><a href="/howto/openvpn">Openvpn</a></li>
      <li><a href="/howto/IPsec-with-PublicKeys">IPsec With Public Keys</a></li>
      <li><a href="/howto/tinc">Tinc</a></li>
      <li><a href="/howto/GRE-on-FreeBSD">GRE on FreeBSD</a></li>
      <li><a href="/howto/GRE-on-OpenBSD">GRE on OpenBSD</a></li>
      <li><a href="/howto/IPv6-Multicast">IPv6 Multicast (PIM-SM)</a></li>
      <li><a href="/howto/multicast">SSM Multicast</a></li>
      <li><a href="/howto/mpls">MPLS</a></li>
      <li><a href="/howto/Bird2">Bird2</a></li>
      <li><a href="/howto/frr">FRRouting</a></li>
      <li><a href="/howto/OpenBGPD">OpenBGPD</a></li>
      <li><a href="/howto/mikrotik">Mikrotik RouterOS</a></li>
      <li><a href="/howto/EdgeOS-Config">EdgeRouter</a></li>
      <li><a href="/howto/Static-routes-on-Windows">Static routes on Windows</a></li>
      <li><a href="/howto/networksettings">Universal Network Requirements</a></li>
      <li><a href="/howto/vyos1.4.x">VyOS</a></li>
      <li><a href="/howto/nixos">NixOS</a></li>
    </ul>
  </li>
  <li>Services
    <ul>
      <li><a href="/services/IRC">IRC</a></li>
      <li><a href="/services/Whois">Whois registry</a></li>
      <li><a href="/services/DNS">DNS</a></li>
      <li><a href="/services/IX-Collection">IX Collection</a></li>
      <li><a href="/services/Clearnet-Domains">Public DNS</a></li>
      <li><a href="/services/Looking-Glasses">Looking Glasses</a></li>
      <li><a href="/services/Automatic-Peering">Automatic Peering</a></li>
      <li><a href="/services/Repository-Mirrors">Repository Mirrors</a></li>
      <li><a href="/services/Distributed-Wiki">Distributed Wiki</a></li>
      <li><a href="/services/Certificate-Authority">Certificate Authority</a></li>
      <li><a href="/services/Route-Collector">Route Collector</a></li>
    </ul>
  </li>
  <li>Internal
    <ul>
      <li><a href="/internal/Internal-Services">Internal services</a></li>
      <li><a href="/internal/Interconnections">Interconnections</a></li>
      <li><a href="/internal/APIs">APIs</a></li>
      <li><a href="/internal/ShowAndTell">Show and Tell</a></li>
      <li><a href="/internal/Historical-Services">Historical services</a></li>
    </ul>
  </li>
  <li>Historical
    <ul>
      <li><a href="/historical/Bird">Bird 1</a></li>
      <li><a href="/historical/Quagga">Quagga</a></li>
    </ul>
  </li>
  <li>External Tools
    <ul>
      <li><a href="https://paste.dn42.us">Paste Board</a></li>
      <li><a href="https://git.dn42.dev">Git Repositories</a></li>
    </ul>
  </li>
</ul>

<hr />


                </div>
            </div>
        </main>
        
        <footer><div class="center">
    <div id="dn42_footer">
        
        <table>
  <tbody>
    <tr>
      <td>Hosted by: <a href="mailto:dn42@burble.com">BURBLE-MNT</a>, <a href="mailto:nurtic-vibe@grmml.net">GRMML-MNT</a>, <a href="mailto:xuu@dn42.us">XUU-MNT</a>, <a href="mailto:janeric@ortgies.it">JAN-MNT</a>, <a href="mailto:lare@lare.cc">LARE-MNT</a>, <a href="mailto:danny@saru.moe">SARU-MNT</a>, <a href="mailto:androw95220@gmail.com">ANDROW-MNT</a>, <a href="mailto:dn42@mk16.de">MARK22K-MNT</a></td>
      <td>Accessible via: <a href="https://wiki.dn42">dn42</a>, <a href="https://dn42.dev/">dn42.dev</a>, <a href="https://dn42.eu/">dn42.eu</a>, <a href="https://wiki.dn42.us/">wiki.dn42.us</a>, <a href="https://dn42.de/">dn42.de</a> (IPv6-only), <a href="https://dn42.cc/">dn42.cc</a> (wiki-ng), <a href="https://dn42.wiki/">dn42.wiki</a>, <a href="https://dn42.pp.ua/">dn42.pp.ua</a>, <a href="https://dn42.obl.ong/">dn42.obl.ong</a></td>
    </tr>
  </tbody>
</table>

    </div>
</div>
</footer>

        
    </body>

</html>