FireBrick 2700 Configuration: Difference between revisions

=Config Run Through=

The FireBrick uses XML version 1.0 and UTF-8 encoding:

<syntaxhighlight>

<?xml version="1.0" encoding="UTF-8"?>

</syntaxhighlight>

FireBrick is running factory release firmware 1.35.001:

<syntaxhighlight>

<config xmlns="http://firebrick.ltd.uk/xml/fb2700/"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://firebrick.ltd.uk/xml/fb2700/ http://firebrick.ltd.uk/download/FB2701/xml/fb2700/1.35.001.xsd"

patch="21695">

</syntaxhighlight>

==System==

FireBrick with basic system config. Automatic updates to new factory release firmware are enabled by default:

<syntaxhighlight>

<system contact="John Doe" log-panic="fb-support"/>

</syntaxhighlight>

Same as above but automatic firmware updates are disabled:

<syntaxhighlight>

<system contact="John Doe" log-panic="fb-support" sw-update="false"/>

</syntaxhighlight>

==User==

Full administrator account:

<syntaxhighlight>

<user name="admin" password="secret"/>

</syntaxhighlight>

Full administrator account with login idle timeout disabled:

<syntaxhighlight>

<user name="admin" password="secret" timeout="0"/>

</syntaxhighlight>

Debug account with a few extra things unhidden:

<syntaxhighlight>

<user name="admin" password="secret" timeout="0" level="DEBUG"/>

</syntaxhighlight>

Guest account with many things hidden:

<syntaxhighlight>

<user name="guest" password="secret" timeout="0" level="GUEST"/>

</syntaxhighlight>

==Logging==

General logging:

<syntaxhighlight>

<log name="default" comment="General logging for web viewing"/>

</syntaxhighlight>

Crash logs emailed to FireBrick support team:

<syntaxhighlight>

<log name="fb-support" comment="Log target for sending logs to FireBrick support team">

<email to="crashlog@firebrick.ltd.uk" delay="10" comment="Crash logs emailed to FireBrick support team"/>

</log>

</syntaxhighlight>

==Services - NTP Client==

Set time from FireBrick time server:

<syntaxhighlight>

<ntp/>

</syntaxhighlight>

Set time from AAISP time server:

<syntaxhighlight>

<ntp ntpserver="time.aa.net.uk"/>

</syntaxhighlight>

==Services - Telnet Server==

Enable telnet server, local-only by default:

<syntaxhighlight>

<telnet/>

</syntaxhighlight>

Enable telnet server, allow inbound to telnet server from a single IPv4 address:

<syntaxhighlight>

<telnet allow="10.0.0.2" local-only="false"/>

</syntaxhighlight>

Enable telnet server, allow inbound to telnet server from a block of IPv4s:

<syntaxhighlight>

<telnet allow="10.0.0.2-254" local-only="false"/>

</syntaxhighlight>

Enable telnet server, allow inbound to telnet server from a /29 block of IPv4s:

<syntaxhighlight>

<telnet allow="10.0.0.2/29" local-only="false"/>

</syntaxhighlight>

Enable telnet server, allow inbound to telnet server from a single IPv6 address:

<syntaxhighlight>

<telnet allow="2001:8b0:119c:acf2::1" local-only="false"/>

</syntaxhighlight>

Enable telnet server, allow inbound to telnet server from a /48 block of IPv6s:

<syntaxhighlight>

<telnet allow="2001:8b0:119c::/48" local-only="false"/>

</syntaxhighlight>

Enable telnet server, allow inbound to telnet server from a /64 block of IPv6s:

<syntaxhighlight>

<telnet allow="2001:8b0:119c:acf2::/64" local-only="false"/>

</syntaxhighlight>

==Services - HTTP Server==

Enable HTTP server, local-only by default:

<syntaxhighlight>

<http/>

</syntaxhighlight>

Enable HTTP server, allow inbound to HTTP server from a single IPv4 address:

<syntaxhighlight>

<http allow="10.0.0.2" local-only="false"/>

</syntaxhighlight>

Enable HTTP server, allow inbound to HTTP server from a block of IPv4s:

<syntaxhighlight>

<http allow="10.0.0.2-254" local-only="false"/>

</syntaxhighlight>

Enable HTTP server, allow inbound to HTTP server from a /29 block of IPv4s:

<syntaxhighlight>

<http allow="10.0.0.2/29" local-only="false"/>

</syntaxhighlight>

Enable HTTP server, allow inbound to HTTP server from a single IPv6 address:

<syntaxhighlight>

<http allow="2001:8b0:119c:acf2::1" local-only="false"/>

</syntaxhighlight>

Enable HTTP server, allow inbound to HTTP server from a /48 block of IPv6s:

<syntaxhighlight>

<http allow="2001:8b0:119c::/48" local-only="false"/>

</syntaxhighlight>

Enable HTTP server, allow inbound to HTTP server from a /64 block of IPv6s:

<syntaxhighlight>

<http allow="2001:8b0:119c:acf2::/64" local-only="false"/>

</syntaxhighlight>

==Services - DNS Service==

Enable DNS service, local-only by default:

<syntaxhighlight>

<dns resolvers="2001:8b0::2020 2001:8b0::2021 217.169.20.20 217.169.20.21"/>

</syntaxhighlight>

==Port Grouping and Naming==

Port grouping for one PPPoE connection:

<syntaxhighlight>

<port name="LAN" ports="1 2 3"/>

<port name="WAN" ports="4"/>

</syntaxhighlight>

Port grouping for two PPPoE connections:

<syntaxhighlight>

<port name="LAN" ports="1 2"/>

<port name="WAN2" ports="3"/>

<port name="WAN1" ports="4"/>

</syntaxhighlight>

Port grouping for three PPPoE connections:

<syntaxhighlight>

<port name="LAN" ports="1"/>

<port name="WAN3" ports="2"/>

<port name="WAN2" ports="3"/>

<port name="WAN1" ports="4"/>

</syntaxhighlight>

==Ethernet Interface==

LAN Interface:

<syntaxhighlight>

<interface name="LAN" port="LAN" ra-client="false">

<subnet ip="10.0.0.1/24 2001:8b0::1/64"/>

</interface>

</syntaxhighlight>

LAN Interface for IPv6 tunnel over 3G dongle (with MTU 1500):

<syntaxhighlight>

<interface name="LAN" port="LAN" ra-client="false">

<subnet ip="10.0.0.1/24 2001:8b0::1/64" ra="true" ra-mtu="1480" ra-dns="2001:8b0::2020 2001:8b0::2021"/>

</interface>

</syntaxhighlight>

LAN Interface for IPv6 tunnel over 3G dongle (with MTU 1492):

<syntaxhighlight>

<interface name="LAN" port="LAN" ra-client="false">

<subnet ip="10.0.0.1/24 2001:8b0::1/64" ra="true" ra-mtu="1472" ra-dns="2001:8b0::2020 2001:8b0::2021"/>

</interface>

</syntaxhighlight>

WAN Interface for a single PPPoE session:

<syntaxhighlight>

<interface name="WAN" port="WAN" ra-client="true"/>

</syntaxhighlight>

WAN Interface for dual PPPoE sessions:

<syntaxhighlight>

<interface name="WAN1" port="WAN1" ra-client="true"/>

<interface name="WAN2" port="WAN2" ra-client="true"/>

</syntaxhighlight>

WAN Interface for triple PPPoE sessions:

<syntaxhighlight>

<interface name="WAN1" port="WAN1" ra-client="true"/>

<interface name="WAN2" port="WAN2" ra-client="true"/>

<interface name="WAN3" port="WAN3" ra-client="true"/>

</syntaxhighlight>

==PPPoE==

Connect to AAISP over PPPoE session (with NAT):

<syntaxhighlight>

<ppp name="AAISP" port="WAN" username="me@a.1" password="secret" nat="true" graph="AAISP" log="default"/>

</syntaxhighlight>

Connect to AAISP over PPPoE session (without NAT):

<syntaxhighlight>

<ppp name="AAISP" port="WAN" username="me@a.1" password="secret" nat="false" graph="AAISP" log="default"/>

</syntaxhighlight>

Connect to AAISP over PPPoE session (with MTU 1500 and NAT):

<syntaxhighlight>

<ppp name="AAISP" port="WAN" username="me@a.1" password="secret" nat="true" mtu="1500" graph="AAISP" log="default"/>

</syntaxhighlight>

Connect to AAISP over PPPoE session (with MTU 1500 but without NAT):

<syntaxhighlight>

<ppp name="AAISP" port="WAN" username="me@a.1" password="secret" nat="false" mtu="1500" graph="AAISP" log="default"/>

</syntaxhighlight>

Connect to AAISP over PPPoE session (with MTU 1500, 3G dongle tweaks and NAT):

<syntaxhighlight>

<ppp name="AAISP" port="WAN" username="me@a.1" password="secret" nat="true" mtu="1500" lcp-rate="1" lcp-timeout="5" graph="AAISP" log="default"/>

</syntaxhighlight>

Connect to AAISP over PPPoE session (with MTU 1500, 3G dongle tweaks but without NAT):

<syntaxhighlight>

<ppp name="AAISP" port="WAN" username="me@a.1" password="secret" nat="false" mtu="1500" lcp-rate="1" lcp-timeout="5" graph="AAISP" log="default"/>

</syntaxhighlight>

==USB and 3G dongle==

Connect to AAISP over 3G dongle (with NAT):

<syntaxhighlight>

<dongle name="AAISP-3G" username="me@a.2" password="secret" nat="true" graph="AAISP-3G" log="default"/>

</syntaxhighlight>

Connect to AAISP over 3G dongle (without NAT):

<syntaxhighlight>

<dongle name="AAISP-3G" username="me@a.2" password="secret" nat="false" graph="AAISP-3G" log="default"/>

</syntaxhighlight>

Connect to AAISP over 3G dongle (with APN and NAT):

<syntaxhighlight>

<dongle name="AAISP-3G" apn="m2m.aql.net" username="me@a.2" password="secret" nat="true" graph="AAISP-3G" log="default"/>

</syntaxhighlight>

Connect to AAISP over 3G dongle (with APN but without NAT):

<syntaxhighlight>

<dongle name="AAISP-3G" apn="m2m.aql.net" username="me@a.2" password="secret" nat="false" graph="AAISP-3G" log="default"/>

</syntaxhighlight>

==Static Routes==

3G dongle IPv6 default route using IPv4 tunnel:

<syntaxhighlight>

<route ip="::/0" gateway="81.187.81.6" comment="IPv6 default route using IPv4 tunnel"/>

</syntaxhighlight>

==Firewall - Rule Set==

Default firewall rule for traffic to LAN:

<syntaxhighlight>

<rule-set name="Firewall: LAN" target-interface="LAN" no-match-action="reject" comment="Default firewall rule for traffic to LAN">

</rule-set>

</syntaxhighlight>

==Firewall - Rule(s)==

Allow all from the FireBrick to LAN - This rule is important:

<syntaxhighlight>

<rule name="Allow Firebrick" source-interface="self" comment="Allow all from the FireBrick to LAN"/>

</syntaxhighlight>

Allow inbound calls to your VoIP Phone, if you register it with Voiceless:

<syntaxhighlight>

<rule name="SIP" source-ip="81.187.30.110-119 90.155.3.0/24 90.155.103.0/24 2001:8b0:0:30::5060:0/112 2001:8b0:5060::/48" target-ip="10.0.0.3" target-port="5060" action="accept"/>

<rule name="RTP" source-ip="81.187.30.110-119 90.155.3.0/24 90.155.103.0/24 2001:8b0:0:30::5060:0/112 2001:8b0:5060::/48" target-ip="10.0.0.3" target-port="1024-65535" protocol="17" action="accept"/>

</syntaxhighlight>

Allow inbound calls to your Snom Phone, if you register it with Voiceless:

<syntaxhighlight>

<rule name="SIP" source-ip="81.187.30.110-119 90.155.3.0/24 90.155.103.0/24 2001:8b0:0:30::5060:0/112 2001:8b0:5060::/48" target-ip="10.0.0.3" target-port="5060" action="accept"/>

<rule name="RTP" source-ip="81.187.30.110-119 90.155.3.0/24 90.155.103.0/24 2001:8b0:0:30::5060:0/112 2001:8b0:5060::/48" target-ip="10.0.0.3" target-port="49152-65534" protocol="17" action="accept"/>

</syntaxhighlight>

==VoIP==

VoIP with IPv6 source IP defined:

<syntaxhighlight>

<voip source-ip6="2001:8b0::1">

</voip>

</syntaxhighlight>

VoIP with IPv4 and IPv6 source IPs defined:

<syntaxhighlight>

<voip source-ip4="10.0.0.1" source-ip6="2001:8b0::1">

</voip>

</syntaxhighlight>

==VoIP Carriers==

VoIP carrier that registers with Voiceless and binds inbound/outbound calls to extension 1000 as below:

<syntaxhighlight>

<carrier name="AASIP+441234567890" allow="81.187.30.110-119 90.155.3.0/24 90.155.103.0/24 2001:8b0:0:30::5060:0/112 2001:8b0:5060::/48" registrar="voiceless.aa.net.uk" username="+441234567890" password="secret" extn="1000"/>

</syntaxhighlight>

==VoIP Users==

VoIP user that accepts registrations from your VoIP phone:

<syntaxhighlight>

<telephone name="John" display-name="John" username="John" password="secret" extn="1000" carrier="AASIP+441234567890"/>

</syntaxhighlight>