firewall {
    global-options {
        state-policy {
            established {
                action "accept"
            }
            invalid {
                action "drop"
            }
            related {
                action "accept"
            }
        }
    }
    group {
        address-group remote_admin {
            address "10.0.0.1-10.0.1.254"
        }
        interface-group LAN {
            interface "eth0"
        }
        interface-group WAN {
            interface "eth1"
        }
        network-group LAN-IPV4 {
            network "10.0.0.0/23"
        }
    }
    ipv4 {
        forward {
            filter {
                default-action "accept"
                rule 5 {
                    action "jump"
                    inbound-interface {
                        name "eth1"
                    }
                    jump-target "WAN_IN"
                }
            }
        }
        input {
            filter {
                default-action "accept"
                rule 5 {
                    action "jump"
                    inbound-interface {
                        name "eth1"
                    }
                    jump-target "WAN_LOCAL"
                }
            }
        }
        name WAN_IN {
            default-action "drop"
            description "WAN to internal"
            rule 2 {
                action "accept"
                description "Allow established/related"
                state "established"
                state "related"
            }
            rule 10 {
                action "accept"
                description "Allow remote admin"
                source {
                    group {
                        address-group "remote_admin"
                    }
                }
                state "new"
            }
            rule 20 {
                action "accept"
                description "Drop invalid state"
                state "invalid"
                state "new"
            }
            rule 30 {
                action "accept"
                destination {
                    address "10.0.0.15"
                    port "25"
                }
                protocol "tcp"
                state "new"
            }
            rule 40 {
                action "accept"
                destination {
                    address "10.0.0.12"
                    port "443"
                }
                protocol "tcp"
                state "new"
            }
            rule 50 {
                action "accept"
                destination {
                    address "10.0.0.17"
                    port "443"
                }
                protocol "tcp"
                state "new"
            }
            rule 60 {
                action "accept"
                destination {
                    address "10.0.0.154"
                    port "32400"
                }
                protocol "tcp"
                state "new"
            }
        }
        name WAN_LOCAL {
            default-action "drop"
            description "WAN to router"
            rule 10 {
                action "accept"
                description "Allow established/related."
                state "established"
                state "related"
            }
            rule 20 {
                action "drop"
                description "Drop invalid state"
                state "invalid"
            }
            rule 30 {
                action "accept"
                description "Allow ICMP."
                protocol "icmp"
                state "established"
                state "related"
            }
        }
    }
}
interfaces {
    ethernet eth0 {
        address "10.0.1.1/23"
        description "INSIDE"
        hw-id "00:08:9b:e0:0c:80"
        offload {
            gro
            gso
            sg
            tso
        }
    }
    ethernet eth1 {
        address "dhcp"
        address "192.168.0.2/24"
        description "OUTSIDE"
        hw-id "00:08:9b:e0:0c:81"
        offload {
            gro
            gso
            sg
            tso
        }
    }
    loopback lo {
    }
}
nat {
    destination {
        rule 50 {
            description "Port SMTP"
            destination {
                port "25"
            }
            inbound-interface {
                name "eth1"
            }
            protocol "tcp_udp"
            translation {
                address "10.0.0.15"
                port "25"
            }
        }
        rule 100 {
            description "Port Proxy HTTP"
            destination {
                port "8131"
            }
            inbound-interface {
                name "eth1"
            }
            protocol "tcp_udp"
            translation {
                address "10.0.0.12"
                port "443"
            }
        }
        rule 200 {
            description "Port Proxy HTTP"
            destination {
                port "8191"
            }
            inbound-interface {
                name "eth1"
            }
            protocol "tcp_udp"
            translation {
                address "10.0.0.17"
                port "443"
            }
        }
        rule 300 {
            description "Plex Remote Access"
            destination {
                port "8192"
            }
            inbound-interface {
                name "eth1"
            }
            protocol "tcp_udp"
            translation {
                address "10.0.0.154"
                port "32400"
            }
        }
    }
    source {
        rule 100 {
            outbound-interface {
                group "WAN"
            }
            source {
                group {
                    network-group "LAN-IPV4"
                }
            }
            translation {
                address "masquerade"
            }
        }
    }
}
protocols {
    static {
        route 0.0.0.0/0 {
            dhcp-interface "eth1"
            next-hop 192.168.0.1 {
            }
        }
    }
}
qos {
    interface eth1 {
        egress "WAN_QUEUE"
    }
    policy {
        shaper WAN_QUEUE {
            bandwidth "100mbit"
            default {
                bandwidth "100%"
                queue-type "fq-codel"
            }
        }
    }
}
service {
        }
    }
    dns {
        dynamic {
        }
        forwarding {
            allow-from "10.0.0.0/23"
            listen-address "10.0.1.1"
            system
        }
    }
    ntp {
        allow-client {
            address "127.0.0.0/8"
            address "169.254.0.0/16"
            address "10.0.0.0/8"
            address "172.16.0.0/12"
            address "192.168.0.0/16"
            address "::1/128"
            address "fe80::/10"
            address "fc00::/7"
            address "10.0.0.0/23"
        }
        server 0.uk.pool.ntp.org {
        }
    }
    snmp {
        community routers {
            authorization "ro"
            network "10.0.0.0/23"
        }
        
        listen-address 10.0.1.1 {
            port "161"
        }
        location "UK, Denton"
    }
    ssh {
        dynamic-protection {
            allow-from "10.0.0.0/23"
            block-time "120"
            detect-time "1800"
            threshold "30"
        }
        listen-address "10.0.1.1"
        port "8181"
    }
}
system {
    config-management {
        commit-revisions "100"
    }
    conntrack {
        modules {
            ftp
            h323
            nfs
            pptp
            sip
            sqlnet
            tftp
        }
    }
    console {
        device ttyS0 {
            speed "115200"
        }
    }
    host-name "vyos"
    login {
        operator-group default {
            command-policy {
                allow "*"
            }
        }
        user admin {
            authentication {
                public-keys rsa-key-20230730 {
                    type "ssh-rsa"
                }
            }
        }
    }
    name-server "10.0.0.252"
    option {
        kernel {
            disable-mitigations
            disable-power-saving
        }
        keyboard-layout "uk"
        performance "network-throughput"
        reboot-on-upgrade-failure "5"
    }
    syslog {
        local {
            facility all {
                level "info"
            }
            facility local7 {
                level "debug"
            }
        }
    }
    time-zone "Europe/London"
    update-check {
        auto-check
        url "https://raw.githubusercontent.com/vyos/vyos-rolling-nightly-builds/main/version.json"
    }
}