12,299
edits
FireBrick 2700 Configuration run-through: Difference between revisions
FireBrick 2700 Configuration run-through (view source)
Revision as of 15:21, 5 January 2011
, 5 January 2011no edit summary
(→PPPoE) |
No edit summary |
||
|
*Username= abc@a.1 Password=secret
*Routed IP block =
= Default Config =
modify the telnet service to permit only access from your LAN:
<syntaxhighlight>
<telnet allow="
</syntaxhighlight>
Set DNS servers and your domain name, under the services:
So, first we'll add a new subnet, this can go under the current 10.0.0.1 subnet (which we'll delete later.) And we'll make this a DHCP server:
<syntaxhighlight>
<subnet ip="
<dhcp ip="
</syntaxhighlight>
Remove the existing DHCP settings for the 10.0.0.1 interface. The LAN! interface now looks like this:
<subnet comment="dhcp client"/>
<subnet ip="2001:DB8::1/64 10.0.0.1/24" nat="true" comment="Temporary IPs for setup only, delete when finished configuring"/>
<subnet ip="
<dhcp ip="
</interface>
</syntaxhighlight>
<subnet comment="dhcp client"/>
<subnet ip="2001:DB8::1/64 10.0.0.1/24" nat="true" comment="Temporary IPs for setup only, delete when finished configuring"/>
<subnet ip="
<dhcp ip="
</interface>
<ppp port="LAN4" username="startup_user@startup_domain" password="" comment="Example PPPoE config for DSL/FTTC/FTTP/etc"/>
<dns domain="yourdomain.tld" resolvers="217.169.20.20 217.169.20.21"/>
<ntp timeserver="90.155.53.32 2001:8B0:0:53::5A9B:3520"/>
<telnet allow="
<http/>
</services>
At this point we can save the config, there should be no errors.
Our computer should then pick up a new
if that works, we can now safely remove the DHCP client subnet and the 10.0.0.1 subnet, so remove the lines:
<subnet comment="dhcp client"/>
<subnet ip="2001:DB8::1/64 10.0.0.1/24" nat="true" comment="Temporary IPs for setup only, delete when finished configuring"/>
<subnet ip="
<dhcp ip="
</interface>
<ppp port="WAN1" username="abc@a.1" password="secret" comment="BT ADSL" graph="BT ADSL" log="true"/>
<dns domain="yourdomain.tld" resolvers="217.169.20.20 217.169.20.21"/>
<ntp timeserver="90.155.53.32 2001:8B0:0:53::5A9B:3520"/>
<telnet allow="
<http/>
</services>
If you have VoIP phones on your LAN, then here are some example rules to allow SIP and RTP from the AAISP phone servers:
<syntaxhighlight>
<rule name="SIP" source-ip="81.187.30.110-119" target-ip="
<rule name="RTP" target-ip="
</syntaxhighlight>
This also sets a graph for RTP, you may want to restrict the target to just your VoIP phones, as the above set the target at the whole of the LAN
== Restricting FireBrick Config access ==
You may only want to allow access to the FireBrick webserver from your LAN, do this in the http service, eg, change the current line to:
<syntaxhighlight>
<http allow="
</syntaxhighlight>
| |||