Jean-Gabriel Gill-Couture
da5a869771
All checks were successful
Run Check Script / check (pull_request) Successful in 59s
Co-authored-by: Jean-Gabriel Gill-Couture <jeangabriel.gc@gmail.com> Co-authored-by: Ian Letourneau <ian@noma.to> Reviewed-on: https://git.nationtech.io/NationTech/harmony/pulls/130 Reviewed-by: Ian Letourneau <ian@noma.to> Co-authored-by: Jean-Gabriel Gill-Couture <jg@nationtech.io> Co-committed-by: Jean-Gabriel Gill-Couture <jg@nationtech.io>
1431 lines
46 KiB
XML
1431 lines
46 KiB
XML
<?xml version="1.0"?>
|
|
<opnsense>
|
|
<theme>opnsense</theme>
|
|
<sysctl>
|
|
<item>
|
|
<descr>Increase UFS read-ahead speeds to match the state of hard drives and NCQ.</descr>
|
|
<tunable>vfs.read_max</tunable>
|
|
<value>default</value>
|
|
</item>
|
|
<item>
|
|
<descr>Set the ephemeral port range to be lower.</descr>
|
|
<tunable>net.inet.ip.portrange.first</tunable>
|
|
<value>default</value>
|
|
</item>
|
|
</sysctl>
|
|
<system>
|
|
<use_mfs_tmp/>
|
|
<use_mfs_var/>
|
|
<serialspeed>115200</serialspeed>
|
|
<primaryconsole>serial</primaryconsole>
|
|
<secondaryconsole>video</secondaryconsole>
|
|
<optimization>normal</optimization>
|
|
<hostname>OPN1</hostname>
|
|
<domain>somedomain.yourlocal.mcd</domain>
|
|
<group>
|
|
<name>admins</name>
|
|
<description>System Administrators</description>
|
|
<scope>system</scope>
|
|
<gid>1999</gid>
|
|
<member>2000</member>
|
|
<priv>page-all</priv>
|
|
</group>
|
|
<user>
|
|
<name>root</name>
|
|
<descr>System Administrator</descr>
|
|
<scope>system</scope>
|
|
<groupname>admins</groupname>
|
|
<password>$2y$10$5555555555o8dj21980j1doiOIJDIOASJOID!jidjeue19812y</password>
|
|
<uid>0</uid>
|
|
<expires/>
|
|
<authorizedkeys/>
|
|
<ipsecpsk/>
|
|
<otp_seed/>
|
|
</user>
|
|
<user>
|
|
<password>$2y$11$55555555556D8198uOASIDJaiojdjd1oijdijosaoijdaoidOIASJDoijdoiadOASdoiK</password>
|
|
<scope>user</scope>
|
|
<name>someuser</name>
|
|
<descr/>
|
|
<expires/>
|
|
<authorizedkeys/>
|
|
<ipsecpsk/>
|
|
<otp_seed/>
|
|
<shell>/bin/sh</shell>
|
|
<uid>2000</uid>
|
|
</user>
|
|
<nextuid>2001</nextuid>
|
|
<nextgid>2000</nextgid>
|
|
<timezone>Etc/UTC</timezone>
|
|
<timeservers>0.opnsense.pool.ntp.org 1.opnsense.pool.ntp.org 2.opnsense.pool.ntp.org 3.opnsense.pool.ntp.org</timeservers>
|
|
<webgui>
|
|
<protocol>https</protocol>
|
|
<ssl-certref>6155aba4c9375</ssl-certref>
|
|
<port/>
|
|
<ssl-ciphers/>
|
|
<interfaces/>
|
|
<compression/>
|
|
</webgui>
|
|
<usevirtualterminal>1</usevirtualterminal>
|
|
<disablenatreflection>yes</disablenatreflection>
|
|
<disableconsolemenu>1</disableconsolemenu>
|
|
<disablevlanhwfilter>1</disablevlanhwfilter>
|
|
<disablechecksumoffloading>1</disablechecksumoffloading>
|
|
<disablesegmentationoffloading>1</disablesegmentationoffloading>
|
|
<disablelargereceiveoffloading>1</disablelargereceiveoffloading>
|
|
<ipv6allow>1</ipv6allow>
|
|
<powerd_ac_mode>hadp</powerd_ac_mode>
|
|
<powerd_battery_mode>hadp</powerd_battery_mode>
|
|
<powerd_normal_mode>hadp</powerd_normal_mode>
|
|
<bogons>
|
|
<interval>monthly</interval>
|
|
</bogons>
|
|
<crypto_hardware>aesni</crypto_hardware>
|
|
<pf_share_forward>1</pf_share_forward>
|
|
<lb_use_sticky>1</lb_use_sticky>
|
|
<kill_states>1</kill_states>
|
|
<ssh>
|
|
<group>admins</group>
|
|
<noauto>1</noauto>
|
|
<interfaces/>
|
|
<kex/>
|
|
<ciphers/>
|
|
<macs/>
|
|
<keys/>
|
|
<enabled>enabled</enabled>
|
|
<passwordauth>1</passwordauth>
|
|
<keysig/>
|
|
<permitrootlogin>1</permitrootlogin>
|
|
</ssh>
|
|
<firmware version="1.0.1">
|
|
<mirror/>
|
|
<flavour/>
|
|
<plugins>os-ddclient,os-dyndns,os-haproxy,os-wireguard</plugins>
|
|
<type/>
|
|
<subscription/>
|
|
<reboot/>
|
|
</firmware>
|
|
<sudo_allow_wheel>1</sudo_allow_wheel>
|
|
<sudo_allow_group>admins</sudo_allow_group>
|
|
<enablenatreflectionhelper>yes</enablenatreflectionhelper>
|
|
<rulesetoptimization>basic</rulesetoptimization>
|
|
<maximumstates/>
|
|
<maximumfrags/>
|
|
<aliasesresolveinterval/>
|
|
<maximumtableentries/>
|
|
<language>en_US</language>
|
|
<dnsserver/>
|
|
<dns1gw>none</dns1gw>
|
|
<dns2gw>none</dns2gw>
|
|
<dns3gw>none</dns3gw>
|
|
<dns4gw>none</dns4gw>
|
|
<dns5gw>none</dns5gw>
|
|
<dns6gw>none</dns6gw>
|
|
<dns7gw>none</dns7gw>
|
|
<dns8gw>none</dns8gw>
|
|
<dnsallowoverride>1</dnsallowoverride>
|
|
<dnsallowoverride_exclude/>
|
|
</system>
|
|
<interfaces>
|
|
<wan>
|
|
<if>pppoe0</if>
|
|
<descr>WAN</descr>
|
|
<enable>1</enable>
|
|
<lock>1</lock>
|
|
<spoofmac/>
|
|
<ipaddr>pppoe</ipaddr>
|
|
<blockpriv>1</blockpriv>
|
|
<blockbogons>1</blockbogons>
|
|
</wan>
|
|
<lan>
|
|
<if>em1</if>
|
|
<descr>LAN</descr>
|
|
<enable>1</enable>
|
|
<spoofmac/>
|
|
<ipaddr>192.168.20.1</ipaddr>
|
|
<subnet>24</subnet>
|
|
<ipaddrv6>track6</ipaddrv6>
|
|
<track6-interface/>
|
|
<track6-prefix-id>0</track6-prefix-id>
|
|
</lan>
|
|
<lo0>
|
|
<internal_dynamic>1</internal_dynamic>
|
|
<if>lo0</if>
|
|
<descr>Loopback</descr>
|
|
<enable>1</enable>
|
|
<ipaddr>127.0.0.1</ipaddr>
|
|
<type>none</type>
|
|
<virtual>1</virtual>
|
|
<subnet>8</subnet>
|
|
<ipaddrv6>::1</ipaddrv6>
|
|
<subnetv6>128</subnetv6>
|
|
</lo0>
|
|
<opt1>
|
|
<if>em5</if>
|
|
<descr>backup_sync</descr>
|
|
<enable>1</enable>
|
|
<lock>1</lock>
|
|
<spoofmac/>
|
|
<ipaddr>10.10.5.1</ipaddr>
|
|
<subnet>24</subnet>
|
|
</opt1>
|
|
<wireguard>
|
|
<internal_dynamic>1</internal_dynamic>
|
|
<if>wireguard</if>
|
|
<descr>WireGuard (Group)</descr>
|
|
<enable>1</enable>
|
|
<type>group</type>
|
|
<virtual>1</virtual>
|
|
<networks/>
|
|
</wireguard>
|
|
<openvpn>
|
|
<internal_dynamic>1</internal_dynamic>
|
|
<if>openvpn</if>
|
|
<descr>OpenVPN</descr>
|
|
<enable>1</enable>
|
|
<type>group</type>
|
|
<virtual>1</virtual>
|
|
<networks/>
|
|
</openvpn>
|
|
</interfaces>
|
|
<dhcpd>
|
|
<lan>
|
|
<enable>1</enable>
|
|
<gateway>192.168.20.1</gateway>
|
|
<domain>somedomain.yourlocal.mcd</domain>
|
|
<ddnsdomainalgorithm>hmac-md5</ddnsdomainalgorithm>
|
|
<numberoptions>
|
|
<item/>
|
|
</numberoptions>
|
|
<range>
|
|
<from>192.168.20.50</from>
|
|
<to>192.168.20.200</to>
|
|
</range>
|
|
<winsserver/>
|
|
<dnsserver>192.168.20.1</dnsserver>
|
|
<ntpserver/>
|
|
<staticmap>
|
|
<mac>55:55:55:55:55:1c</mac>
|
|
<ipaddr>192.168.20.160</ipaddr>
|
|
<hostname>somehost983</hostname>
|
|
<descr>someservire8</descr>
|
|
<winsserver/>
|
|
<dnsserver/>
|
|
<ntpserver/>
|
|
</staticmap>
|
|
<staticmap>
|
|
<mac>55:55:55:55:55:1c</mac>
|
|
<ipaddr>192.168.20.155</ipaddr>
|
|
<hostname>somehost893</hostname>
|
|
<winsserver/>
|
|
<dnsserver/>
|
|
<ntpserver/>
|
|
</staticmap>
|
|
<staticmap>
|
|
<mac>55:55:55:55:55:1c</mac>
|
|
<ipaddr>192.168.20.50</ipaddr>
|
|
<hostname>hostswitch2</hostname>
|
|
<descr>switch-2 (bottom)</descr>
|
|
<winsserver/>
|
|
<dnsserver/>
|
|
<ntpserver/>
|
|
</staticmap>
|
|
<pool/>
|
|
</lan>
|
|
</dhcpd>
|
|
<snmpd>
|
|
<syslocation/>
|
|
<syscontact/>
|
|
<rocommunity>public</rocommunity>
|
|
</snmpd>
|
|
<syslog>
|
|
<reverse/>
|
|
<preservelogs>3</preservelogs>
|
|
</syslog>
|
|
<nat>
|
|
<outbound>
|
|
<mode>automatic</mode>
|
|
</outbound>
|
|
<rule>
|
|
<protocol>tcp</protocol>
|
|
<interface>wan</interface>
|
|
<category/>
|
|
<ipprotocol>inet</ipprotocol>
|
|
<descr/>
|
|
<tag/>
|
|
<tagged/>
|
|
<poolopts/>
|
|
<associated-rule-id>nat_618812d37b8193.31302503</associated-rule-id>
|
|
<target>host_3</target>
|
|
<local-port>22</local-port>
|
|
<source>
|
|
<any>1</any>
|
|
</source>
|
|
<destination>
|
|
<network>wanip</network>
|
|
<port>55555</port>
|
|
</destination>
|
|
<updated>
|
|
<username>root@192.168.1.118</username>
|
|
<time>1636307667.506</time>
|
|
<description>/firewall_nat_edit.php made changes</description>
|
|
</updated>
|
|
<created>
|
|
<username>root@192.168.1.118</username>
|
|
<time>1636307667.506</time>
|
|
<description>/firewall_nat_edit.php made changes</description>
|
|
</created>
|
|
</rule>
|
|
<rule>
|
|
<protocol>tcp</protocol>
|
|
<interface>wan</interface>
|
|
<category/>
|
|
<ipprotocol>inet</ipprotocol>
|
|
<descr/>
|
|
<tag/>
|
|
<tagged/>
|
|
<poolopts/>
|
|
<associated-rule-id>nat_651ffc35e573d9.09092618</associated-rule-id>
|
|
<target>192.168.20.140</target>
|
|
<local-port>22</local-port>
|
|
<source>
|
|
<any>1</any>
|
|
</source>
|
|
<destination>
|
|
<network>wanip</network>
|
|
<port>30140</port>
|
|
</destination>
|
|
<updated>
|
|
<username>root@172.12.0.11</username>
|
|
<time>1696594997.9399</time>
|
|
<description>/firewall_nat_edit.php made changes</description>
|
|
</updated>
|
|
<created>
|
|
<username>root@172.12.0.11</username>
|
|
<time>1696594997.9399</time>
|
|
<description>/firewall_nat_edit.php made changes</description>
|
|
</created>
|
|
</rule>
|
|
</nat>
|
|
<filter>
|
|
<rule uuid="36bf9a49-7705-40d4-9ea8-815a215ce007">
|
|
<type>pass</type>
|
|
<interface>wan</interface>
|
|
<ipprotocol>inet</ipprotocol>
|
|
<statetype>keep state</statetype>
|
|
<descr>allow public connections to vpn</descr>
|
|
<direction>in</direction>
|
|
<category>wireguard</category>
|
|
<quick>1</quick>
|
|
<protocol>udp</protocol>
|
|
<source>
|
|
<any>1</any>
|
|
</source>
|
|
<destination>
|
|
<network>wanip</network>
|
|
<port>51820</port>
|
|
</destination>
|
|
<updated>
|
|
<username>root@192.168.1.118</username>
|
|
<time>1636306863.2747</time>
|
|
<description>/firewall_rules_edit.php made changes</description>
|
|
</updated>
|
|
<created>
|
|
<username>root@192.168.1.118</username>
|
|
<time>1636305029.8036</time>
|
|
<description>/firewall_rules_edit.php made changes</description>
|
|
</created>
|
|
</rule>
|
|
<rule>
|
|
<associated-rule-id>nat_670979b3279551.73601303</associated-rule-id>
|
|
<interface>wan</interface>
|
|
<ipprotocol>inet</ipprotocol>
|
|
<statetype>keep state</statetype>
|
|
<descr>port forwarding for virtual ip for someservice2 servers</descr>
|
|
<category/>
|
|
<protocol>tcp</protocol>
|
|
<source>
|
|
<any>1</any>
|
|
</source>
|
|
<destination>
|
|
<address>192.168.20.1</address>
|
|
<port>55555</port>
|
|
</destination>
|
|
<created>
|
|
<username>root@172.12.0.12</username>
|
|
<time>1728674227.1622</time>
|
|
<description>/firewall_nat_edit.php made changes</description>
|
|
</created>
|
|
<disabled>1</disabled>
|
|
</rule>
|
|
</filter>
|
|
<load_balancer>
|
|
<monitor_type>
|
|
<name>ICMP</name>
|
|
<type>icmp</type>
|
|
<descr>ICMP</descr>
|
|
<options/>
|
|
</monitor_type>
|
|
<monitor_type>
|
|
<name>TCP</name>
|
|
<type>tcp</type>
|
|
<descr>Generic TCP</descr>
|
|
<options/>
|
|
</monitor_type>
|
|
<monitor_type>
|
|
<name>HTTP</name>
|
|
<type>http</type>
|
|
<descr>Generic HTTP</descr>
|
|
<options>
|
|
<path>/</path>
|
|
<host/>
|
|
<code>200</code>
|
|
</options>
|
|
</monitor_type>
|
|
</load_balancer>
|
|
<ntpd>
|
|
<prefer>0.opnsense.pool.ntp.org</prefer>
|
|
</ntpd>
|
|
<widgets>
|
|
<sequence>system_information-container:00000000-col3:show,traffic_graphs-container:00000001-col3:show,thermal_sensors-container:00000002-col3:show,log-container:00000003-col3:show,services_status-container:00000004-col4:show,gateways-container:00000005-col4:show,interface_list-container:00000006-col4:show,carp_status-container:00000007-col4:show,wireguard-container:00000008-col4:show,dyn_dns_status-container:00000009-col4:show,system_log-container:00000010-col4:show</sequence>
|
|
<column_count>2</column_count>
|
|
</widgets>
|
|
<revision>
|
|
<username>root@172.12.0.12</username>
|
|
<time>1728676391.9878</time>
|
|
<description>/firewall_nat.php made changes</description>
|
|
</revision>
|
|
<OPNsense>
|
|
<captiveportal version="1.0.1">
|
|
<zones/>
|
|
<templates/>
|
|
</captiveportal>
|
|
<cron version="1.0.4">
|
|
<jobs/>
|
|
</cron>
|
|
<Netflow version="1.0.1">
|
|
<capture>
|
|
<interfaces/>
|
|
<egress_only/>
|
|
<version>v9</version>
|
|
<targets/>
|
|
</capture>
|
|
<collect>
|
|
<enable>0</enable>
|
|
</collect>
|
|
<activeTimeout>1800</activeTimeout>
|
|
<inactiveTimeout>15</inactiveTimeout>
|
|
</Netflow>
|
|
<Firewall>
|
|
<Lvtemplate version="0.0.1">
|
|
<templates/>
|
|
</Lvtemplate>
|
|
<Category version="1.0.0">
|
|
<categories>
|
|
<category uuid="1d91d52b-7588-40c5-8c2c-05acdfcf8c1e">
|
|
<name>wireguard</name>
|
|
<auto>1</auto>
|
|
<color/>
|
|
</category>
|
|
</categories>
|
|
</Category>
|
|
<Alias version="1.0.1">
|
|
<geoip>
|
|
<url/>
|
|
</geoip>
|
|
<aliases>
|
|
<alias uuid="298089ad-f84a-4dda-9c10-6653a7464294">
|
|
<enabled>1</enabled>
|
|
<name>x3690_3</name>
|
|
<type>host</type>
|
|
<proto/>
|
|
<interface/>
|
|
<counters>0</counters>
|
|
<updatefreq/>
|
|
<content>192.168.1.136</content>
|
|
<categories/>
|
|
<description/>
|
|
</alias>
|
|
<alias uuid="e80d6d23-a0b0-4432-aff5-b5be0557eb01">
|
|
<enabled>1</enabled>
|
|
<name>someservice2_vip</name>
|
|
<type>host</type>
|
|
<proto/>
|
|
<interface/>
|
|
<counters>0</counters>
|
|
<updatefreq/>
|
|
<content>192.168.20.225</content>
|
|
<categories/>
|
|
<description>alias for someservice2 vip</description>
|
|
</alias>
|
|
</aliases>
|
|
</Alias>
|
|
</Firewall>
|
|
<IDS version="1.0.9">
|
|
<rules/>
|
|
<policies/>
|
|
<userDefinedRules/>
|
|
<files/>
|
|
<fileTags/>
|
|
<general>
|
|
<enabled>0</enabled>
|
|
<ips>0</ips>
|
|
<promisc>0</promisc>
|
|
<interfaces>wan</interfaces>
|
|
<homenet>192.168.0.0/16,10.0.0.0/8,172.16.0.0/12</homenet>
|
|
<defaultPacketSize/>
|
|
<UpdateCron/>
|
|
<AlertLogrotate>W0D23</AlertLogrotate>
|
|
<AlertSaveLogs>4</AlertSaveLogs>
|
|
<MPMAlgo>ac</MPMAlgo>
|
|
<detect>
|
|
<Profile>medium</Profile>
|
|
<toclient_groups/>
|
|
<toserver_groups/>
|
|
</detect>
|
|
<syslog>0</syslog>
|
|
<syslog_eve>0</syslog_eve>
|
|
<LogPayload>0</LogPayload>
|
|
<verbosity/>
|
|
</general>
|
|
</IDS>
|
|
<IPsec version="1.0.1">
|
|
<general>
|
|
<enabled/>
|
|
</general>
|
|
<keyPairs/>
|
|
<preSharedKeys/>
|
|
</IPsec>
|
|
<Interfaces>
|
|
<vxlans version="1.0.1"/>
|
|
<loopbacks version="1.0.0"/>
|
|
</Interfaces>
|
|
<monit version="1.0.12">
|
|
<general>
|
|
<enabled>0</enabled>
|
|
<interval>120</interval>
|
|
<startdelay>120</startdelay>
|
|
<mailserver>127.0.0.1</mailserver>
|
|
<port>25</port>
|
|
<username/>
|
|
<password/>
|
|
<ssl>0</ssl>
|
|
<sslversion>auto</sslversion>
|
|
<sslverify>1</sslverify>
|
|
<logfile>syslog facility log_daemon</logfile>
|
|
<statefile/>
|
|
<eventqueuePath/>
|
|
<eventqueueSlots/>
|
|
<httpdEnabled>0</httpdEnabled>
|
|
<httpdUsername>root</httpdUsername>
|
|
<httpdPassword>oiujds9889DSIJSDIJSDIjdj</httpdPassword>
|
|
<httpdPort>2812</httpdPort>
|
|
<httpdAllow/>
|
|
<mmonitUrl/>
|
|
<mmonitTimeout>5</mmonitTimeout>
|
|
<mmonitRegisterCredentials>1</mmonitRegisterCredentials>
|
|
</general>
|
|
<alert uuid="d307f1df-e759-4262-a4cd-7b9673f0ad36">
|
|
<enabled>0</enabled>
|
|
<recipient>root@localhost.local</recipient>
|
|
<noton>0</noton>
|
|
<events/>
|
|
<format/>
|
|
<reminder>10</reminder>
|
|
<description/>
|
|
</alert>
|
|
<service uuid="9f01617b-08c1-487d-9c8a-fa1340add37e">
|
|
<enabled>1</enabled>
|
|
<name>$HOST</name>
|
|
<description/>
|
|
<type>system</type>
|
|
<pidfile/>
|
|
<match/>
|
|
<path/>
|
|
<timeout>300</timeout>
|
|
<starttimeout>30</starttimeout>
|
|
<address/>
|
|
<interface/>
|
|
<start/>
|
|
<stop/>
|
|
<tests>da6083fd-852c-44af-9ae7-8c9de443bbc9,4f18b847-c2ab-4707-9686-bf656e187ab8,62ea6632-3554-43be-bb0b-ceceab685338,f543f50a-4e52-4afd-85ce-95fe6d61dc54</tests>
|
|
<depends/>
|
|
<polltime/>
|
|
</service>
|
|
<test uuid="93365006-3a70-4d80-bab8-72fb9214a51b">
|
|
<name>Ping</name>
|
|
<type>NetworkPing</type>
|
|
<condition>failed ping</condition>
|
|
<action>alert</action>
|
|
<path/>
|
|
</test>
|
|
<test uuid="48a4ae66-c879-40fe-a554-0f354ee67770">
|
|
<name>NetworkLink</name>
|
|
<type>NetworkInterface</type>
|
|
<condition>failed link</condition>
|
|
<action>alert</action>
|
|
<path/>
|
|
</test>
|
|
</monit>
|
|
<OpenVPNExport version="0.0.1">
|
|
<servers/>
|
|
</OpenVPNExport>
|
|
<proxy version="1.0.6">
|
|
<general>
|
|
<enabled>0</enabled>
|
|
<error_pages>opnsense</error_pages>
|
|
<icpPort/>
|
|
<logging>
|
|
<enable>
|
|
<accessLog>1</accessLog>
|
|
<storeLog>1</storeLog>
|
|
</enable>
|
|
<ignoreLogACL/>
|
|
<target/>
|
|
</logging>
|
|
<alternateDNSservers/>
|
|
<dnsV4First>0</dnsV4First>
|
|
<forwardedForHandling>on</forwardedForHandling>
|
|
<uriWhitespaceHandling>strip</uriWhitespaceHandling>
|
|
<enablePinger>1</enablePinger>
|
|
<useViaHeader>1</useViaHeader>
|
|
<suppressVersion>0</suppressVersion>
|
|
<connecttimeout/>
|
|
<VisibleEmail>admin@localhost.local</VisibleEmail>
|
|
<VisibleHostname/>
|
|
<cache>
|
|
<local>
|
|
<enabled>0</enabled>
|
|
<directory>/var/squid/cache</directory>
|
|
<cache_mem>256</cache_mem>
|
|
<maximum_object_size/>
|
|
<maximum_object_size_in_memory/>
|
|
<memory_cache_mode>always</memory_cache_mode>
|
|
<size>100</size>
|
|
<l1>16</l1>
|
|
<l2>256</l2>
|
|
<cache_linux_packages>0</cache_linux_packages>
|
|
<cache_windows_updates>0</cache_windows_updates>
|
|
</local>
|
|
</cache>
|
|
<traffic>
|
|
<enabled>0</enabled>
|
|
<maxDownloadSize>2048</maxDownloadSize>
|
|
<maxUploadSize>1024</maxUploadSize>
|
|
<OverallBandwidthTrotteling>1024</OverallBandwidthTrotteling>
|
|
<perHostTrotteling>256</perHostTrotteling>
|
|
</traffic>
|
|
<parentproxy>
|
|
<enabled>0</enabled>
|
|
<host/>
|
|
<enableauth>0</enableauth>
|
|
<user>username</user>
|
|
<password>password</password>
|
|
<port/>
|
|
<localdomains/>
|
|
<localips/>
|
|
</parentproxy>
|
|
</general>
|
|
<forward>
|
|
<interfaces>lan</interfaces>
|
|
<port>3128</port>
|
|
<sslbumpport>3129</sslbumpport>
|
|
<sslbump>0</sslbump>
|
|
<sslurlonly>0</sslurlonly>
|
|
<sslcertificate/>
|
|
<sslnobumpsites/>
|
|
<ssl_crtd_storage_max_size>4</ssl_crtd_storage_max_size>
|
|
<sslcrtd_children>5</sslcrtd_children>
|
|
<snmp_enable>0</snmp_enable>
|
|
<snmp_port>3401</snmp_port>
|
|
<snmp_password>public</snmp_password>
|
|
<ftpInterfaces/>
|
|
<ftpPort>2121</ftpPort>
|
|
<ftpTransparentMode>0</ftpTransparentMode>
|
|
<addACLforInterfaceSubnets>1</addACLforInterfaceSubnets>
|
|
<transparentMode>0</transparentMode>
|
|
<acl>
|
|
<allowedSubnets/>
|
|
<unrestricted/>
|
|
<bannedHosts/>
|
|
<whiteList/>
|
|
<blackList/>
|
|
<browser/>
|
|
<mimeType/>
|
|
<googleapps/>
|
|
<youtube/>
|
|
<safePorts>80:http,21:ftp,443:https,70:gopher,210:wais,1025-65535:unregistered ports,280:http-mgmt,488:gss-http,591:filemaker,777:multiling http</safePorts>
|
|
<sslPorts>443:https</sslPorts>
|
|
<remoteACLs>
|
|
<blacklists/>
|
|
<UpdateCron/>
|
|
</remoteACLs>
|
|
</acl>
|
|
<icap>
|
|
<enable>0</enable>
|
|
<RequestURL>icap://[::1]:1344/avscan</RequestURL>
|
|
<ResponseURL>icap://[::1]:1344/avscan</ResponseURL>
|
|
<SendClientIP>1</SendClientIP>
|
|
<SendUsername>0</SendUsername>
|
|
<EncodeUsername>0</EncodeUsername>
|
|
<UsernameHeader>X-Username</UsernameHeader>
|
|
<EnablePreview>1</EnablePreview>
|
|
<PreviewSize>1024</PreviewSize>
|
|
<OptionsTTL>60</OptionsTTL>
|
|
<exclude/>
|
|
</icap>
|
|
<authentication>
|
|
<method/>
|
|
<authEnforceGroup/>
|
|
<realm>OPNsense proxy authentication</realm>
|
|
<credentialsttl>2</credentialsttl>
|
|
<children>5</children>
|
|
</authentication>
|
|
</forward>
|
|
<pac/>
|
|
<error_pages>
|
|
<template/>
|
|
</error_pages>
|
|
</proxy>
|
|
<Syslog version="1.0.1">
|
|
<general>
|
|
<enabled>1</enabled>
|
|
</general>
|
|
<destinations/>
|
|
</Syslog>
|
|
<TrafficShaper version="1.0.3">
|
|
<pipes/>
|
|
<queues/>
|
|
<rules/>
|
|
</TrafficShaper>
|
|
<unboundplus version="1.0.8">
|
|
<general>
|
|
<enabled>1</enabled>
|
|
<port>53</port>
|
|
<stats/>
|
|
<active_interface/>
|
|
<dnssec/>
|
|
<dns64/>
|
|
<dns64prefix/>
|
|
<noarecords/>
|
|
<regdhcp>1</regdhcp>
|
|
<regdhcpdomain/>
|
|
<regdhcpstatic>1</regdhcpstatic>
|
|
<noreglladdr6/>
|
|
<noregrecords/>
|
|
<txtsupport/>
|
|
<cacheflush/>
|
|
<local_zone_type>transparent</local_zone_type>
|
|
<outgoing_interface/>
|
|
<enable_wpad/>
|
|
</general>
|
|
<advanced>
|
|
<hideidentity>0</hideidentity>
|
|
<hideversion>0</hideversion>
|
|
<prefetch>0</prefetch>
|
|
<prefetchkey>0</prefetchkey>
|
|
<dnssecstripped>0</dnssecstripped>
|
|
<serveexpired>0</serveexpired>
|
|
<serveexpiredreplyttl/>
|
|
<serveexpiredttl/>
|
|
<serveexpiredttlreset>0</serveexpiredttlreset>
|
|
<serveexpiredclienttimeout/>
|
|
<qnameminstrict>0</qnameminstrict>
|
|
<extendedstatistics>0</extendedstatistics>
|
|
<logqueries>0</logqueries>
|
|
<logreplies>0</logreplies>
|
|
<logtagqueryreply>0</logtagqueryreply>
|
|
<logservfail/>
|
|
<loglocalactions/>
|
|
<logverbosity>1</logverbosity>
|
|
<valloglevel>0</valloglevel>
|
|
<privatedomain/>
|
|
<privateaddress>0.0.0.0/8,10.0.0.0/8,100.64.0.0/10,169.254.0.0/16,172.16.0.0/12,192.0.2.0/24,192.168.0.0/16,198.18.0.0/15,198.51.100.0/24,203.0.113.0/24,233.252.0.0/24,::1/128,2001:db8::/32,fc00::/8,fd00::/8,fe80::/10</privateaddress>
|
|
<insecuredomain/>
|
|
<msgcachesize/>
|
|
<rrsetcachesize/>
|
|
<outgoingnumtcp/>
|
|
<incomingnumtcp/>
|
|
<numqueriesperthread/>
|
|
<outgoingrange/>
|
|
<jostletimeout/>
|
|
<cachemaxttl/>
|
|
<cachemaxnegativettl/>
|
|
<cacheminttl/>
|
|
<infrahostttl/>
|
|
<infrakeepprobing/>
|
|
<infracachenumhosts/>
|
|
<unwantedreplythreshold/>
|
|
</advanced>
|
|
<acls>
|
|
<default_action>allow</default_action>
|
|
</acls>
|
|
<dnsbl>
|
|
<enabled>0</enabled>
|
|
<safesearch/>
|
|
<type/>
|
|
<lists/>
|
|
<whitelists/>
|
|
<blocklists/>
|
|
<wildcards/>
|
|
<address/>
|
|
<nxdomain>0</nxdomain>
|
|
</dnsbl>
|
|
<forwarding>
|
|
<enabled>0</enabled>
|
|
</forwarding>
|
|
<dots/>
|
|
<hosts>
|
|
<host uuid="a681fc39-70fa-4cf1-9331-79f5cbf9048f">
|
|
<enabled>1</enabled>
|
|
<hostname>api</hostname>
|
|
<domain>someapp.yourdomain.local.mcd</domain>
|
|
<rr>A</rr>
|
|
<mxprio/>
|
|
<mx/>
|
|
<server>192.168.20.161</server>
|
|
<description>Some app local</description>
|
|
</host>
|
|
<host uuid="dd593e95-02bc-476f-8610-fa1ee454e950">
|
|
<enabled>1</enabled>
|
|
<hostname>api-int</hostname>
|
|
<domain>someapp.yourdomain.local.mcd</domain>
|
|
<rr>A</rr>
|
|
<mxprio/>
|
|
<mx/>
|
|
<server>192.168.20.161</server>
|
|
<description>Some app local</description>
|
|
</host>
|
|
<host uuid="e1606f96-dd38-471f-a3d7-ad25e41e810d">
|
|
<enabled>1</enabled>
|
|
<hostname>*</hostname>
|
|
<domain>someapp.yourdomain.local.mcd</domain>
|
|
<rr>A</rr>
|
|
<mxprio/>
|
|
<mx/>
|
|
<server>192.168.20.161</server>
|
|
<description>Some app local</description>
|
|
</host>
|
|
</hosts>
|
|
<aliases/>
|
|
<domains/>
|
|
</unboundplus>
|
|
<wireguard>
|
|
<general version="0.0.1">
|
|
<enabled>1</enabled>
|
|
</general>
|
|
<server version="0.0.4">
|
|
<servers>
|
|
<server uuid="3ec7bf83-b3b7-4fba-b4f2-a96dafbfb162">
|
|
<enabled>1</enabled>
|
|
<name>publicwg</name>
|
|
<instance>0</instance>
|
|
<pubkey>89udsjiuod109jadsSUIDSAUIduhashuiauas/asdkj=</pubkey>
|
|
<privkey>eH555555555555555+892jdjiodsjiodsoijsdjiodj=</privkey>
|
|
<port>51820</port>
|
|
<mtu/>
|
|
<dns/>
|
|
<tunneladdress>172.12.0.1/24</tunneladdress>
|
|
<disableroutes>0</disableroutes>
|
|
<endpoint/>
|
|
<peer_dns/>
|
|
<gateway/>
|
|
<carp_depend_on/>
|
|
<peers>03031aec-2e84-462e-9eab-57762dde667a,98e6ca3d-1de9-449b-be80-77022221b509,67c0ace5-e802-4d2b-a536-f8b7a2db6f99,74b60fff-7844-4097-9966-f1c2b1ad29ff,3de82ad5-bc1b-4b91-9598-f906e58ac937,a95e6b5e-24a4-40b5-bb41-b79e784f6f1c,6c9a12c6-c1ca-4c14-866b-975406a30590,c33b308b-7125-4688-9561-989ace8787b5,e43f004a-23bf-4027-8fb0-953fbb40479f</peers>
|
|
</server>
|
|
</servers>
|
|
</server>
|
|
<client version="0.0.7">
|
|
<clients>
|
|
<client uuid="98e6ca3d-1de9-449b-be80-77022221b509">
|
|
<enabled>1</enabled>
|
|
<name>some-laptop</name>
|
|
<pubkey>95555555555555555555555555555FN2aCHemL3RjA8=</pubkey>
|
|
<psk/>
|
|
<tunneladdress>172.12.0.8/32</tunneladdress>
|
|
<serveraddress/>
|
|
<serverport/>
|
|
<keepalive/>
|
|
</client>
|
|
<client uuid="74b60fff-7844-4097-9966-f1c2b1ad29ff">
|
|
<enabled>1</enabled>
|
|
<name>user2</name>
|
|
<pubkey>pJ555555555555555555xiUxuJof78XXugx1KUrrYg8=</pubkey>
|
|
<psk/>
|
|
<tunneladdress>172.12.0.6/32</tunneladdress>
|
|
<serveraddress/>
|
|
<serverport/>
|
|
<keepalive/>
|
|
</client>
|
|
<client uuid="67c0ace5-e802-4d2b-a536-f8b7a2db6f99">
|
|
<enabled>1</enabled>
|
|
<name>some-phone</name>
|
|
<pubkey>SLQXdM/555555555555555555MWhR2WSEkaSXh1ZpXU=</pubkey>
|
|
<psk/>
|
|
<tunneladdress>172.12.0.9/32</tunneladdress>
|
|
<serveraddress/>
|
|
<serverport/>
|
|
<keepalive/>
|
|
</client>
|
|
</clients>
|
|
</client>
|
|
</wireguard>
|
|
<Swanctl version="1.0.0">
|
|
<Connections/>
|
|
<locals/>
|
|
<remotes/>
|
|
<children/>
|
|
<Pools/>
|
|
<VTIs/>
|
|
<SPDs/>
|
|
</Swanctl>
|
|
<DynDNS version="1.5.1">
|
|
<general>
|
|
<enabled>1</enabled>
|
|
<verbose>0</verbose>
|
|
<allowipv6>0</allowipv6>
|
|
<daemon_delay>300</daemon_delay>
|
|
<backend>ddclient</backend>
|
|
</general>
|
|
<accounts>
|
|
<account uuid="5be8a905-3cde-4e34-b16c-e53623146c95">
|
|
<enabled>1</enabled>
|
|
<service>someddnsprovider</service>
|
|
<protocol/>
|
|
<server/>
|
|
<username>someusername.com</username>
|
|
<password>55555555555555555555555555555dsi</password>
|
|
<resourceId/>
|
|
<hostnames>yourpublic.host.com</hostnames>
|
|
<wildcard>0</wildcard>
|
|
<zone/>
|
|
<checkip>if</checkip>
|
|
<checkip_timeout>10</checkip_timeout>
|
|
<force_ssl>1</force_ssl>
|
|
<ttl>300</ttl>
|
|
<interface>wan</interface>
|
|
<description>yourpublic.host.com</description>
|
|
</account>
|
|
</accounts>
|
|
</DynDNS>
|
|
<OpenVPN version="1.0.0">
|
|
<Overwrites/>
|
|
<Instances/>
|
|
<StaticKeys/>
|
|
</OpenVPN>
|
|
<Gateways version="0.0.1"/>
|
|
<HAProxy version="4.0.0">
|
|
<general>
|
|
<enabled>1</enabled>
|
|
<gracefulStop>0</gracefulStop>
|
|
<hardStopAfter>60s</hardStopAfter>
|
|
<closeSpreadTime/>
|
|
<seamlessReload>0</seamlessReload>
|
|
<storeOcsp>0</storeOcsp>
|
|
<showIntro>1</showIntro>
|
|
<peers>
|
|
<enabled>0</enabled>
|
|
<name1/>
|
|
<listen1/>
|
|
<port1>1024</port1>
|
|
<name2/>
|
|
<listen2/>
|
|
<port2>1024</port2>
|
|
</peers>
|
|
<tuning>
|
|
<root>0</root>
|
|
<maxConnections/>
|
|
<nbthread>1</nbthread>
|
|
<sslServerVerify>ignore</sslServerVerify>
|
|
<maxDHSize>2048</maxDHSize>
|
|
<bufferSize>16384</bufferSize>
|
|
<resolversPrefer>ipv4</resolversPrefer>
|
|
<spreadChecks>2</spreadChecks>
|
|
<bogusProxyEnabled>0</bogusProxyEnabled>
|
|
<luaMaxMem>0</luaMaxMem>
|
|
<customOptions/>
|
|
<ocspUpdateEnabled>0</ocspUpdateEnabled>
|
|
<ocspUpdateMinDelay>300</ocspUpdateMinDelay>
|
|
<ocspUpdateMaxDelay>3600</ocspUpdateMaxDelay>
|
|
<ssl_defaultsEnabled>0</ssl_defaultsEnabled>
|
|
<ssl_bindOptions>prefer-client-ciphers</ssl_bindOptions>
|
|
<ssl_minVersion>TLSv1.2</ssl_minVersion>
|
|
<ssl_maxVersion/>
|
|
<ssl_cipherList>ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256</ssl_cipherList>
|
|
<ssl_cipherSuites>TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256</ssl_cipherSuites>
|
|
</tuning>
|
|
<defaults>
|
|
<maxConnections/>
|
|
<maxConnectionsServers/>
|
|
<timeoutClient>30s</timeoutClient>
|
|
<timeoutConnect>30s</timeoutConnect>
|
|
<timeoutCheck/>
|
|
<timeoutServer>30s</timeoutServer>
|
|
<retries>3</retries>
|
|
<redispatch>x-1</redispatch>
|
|
<init_addr>last,libc</init_addr>
|
|
<customOptions/>
|
|
</defaults>
|
|
<logging>
|
|
<host>127.0.0.1</host>
|
|
<facility>local0</facility>
|
|
<level>info</level>
|
|
<length/>
|
|
</logging>
|
|
<stats>
|
|
<enabled>0</enabled>
|
|
<port>8822</port>
|
|
<remoteEnabled>0</remoteEnabled>
|
|
<remoteBind/>
|
|
<authEnabled>0</authEnabled>
|
|
<users/>
|
|
<allowedUsers/>
|
|
<allowedGroups/>
|
|
<customOptions/>
|
|
<prometheus_enabled>0</prometheus_enabled>
|
|
<prometheus_bind>*:8404</prometheus_bind>
|
|
<prometheus_path>/metrics</prometheus_path>
|
|
</stats>
|
|
<cache>
|
|
<enabled>0</enabled>
|
|
<totalMaxSize>4</totalMaxSize>
|
|
<maxAge>60</maxAge>
|
|
<maxObjectSize/>
|
|
<processVary>0</processVary>
|
|
<maxSecondaryEntries>10</maxSecondaryEntries>
|
|
</cache>
|
|
</general>
|
|
<frontends>
|
|
<frontend uuid="379ce7bf-4df6-4b12-8aee-a32cff084d92">
|
|
<id>6707fe74642f67.52019899</id>
|
|
<enabled>1</enabled>
|
|
<name>some-ingress</name>
|
|
<description>public service redirecting traffic</description>
|
|
<bind>192.168.20.55:55555</bind>
|
|
<bindOptions/>
|
|
<mode>tcp</mode>
|
|
<defaultBackend>f0c76bef-8623-4fa8-a992-61f83d504b87</defaultBackend>
|
|
<ssl_enabled>0</ssl_enabled>
|
|
<ssl_certificates/>
|
|
<ssl_default_certificate/>
|
|
<ssl_customOptions/>
|
|
<ssl_advancedEnabled>0</ssl_advancedEnabled>
|
|
<ssl_bindOptions>prefer-client-ciphers</ssl_bindOptions>
|
|
<ssl_minVersion>TLSv1.2</ssl_minVersion>
|
|
<ssl_maxVersion/>
|
|
<ssl_cipherList>ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256</ssl_cipherList>
|
|
<ssl_cipherSuites>TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256</ssl_cipherSuites>
|
|
<ssl_hstsEnabled>1</ssl_hstsEnabled>
|
|
<ssl_hstsIncludeSubDomains>0</ssl_hstsIncludeSubDomains>
|
|
<ssl_hstsPreload>0</ssl_hstsPreload>
|
|
<ssl_hstsMaxAge>15768000</ssl_hstsMaxAge>
|
|
<ssl_clientAuthEnabled>0</ssl_clientAuthEnabled>
|
|
<ssl_clientAuthVerify>required</ssl_clientAuthVerify>
|
|
<ssl_clientAuthCAs/>
|
|
<ssl_clientAuthCRLs/>
|
|
<basicAuthEnabled>0</basicAuthEnabled>
|
|
<basicAuthUsers/>
|
|
<basicAuthGroups/>
|
|
<tuning_maxConnections/>
|
|
<tuning_timeoutClient/>
|
|
<tuning_timeoutHttpReq/>
|
|
<tuning_timeoutHttpKeepAlive/>
|
|
<linkedCpuAffinityRules/>
|
|
<tuning_shards/>
|
|
<logging_dontLogNull>0</logging_dontLogNull>
|
|
<logging_dontLogNormal>0</logging_dontLogNormal>
|
|
<logging_logSeparateErrors>0</logging_logSeparateErrors>
|
|
<logging_detailedLog>0</logging_detailedLog>
|
|
<logging_socketStats>0</logging_socketStats>
|
|
<stickiness_pattern/>
|
|
<stickiness_dataTypes/>
|
|
<stickiness_expire>30m</stickiness_expire>
|
|
<stickiness_size>50k</stickiness_size>
|
|
<stickiness_counter>1</stickiness_counter>
|
|
<stickiness_counter_key>src</stickiness_counter_key>
|
|
<stickiness_length/>
|
|
<stickiness_connRatePeriod>10s</stickiness_connRatePeriod>
|
|
<stickiness_sessRatePeriod>10s</stickiness_sessRatePeriod>
|
|
<stickiness_httpReqRatePeriod>10s</stickiness_httpReqRatePeriod>
|
|
<stickiness_httpErrRatePeriod>10s</stickiness_httpErrRatePeriod>
|
|
<stickiness_bytesInRatePeriod>1m</stickiness_bytesInRatePeriod>
|
|
<stickiness_bytesOutRatePeriod>1m</stickiness_bytesOutRatePeriod>
|
|
<http2Enabled>0</http2Enabled>
|
|
<http2Enabled_nontls>0</http2Enabled_nontls>
|
|
<advertised_protocols>h2,http11</advertised_protocols>
|
|
<forwardFor>0</forwardFor>
|
|
<prometheus_enabled>0</prometheus_enabled>
|
|
<prometheus_path>/metrics</prometheus_path>
|
|
<connectionBehaviour>http-keep-alive</connectionBehaviour>
|
|
<customOptions/>
|
|
<linkedActions/>
|
|
<linkedErrorfiles/>
|
|
</frontend>
|
|
<frontend uuid="e5cdd687-92a0-46a1-93c0-7b26431fea92">
|
|
<id>670979396dea69.72299427</id>
|
|
<enabled>0</enabled>
|
|
<name>another-ingress</name>
|
|
<description>public service redirecting traffic with non descriptive description</description>
|
|
<bind>192.168.20.1:55555</bind>
|
|
<bindOptions/>
|
|
<mode>tcp</mode>
|
|
<defaultBackend>f0c76bef-8623-4fa8-a992-61f83d504b87</defaultBackend>
|
|
<ssl_enabled>0</ssl_enabled>
|
|
<ssl_certificates/>
|
|
<ssl_default_certificate/>
|
|
<ssl_customOptions/>
|
|
<ssl_advancedEnabled>0</ssl_advancedEnabled>
|
|
<ssl_bindOptions>prefer-client-ciphers</ssl_bindOptions>
|
|
<ssl_minVersion>TLSv1.2</ssl_minVersion>
|
|
<ssl_maxVersion/>
|
|
<ssl_cipherList>ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256</ssl_cipherList>
|
|
<ssl_cipherSuites>TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256</ssl_cipherSuites>
|
|
<ssl_hstsEnabled>1</ssl_hstsEnabled>
|
|
<ssl_hstsIncludeSubDomains>0</ssl_hstsIncludeSubDomains>
|
|
<ssl_hstsPreload>0</ssl_hstsPreload>
|
|
<ssl_hstsMaxAge>15768000</ssl_hstsMaxAge>
|
|
<ssl_clientAuthEnabled>0</ssl_clientAuthEnabled>
|
|
<ssl_clientAuthVerify>required</ssl_clientAuthVerify>
|
|
<ssl_clientAuthCAs/>
|
|
<ssl_clientAuthCRLs/>
|
|
<basicAuthEnabled>0</basicAuthEnabled>
|
|
<basicAuthUsers/>
|
|
<basicAuthGroups/>
|
|
<tuning_maxConnections/>
|
|
<tuning_timeoutClient/>
|
|
<tuning_timeoutHttpReq/>
|
|
<tuning_timeoutHttpKeepAlive/>
|
|
<linkedCpuAffinityRules/>
|
|
<tuning_shards/>
|
|
<logging_dontLogNull>0</logging_dontLogNull>
|
|
<logging_dontLogNormal>0</logging_dontLogNormal>
|
|
<logging_logSeparateErrors>0</logging_logSeparateErrors>
|
|
<logging_detailedLog>0</logging_detailedLog>
|
|
<logging_socketStats>0</logging_socketStats>
|
|
<stickiness_pattern/>
|
|
<stickiness_dataTypes/>
|
|
<stickiness_expire>30m</stickiness_expire>
|
|
<stickiness_size>50k</stickiness_size>
|
|
<stickiness_counter>1</stickiness_counter>
|
|
<stickiness_counter_key>src</stickiness_counter_key>
|
|
<stickiness_length/>
|
|
<stickiness_connRatePeriod>10s</stickiness_connRatePeriod>
|
|
<stickiness_sessRatePeriod>10s</stickiness_sessRatePeriod>
|
|
<stickiness_httpReqRatePeriod>10s</stickiness_httpReqRatePeriod>
|
|
<stickiness_httpErrRatePeriod>10s</stickiness_httpErrRatePeriod>
|
|
<stickiness_bytesInRatePeriod>1m</stickiness_bytesInRatePeriod>
|
|
<stickiness_bytesOutRatePeriod>1m</stickiness_bytesOutRatePeriod>
|
|
<http2Enabled>0</http2Enabled>
|
|
<http2Enabled_nontls>0</http2Enabled_nontls>
|
|
<advertised_protocols>h2,http11</advertised_protocols>
|
|
<forwardFor>0</forwardFor>
|
|
<prometheus_enabled>0</prometheus_enabled>
|
|
<prometheus_path>/metrics</prometheus_path>
|
|
<connectionBehaviour>http-keep-alive</connectionBehaviour>
|
|
<customOptions/>
|
|
<linkedActions/>
|
|
<linkedErrorfiles/>
|
|
</frontend>
|
|
</frontends>
|
|
<backends>
|
|
<backend uuid="f0c76bef-8623-4fa8-a992-61f83d504b87">
|
|
<id>6707fa71c3cb99.64451664</id>
|
|
<enabled>1</enabled>
|
|
<name>some_servers</name>
|
|
<description/>
|
|
<mode>tcp</mode>
|
|
<algorithm>roundrobin</algorithm>
|
|
<random_draws>2</random_draws>
|
|
<proxyProtocol/>
|
|
<linkedServers>c0364e69-459d-48b2-a1d1-808324fea9cb,187d8b79-4376-45fc-9fd7-476074a7a577</linkedServers>
|
|
<linkedFcgi/>
|
|
<linkedResolver/>
|
|
<resolverOpts/>
|
|
<resolvePrefer/>
|
|
<source/>
|
|
<healthCheckEnabled>1</healthCheckEnabled>
|
|
<healthCheck>5110db0c-afa9-4bad-bbbe-5bbeb52262bb</healthCheck>
|
|
<healthCheckLogStatus>0</healthCheckLogStatus>
|
|
<checkInterval/>
|
|
<checkDownInterval/>
|
|
<healthCheckFall/>
|
|
<healthCheckRise/>
|
|
<linkedMailer/>
|
|
<http2Enabled>0</http2Enabled>
|
|
<http2Enabled_nontls>0</http2Enabled_nontls>
|
|
<ba_advertised_protocols>h2,http11</ba_advertised_protocols>
|
|
<persistence>sticktable</persistence>
|
|
<persistence_cookiemode>piggyback</persistence_cookiemode>
|
|
<persistence_cookiename>SRVCOOKIE</persistence_cookiename>
|
|
<persistence_stripquotes>1</persistence_stripquotes>
|
|
<stickiness_pattern>sourceipv4</stickiness_pattern>
|
|
<stickiness_dataTypes/>
|
|
<stickiness_expire>30m</stickiness_expire>
|
|
<stickiness_size>50k</stickiness_size>
|
|
<stickiness_cookiename/>
|
|
<stickiness_cookielength/>
|
|
<stickiness_connRatePeriod>10s</stickiness_connRatePeriod>
|
|
<stickiness_sessRatePeriod>10s</stickiness_sessRatePeriod>
|
|
<stickiness_httpReqRatePeriod>10s</stickiness_httpReqRatePeriod>
|
|
<stickiness_httpErrRatePeriod>10s</stickiness_httpErrRatePeriod>
|
|
<stickiness_bytesInRatePeriod>1m</stickiness_bytesInRatePeriod>
|
|
<stickiness_bytesOutRatePeriod>1m</stickiness_bytesOutRatePeriod>
|
|
<basicAuthEnabled>0</basicAuthEnabled>
|
|
<basicAuthUsers/>
|
|
<basicAuthGroups/>
|
|
<tuning_timeoutConnect/>
|
|
<tuning_timeoutCheck/>
|
|
<tuning_timeoutServer/>
|
|
<tuning_retries/>
|
|
<customOptions/>
|
|
<tuning_defaultserver/>
|
|
<tuning_noport>0</tuning_noport>
|
|
<tuning_httpreuse>safe</tuning_httpreuse>
|
|
<tuning_caching>0</tuning_caching>
|
|
<linkedActions/>
|
|
<linkedErrorfiles/>
|
|
</backend>
|
|
</backends>
|
|
<servers>
|
|
<server uuid="c0364e69-459d-48b2-a1d1-808324fea9cb">
|
|
<id>6707f9a980b271.59222580</id>
|
|
<enabled>1</enabled>
|
|
<name>server1</name>
|
|
<description>server running on host</description>
|
|
<address>192.168.20.55</address>
|
|
<port>55555</port>
|
|
<checkport/>
|
|
<mode>active</mode>
|
|
<multiplexer_protocol>unspecified</multiplexer_protocol>
|
|
<type>static</type>
|
|
<serviceName/>
|
|
<number/>
|
|
<linkedResolver/>
|
|
<resolverOpts/>
|
|
<resolvePrefer/>
|
|
<ssl>0</ssl>
|
|
<sslSNI/>
|
|
<sslVerify>1</sslVerify>
|
|
<sslCA/>
|
|
<sslCRL/>
|
|
<sslClientCertificate/>
|
|
<maxConnections/>
|
|
<weight>33</weight>
|
|
<checkInterval/>
|
|
<checkDownInterval/>
|
|
<source/>
|
|
<advanced/>
|
|
<unix_socket/>
|
|
</server>
|
|
<server uuid="187d8b79-4376-45fc-9fd7-476074a7a577">
|
|
<id>6707faa46d5f57.14318783</id>
|
|
<enabled>1</enabled>
|
|
<name>server2</name>
|
|
<description>server running something</description>
|
|
<address>192.168.20.155</address>
|
|
<port>55555</port>
|
|
<checkport/>
|
|
<mode>active</mode>
|
|
<multiplexer_protocol>unspecified</multiplexer_protocol>
|
|
<type>static</type>
|
|
<serviceName/>
|
|
<number/>
|
|
<linkedResolver/>
|
|
<resolverOpts/>
|
|
<resolvePrefer/>
|
|
<ssl>0</ssl>
|
|
<sslSNI/>
|
|
<sslVerify>1</sslVerify>
|
|
<sslCA/>
|
|
<sslCRL/>
|
|
<sslClientCertificate/>
|
|
<maxConnections/>
|
|
<weight>67</weight>
|
|
<checkInterval/>
|
|
<checkDownInterval/>
|
|
<source/>
|
|
<advanced/>
|
|
<unix_socket/>
|
|
</server>
|
|
</servers>
|
|
<healthchecks>
|
|
<healthcheck uuid="5110db0c-afa9-4bad-bbbe-5bbeb52262bb">
|
|
<name>server-loadbalancer-monitor</name>
|
|
<description/>
|
|
<type>tcp</type>
|
|
<interval>2s</interval>
|
|
<ssl>nopref</ssl>
|
|
<sslSNI/>
|
|
<force_ssl>0</force_ssl>
|
|
<checkport/>
|
|
<http_method>options</http_method>
|
|
<http_uri>/</http_uri>
|
|
<http_version>http10</http_version>
|
|
<http_host>localhost</http_host>
|
|
<http_expressionEnabled>0</http_expressionEnabled>
|
|
<http_expression/>
|
|
<http_negate>0</http_negate>
|
|
<http_value/>
|
|
<tcp_enabled>0</tcp_enabled>
|
|
<tcp_sendValue/>
|
|
<tcp_matchType>string</tcp_matchType>
|
|
<tcp_negate>0</tcp_negate>
|
|
<tcp_matchValue/>
|
|
<agent_port/>
|
|
<mysql_user/>
|
|
<mysql_post41>0</mysql_post41>
|
|
<pgsql_user/>
|
|
<smtp_domain/>
|
|
<esmtp_domain/>
|
|
<agentPort/>
|
|
<dbUser/>
|
|
<smtpDomain/>
|
|
</healthcheck>
|
|
</healthchecks>
|
|
<acls/>
|
|
<actions/>
|
|
<luas/>
|
|
<fcgis/>
|
|
<errorfiles/>
|
|
<mapfiles/>
|
|
<groups/>
|
|
<users/>
|
|
<cpus/>
|
|
<resolvers/>
|
|
<mailers/>
|
|
<maintenance>
|
|
<cronjobs>
|
|
<syncCerts>0</syncCerts>
|
|
<syncCertsCron/>
|
|
<updateOcsp>0</updateOcsp>
|
|
<updateOcspCron/>
|
|
<reloadService>0</reloadService>
|
|
<reloadServiceCron/>
|
|
<restartService>0</restartService>
|
|
<restartServiceCron/>
|
|
</cronjobs>
|
|
</maintenance>
|
|
</HAProxy>
|
|
</OPNsense>
|
|
<staticroutes version="1.0.0">
|
|
<route/>
|
|
</staticroutes>
|
|
<ca/>
|
|
<gateways>
|
|
<gateway_item/>
|
|
</gateways>
|
|
<cert>
|
|
<refid>6155aba4c9375</refid>
|
|
<descr>Web GUI TLS certificate</descr>
|
|
<crt>LtCg==</crt>
|
|
<prv>L22o=</prv>
|
|
</cert>
|
|
<dhcpdv6/>
|
|
<virtualip version="1.0.0">
|
|
<vip uuid="756c3b4a-f61a-4406-8776-383bc429a5b3">
|
|
<interface>wan</interface>
|
|
<mode>ipalias</mode>
|
|
<subnet>192.168.20.155</subnet>
|
|
<subnet_bits>32</subnet_bits>
|
|
<gateway>10.11.16.17</gateway>
|
|
<noexpand>0</noexpand>
|
|
<nobind>0</nobind>
|
|
<password/>
|
|
<vhid/>
|
|
<advbase>1</advbase>
|
|
<advskew>0</advskew>
|
|
<descr>virtual ip for service</descr>
|
|
</vip>
|
|
</virtualip>
|
|
<openvpn>
|
|
<openvpn-server/>
|
|
<openvpn-client/>
|
|
</openvpn>
|
|
<ppps>
|
|
<ppp>
|
|
<ptpid>0</ptpid>
|
|
<type>pppoe</type>
|
|
<if>pppoe0</if>
|
|
<ports>em0</ports>
|
|
<username>someuser@ppoeserver.com</username>
|
|
<password>5555555555AyNA==</password>
|
|
</ppp>
|
|
</ppps>
|
|
<dyndnses>
|
|
<dyndns>
|
|
<type>someddnsprovider</type>
|
|
<username/>
|
|
<password>5555555555ee479874398u1298e98u18</password>
|
|
<host>yourpublic.host.com</host>
|
|
<mx/>
|
|
<interface>wan</interface>
|
|
<zoneid/>
|
|
<resourceid/>
|
|
<ttl/>
|
|
<updateurl/>
|
|
<resultmatch/>
|
|
<requestif>wan</requestif>
|
|
<descr/>
|
|
<id>0</id>
|
|
</dyndns>
|
|
</dyndnses>
|
|
<vlans version="1.0.0">
|
|
<vlan/>
|
|
</vlans>
|
|
<bridges>
|
|
<bridged/>
|
|
</bridges>
|
|
<gifs>
|
|
<gif/>
|
|
</gifs>
|
|
<gres>
|
|
<gre/>
|
|
</gres>
|
|
<laggs version="1.0.0"/>
|
|
<wireless>
|
|
<clone/>
|
|
</wireless>
|
|
<hasync>
|
|
<synchronizealiases>on</synchronizealiases>
|
|
<synchronizeauthservers>on</synchronizeauthservers>
|
|
<synchronizecerts>on</synchronizecerts>
|
|
<synchronizedhcpd>on</synchronizedhcpd>
|
|
<synchronizenat>on</synchronizenat>
|
|
<synchronizerules>on</synchronizerules>
|
|
<synchronizeschedules>on</synchronizeschedules>
|
|
<synchronizestaticroutes>on</synchronizestaticroutes>
|
|
<synchronizeusers>on</synchronizeusers>
|
|
<synchronizevirtualip>on</synchronizevirtualip>
|
|
<synchronizewidgets>on</synchronizewidgets>
|
|
<synchronizedhcrelay>on</synchronizedhcrelay>
|
|
<synchronizedhcpdv6>on</synchronizedhcpdv6>
|
|
<synchronizedhcrelay6>on</synchronizedhcrelay6>
|
|
<synchronizentpd>on</synchronizentpd>
|
|
<synchronizesyslog>on</synchronizesyslog>
|
|
<synchronizecron>on</synchronizecron>
|
|
<synchronizesysctl>on</synchronizesysctl>
|
|
<synchronizewebgui>on</synchronizewebgui>
|
|
<synchronizednsforwarder>on</synchronizednsforwarder>
|
|
<synchronizeshaper>on</synchronizeshaper>
|
|
<synchronizecaptiveportal>on</synchronizecaptiveportal>
|
|
<synchronizeipsec>on</synchronizeipsec>
|
|
<synchronizemonit>on</synchronizemonit>
|
|
<synchronizessh>on</synchronizessh>
|
|
<synchronizeopenvpn>on</synchronizeopenvpn>
|
|
<synchronizeifgroups>on</synchronizeifgroups>
|
|
<synchronizecategories>on</synchronizecategories>
|
|
<synchronizelvtemplate>on</synchronizelvtemplate>
|
|
<synchronizesquid>on</synchronizesquid>
|
|
<synchronizesuricata>on</synchronizesuricata>
|
|
<synchronizednsresolver>on</synchronizednsresolver>
|
|
<pfsyncinterface>opt1</pfsyncinterface>
|
|
<synchronizetoip>10.10.5.2</synchronizetoip>
|
|
<username>root</username>
|
|
<password>555555555</password>
|
|
<pfsyncenabled>on</pfsyncenabled>
|
|
<disablepreempt>on</disablepreempt>
|
|
<disconnectppps>on</disconnectppps>
|
|
</hasync>
|
|
<ifgroups version="1.0.0"/>
|
|
</opnsense>
|