FireBrick 2700 Configuration: Difference between revisions

From AAISP Support Site
mNo edit summary
(lang=xml)
Line 10: Line 10:
=Factory Default Config=
=Factory Default Config=
The factory default config of a FireBrick looks like this:
The factory default config of a FireBrick looks like this:
<syntaxhighlight>
<syntaxhighlight lang=xml>
<?xml version="1.0" encoding="UTF-8"?>
<?xml version="1.0" encoding="UTF-8"?>
<config xmlns="http://firebrick.ltd.uk/xml/fb2700/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://firebrick.ltd.uk/xml/fb2700/ http://firebrick.ltd.uk/download/FB2701/xml/fb2700/1.38.001.xsd" patch="22527">
<config xmlns="http://firebrick.ltd.uk/xml/fb2700/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://firebrick.ltd.uk/xml/fb2700/ http://firebrick.ltd.uk/download/FB2701/xml/fb2700/1.38.001.xsd" patch="22527">
Line 61: Line 61:
Here we have an example of the FireBrick using NAT:
Here we have an example of the FireBrick using NAT:


<syntaxhighlight>
<syntaxhighlight lang=xml>
<?xml version="1.0" encoding="UTF-8"?>
<?xml version="1.0" encoding="UTF-8"?>
<config xmlns="http://firebrick.ltd.uk/xml/fb2700/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://firebrick.ltd.uk/xml/fb2700/ http://firebrick.ltd.uk/download/FB2701/xml/fb2700/1.38.001.xsd" patch="22527">
<config xmlns="http://firebrick.ltd.uk/xml/fb2700/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://firebrick.ltd.uk/xml/fb2700/ http://firebrick.ltd.uk/download/FB2701/xml/fb2700/1.38.001.xsd" patch="22527">
Line 92: Line 92:
and here the FireBrick is NAT free:
and here the FireBrick is NAT free:


<syntaxhighlight>
<syntaxhighlight lang=xml>
<?xml version="1.0" encoding="UTF-8"?>
<?xml version="1.0" encoding="UTF-8"?>
<config xmlns="http://firebrick.ltd.uk/xml/fb2700/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://firebrick.ltd.uk/xml/fb2700/ http://firebrick.ltd.uk/download/FB2701/xml/fb2700/1.38.001.xsd" patch="22527">
<config xmlns="http://firebrick.ltd.uk/xml/fb2700/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://firebrick.ltd.uk/xml/fb2700/ http://firebrick.ltd.uk/download/FB2701/xml/fb2700/1.38.001.xsd" patch="22527">
Line 126: Line 126:
Here we have an example of setting up VoIP on the FireBrick, inbound and outbound calls, inbound URI calls, and outbound URI calls to AAISP:
Here we have an example of setting up VoIP on the FireBrick, inbound and outbound calls, inbound URI calls, and outbound URI calls to AAISP:


<syntaxhighlight>
<syntaxhighlight lang=xml>
<voip source-ip4="217.169.11.113" source-ip6="2001:8b0:119c:acf2::1">
<voip source-ip4="217.169.11.113" source-ip6="2001:8b0:119c:acf2::1">
<carrier name="AASIP+441234567890" allow="81.187.30.110-119 90.155.3.0/24 90.155.103.0/24 2001:8b0:0:30::5060:0/112 2001:8b0:5060::/48"
<carrier name="AASIP+441234567890" allow="81.187.30.110-119 90.155.3.0/24 90.155.103.0/24 2001:8b0:0:30::5060:0/112 2001:8b0:5060::/48"
Line 140: Line 140:
and here we use Direct Dial In, extn= is removed from <carrier> element and ddi= added to <telephone> element:
and here we use Direct Dial In, extn= is removed from <carrier> element and ddi= added to <telephone> element:


<syntaxhighlight>
<syntaxhighlight lang=xml>
<voip source-ip4="217.169.11.113" source-ip6="2001:8b0:119c:acf2::1">
<voip source-ip4="217.169.11.113" source-ip6="2001:8b0:119c:acf2::1">
<carrier name="AASIP+441234567890" allow="81.187.30.110-119 90.155.3.0/24 90.155.103.0/24 2001:8b0:0:30::5060:0/112 2001:8b0:5060::/48"
<carrier name="AASIP+441234567890" allow="81.187.30.110-119 90.155.3.0/24 90.155.103.0/24 2001:8b0:0:30::5060:0/112 2001:8b0:5060::/48"
Line 157: Line 157:
Here we allow limited IPv6 addresses access to Telnet and HTTP, this stops you locking yourself out, in the example below 2001:8b0:119c:acf2::2/64 is used but you will need to use your own IP address instead, it also allows AAISP staff to login:
Here we allow limited IPv6 addresses access to Telnet and HTTP, this stops you locking yourself out, in the example below 2001:8b0:119c:acf2::2/64 is used but you will need to use your own IP address instead, it also allows AAISP staff to login:


<syntaxhighlight>
<syntaxhighlight lang=xml>
<telnet allow="2001:8b0:119c:acf2::2/64 2001:8b0::/47" local-only="false"/>
<telnet allow="2001:8b0:119c:acf2::2/64 2001:8b0::/47" local-only="false"/>
<http allow="2001:8b0:119c:acf2::2/64 2001:8b0::/47" local-only="false"/>
<http allow="2001:8b0:119c:acf2::2/64 2001:8b0::/47" local-only="false"/>
Line 164: Line 164:
then add a user account for AAISP, don't forgot to change password to something else:
then add a user account for AAISP, don't forgot to change password to something else:


<syntaxhighlight>
<syntaxhighlight lang=xml>
<user name="AAISP" password="secret" timeout="1:00:00"/>
<user name="AAISP" password="secret" timeout="1:00:00"/>
</syntaxhighlight>
</syntaxhighlight>
Line 173: Line 173:
Ports - LAN is on ports 1 and 2, WAN1 is on port 4, WAN2 is on port 3:
Ports - LAN is on ports 1 and 2, WAN1 is on port 4, WAN2 is on port 3:


<syntaxhighlight>
<syntaxhighlight lang=xml>
<port name="LAN" ports="1 2"/>
<port name="LAN" ports="1 2"/>
<port name="WAN2" ports="3"/>
<port name="WAN2" ports="3"/>
Line 181: Line 181:
Interface - LAN interface, with DHCP for IPv4 addresses and RA for IPv6 addresses, assumes PPP session is 1500 MTU, if PPP session is 1492 MTU then change 1472 to 1464 in second ra-mtu= element:
Interface - LAN interface, with DHCP for IPv4 addresses and RA for IPv6 addresses, assumes PPP session is 1500 MTU, if PPP session is 1492 MTU then change 1472 to 1464 in second ra-mtu= element:


<syntaxhighlight>
<syntaxhighlight lang=xml>
<interface name="LAN" port="LAN" ra-client="false">
<interface name="LAN" port="LAN" ra-client="false">
<subnet ip="2001:8b0:119c:acf2::1/64 217.169.11.113/29" ra="true" ra-mtu="1412" ra-dns="2001:8b0::2020 2001:8b0::2021" profile="DSL-Down"/>
<subnet ip="2001:8b0:119c:acf2::1/64 217.169.11.113/29" ra="true" ra-mtu="1412" ra-dns="2001:8b0::2020 2001:8b0::2021" profile="DSL-Down"/>
Line 191: Line 191:
Interface - WAN interfaces, RA client is enabled:
Interface - WAN interfaces, RA client is enabled:


<syntaxhighlight>
<syntaxhighlight lang=xml>
<interface name="WAN1" port="WAN1" ra-client="true"/>
<interface name="WAN1" port="WAN1" ra-client="true"/>
<interface name="WAN2" port="WAN2" ra-client="true"/>
<interface name="WAN2" port="WAN2" ra-client="true"/>
Line 198: Line 198:
PPP - Connect to both lines, MTU is 1500, timeout is 5 seconds:
PPP - Connect to both lines, MTU is 1500, timeout is 5 seconds:


<syntaxhighlight>
<syntaxhighlight lang=xml>
<ppp name="AAISP1" port="WAN1" username="me@a.1" password="secret" mtu="1500" lcp-rate="1" lcp-timeout="5" graph="AAISP1" log="default" nat="false"/>
<ppp name="AAISP1" port="WAN1" username="me@a.1" password="secret" mtu="1500" lcp-rate="1" lcp-timeout="5" graph="AAISP1" log="default" nat="false"/>
<ppp name="AAISP2" port="WAN2" username="me@a.2" password="secret" mtu="1500" lcp-rate="1" lcp-timeout="5" graph="AAISP2" log="default" nat="false"/>
<ppp name="AAISP2" port="WAN2" username="me@a.2" password="secret" mtu="1500" lcp-rate="1" lcp-timeout="5" graph="AAISP2" log="default" nat="false"/>
Line 205: Line 205:
Dongle - Connect over 3G:
Dongle - Connect over 3G:


<syntaxhighlight>
<syntaxhighlight lang=xml>
<usb>
<usb>
<dongle name="AAISP3" username="me@a.3" password="secret" nat="false" graph="AAISP3" log="default"/>
<dongle name="AAISP3" username="me@a.3" password="secret" nat="false" graph="AAISP3" log="default"/>
Line 213: Line 213:
Static Route - Brings up IPv6 default route using IPv4 tunnel when both lines are down or unplugged:
Static Route - Brings up IPv6 default route using IPv4 tunnel when both lines are down or unplugged:


<syntaxhighlight>
<syntaxhighlight lang=xml>
<route ip="::/0" gateway="81.187.81.6" profile="DSL-Down" comment="IPv6 default route using IPv4 tunnel"/>
<route ip="::/0" gateway="81.187.81.6" profile="DSL-Down" comment="IPv6 default route using IPv4 tunnel"/>
</syntaxhighlight>
</syntaxhighlight>
Line 219: Line 219:
Profiles - Checks if both lines are up or down:
Profiles - Checks if both lines are up or down:


<syntaxhighlight>
<syntaxhighlight lang=xml>
<profile name="DSL-Down" interval="1" timeout="5" recover="1" ppp="AAISP1 AAISP2" invert="true" comment="DSL is Down"/>
<profile name="DSL-Down" interval="1" timeout="5" recover="1" ppp="AAISP1 AAISP2" invert="true" comment="DSL is Down"/>
<profile name="DSL-Up" not="DSL-Down" comment="DSL is Up"/>
<profile name="DSL-Up" not="DSL-Down" comment="DSL is Up"/>
Line 229: Line 229:
Ports - LAN is on ports 1 and 2, WAN1 is on port 4, WAN2 is on port 3:
Ports - LAN is on ports 1 and 2, WAN1 is on port 4, WAN2 is on port 3:


<syntaxhighlight>
<syntaxhighlight lang=xml>
<port name="LAN" ports="1 2"/>
<port name="LAN" ports="1 2"/>
<port name="WAN2" ports="3"/>
<port name="WAN2" ports="3"/>
Line 237: Line 237:
Interface - LAN interface, with DHCP for IPv4 addresses and RA for IPv6 addresses, assumes PPP session is 1500 MTU, if PPP session is 1492 MTU then change 1472 to 1464 in second ra-mtu= element:
Interface - LAN interface, with DHCP for IPv4 addresses and RA for IPv6 addresses, assumes PPP session is 1500 MTU, if PPP session is 1492 MTU then change 1472 to 1464 in second ra-mtu= element:


<syntaxhighlight>
<syntaxhighlight lang=xml>
<interface name="LAN" port="LAN" ra-client="false">
<interface name="LAN" port="LAN" ra-client="false">
<subnet ip="2001:8b0:119c:acf2::1/64 217.169.11.113/29" ra="true" ra-mtu="1412" ra-dns="2001:8b0::2020 2001:8b0::2021" profile="DSL-Down"/>
<subnet ip="2001:8b0:119c:acf2::1/64 217.169.11.113/29" ra="true" ra-mtu="1412" ra-dns="2001:8b0::2020 2001:8b0::2021" profile="DSL-Down"/>
Line 247: Line 247:
Interface - WAN interfaces, RA client is enabled:
Interface - WAN interfaces, RA client is enabled:


<syntaxhighlight>
<syntaxhighlight lang=xml>
<interface name="WAN1" port="WAN1" ra-client="true"/>
<interface name="WAN1" port="WAN1" ra-client="true"/>
<interface name="WAN2" port="WAN2" ra-client="true"/>
<interface name="WAN2" port="WAN2" ra-client="true"/>
Line 254: Line 254:
PPP - Connect to both lines, MTU is 1500, timeout is 5 seconds, localpref= gives priority to the highest value:
PPP - Connect to both lines, MTU is 1500, timeout is 5 seconds, localpref= gives priority to the highest value:


<syntaxhighlight>
<syntaxhighlight lang=xml>
<ppp name="AAISP1" port="WAN1" username="me@a.1" password="secret" mtu="1500" lcp-rate="1" lcp-timeout="5" localpref="1000" graph="AAISP1" log="default" nat="false"/>
<ppp name="AAISP1" port="WAN1" username="me@a.1" password="secret" mtu="1500" lcp-rate="1" lcp-timeout="5" localpref="1000" graph="AAISP1" log="default" nat="false"/>
<ppp name="AAISP2" port="WAN2" username="me@a.2" password="secret" mtu="1500" lcp-rate="1" lcp-timeout="5" localpref="100" graph="AAISP2" log="default" nat="false"/>
<ppp name="AAISP2" port="WAN2" username="me@a.2" password="secret" mtu="1500" lcp-rate="1" lcp-timeout="5" localpref="100" graph="AAISP2" log="default" nat="false"/>
Line 261: Line 261:
Dongle - Connect over 3G, localpref= gives this connection the lowest priority:
Dongle - Connect over 3G, localpref= gives this connection the lowest priority:


<syntaxhighlight>
<syntaxhighlight lang=xml>
<usb>
<usb>
<dongle name="AAISP3" username="me@a.3" password="secret" nat="false" localpref="10" graph="AAISP3" log="default"/>
<dongle name="AAISP3" username="me@a.3" password="secret" nat="false" localpref="10" graph="AAISP3" log="default"/>
Line 269: Line 269:
Static Route - Brings up IPv6 default route using IPv4 tunnel when both lines are down or unplugged:
Static Route - Brings up IPv6 default route using IPv4 tunnel when both lines are down or unplugged:


<syntaxhighlight>
<syntaxhighlight lang=xml>
<route ip="::/0" gateway="81.187.81.6" profile="DSL-Down" comment="IPv6 default route using IPv4 tunnel"/>
<route ip="::/0" gateway="81.187.81.6" profile="DSL-Down" comment="IPv6 default route using IPv4 tunnel"/>
</syntaxhighlight>
</syntaxhighlight>
Line 275: Line 275:
Profiles - Checks if both lines are up or down:
Profiles - Checks if both lines are up or down:


<syntaxhighlight>
<syntaxhighlight lang=xml>
<profile name="DSL-Down" interval="1" timeout="5" recover="1" ppp="AAISP1 AAISP2" invert="true" comment="DSL is Down"/>
<profile name="DSL-Down" interval="1" timeout="5" recover="1" ppp="AAISP1 AAISP2" invert="true" comment="DSL is Down"/>
<profile name="DSL-Up" not="DSL-Down" comment="DSL is Up"/>
<profile name="DSL-Up" not="DSL-Down" comment="DSL is Up"/>

Revision as of 23:30, 7 March 2016

2700-small.png

This page describes editing the XML directly. The Firebrick does have a Web User Interface too. Both can be used to edit the config, as they edit the same underlying XML.

These instructions are mostly applicable to the 2500 too. The difference between the 2700 and the 2500 is that:

  • The 2700 has a USB port so supports 3G fallback, the 2500 does not have a USB port.
  • The 2700 has faster throughput - 350Mbit/s on the 2700 compared to 100Mbit/s on the 2500.


Factory Default Config

The factory default config of a FireBrick looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<config xmlns="http://firebrick.ltd.uk/xml/fb2700/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://firebrick.ltd.uk/xml/fb2700/ http://firebrick.ltd.uk/download/FB2701/xml/fb2700/1.38.001.xsd" patch="22527">
   <system contact="John Doe" log-panic="fb-support"/>
   <log name="default" comment="General logging for web viewing"/>
   <log name="fb-support" comment="Log target for sending logs to FireBrick support team">
      <email to="crashlog@firebrick.ltd.uk" delay="10" comment="Crash logs emailed to FireBrick support team"/>
   </log>
   <services>
      <ntp/>
      <telnet/>
      <http local-only="true"/>
      <dns>
         <host name="my.firebrick.co.uk my.firebrick.uk"/>
      </dns>
   </services>
   <port name="LAN1" ports="1"/>
   <port name="LAN2" ports="2"/>
   <port name="LAN3" ports="3"/>
   <port name="WAN" ports="4"/>
   <interface name="LAN1" port="LAN1" ra-client="false" comment="Default LAN interface">
      <subnet name="Default IPs" ip="2001:db8::1/64 10.0.0.1/24" ra="false" nat="true" comment="Temporary IPs for setup only, delete when finished configuring"/>
      <dhcp name="Auto allocated IPs" comment="Allocates IP addresses automatically"/>
   </interface>
   <interface name="LAN2" port="LAN2" ra-client="false" comment="Default LAN interface">
      <subnet name="Default IPs" ip="2001:db8::1/64 10.0.0.1/24" ra="false" nat="true" comment="Temporary IPs for setup only, delete when finished configuring"/>
      <dhcp name="Auto allocated IPs" comment="Allocates IP addresses automatically"/>
   </interface>
   <interface name="LAN3" port="LAN3" ra-client="false" comment="Default LAN interface">
      <subnet name="Default IPs" ip="2001:db8::1/64 10.0.0.1/24" ra="false" nat="true" comment="Temporary IPs for setup only, delete when finished configuring"/>
      <dhcp name="Auto allocated IPs" comment="Allocates IP addresses automatically"/>
   </interface>
   <interface name="WAN" port="WAN" ra-client="true" comment="Default WAN interface">
      <subnet name="DHCP client" comment="Delete if not required, not needed if using PPP"/>
   </interface>
   <ppp name="LAN-PPPoE" port="LAN1" username="me@firebrick" password="password" nat="true"/>
   <ppp name="WAN-PPPoE" port="WAN" username="me@firebrick" password="password" nat="true"/>
   <usb>
      <dongle name="Example-3G" comment="Default 3G config, does not usually require any more settings"/>
   </usb>
   <rule-set name="Firewall: LAN" target-interface="LAN1 LAN2 LAN3" no-match-action="reject" comment="Default firewall rule for traffic to LAN">
      <rule name="Allow Firebrick" source-interface="self" comment="Allow all from the FireBrick to LAN"/>
   </rule-set>
</config>


Quick Start Config

Here we have an example of the FireBrick using NAT:

<?xml version="1.0" encoding="UTF-8"?>
<config xmlns="http://firebrick.ltd.uk/xml/fb2700/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://firebrick.ltd.uk/xml/fb2700/ http://firebrick.ltd.uk/download/FB2701/xml/fb2700/1.38.001.xsd" patch="22527">
   <system contact="John Doe" log-panic="fb-support"/>
   <user name="admin" password="secret" timeout="1:00:00"/>
   <log name="default" comment="General logging for web viewing"/>
   <log name="fb-support" comment="Log target for sending logs to FireBrick support team">
      <email to="crashlog@firebrick.ltd.uk" delay="10" comment="Crash logs emailed to FireBrick support team"/>
   </log>
   <services>
      <ntp ntpserver="time.aa.net.uk"/>
      <telnet/>
      <http/>
      <dns resolvers="2001:8b0::2020 2001:8b0::2021 217.169.20.20 217.169.20.21"/>
   </services>
   <port name="LAN" ports="1 2 3"/>
   <port name="WAN" ports="4"/>
   <interface name="LAN" port="LAN" ra-client="false">
      <subnet ip="2001:db8::1/64 10.0.0.1/24"/>
      <dhcp name="DHCP" ip="10.0.0.2-254" lease="1:00:00"/>
   </interface>
   <interface name="WAN" port="WAN" ra-client="true"/>
   <ppp name="AAISP" port="WAN" username="me@a.1" password="secret" graph="AAISP" log="default" nat="true"/>
   <rule-set name="Firewall: LAN" target-interface="LAN" no-match-action="reject" comment="Default firewall rule for traffic to LAN">
      <rule name="Allow Firebrick" source-interface="self" comment="Allow all from the FireBrick to LAN"/>
   </rule-set>
</config>

and here the FireBrick is NAT free:

<?xml version="1.0" encoding="UTF-8"?>
<config xmlns="http://firebrick.ltd.uk/xml/fb2700/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://firebrick.ltd.uk/xml/fb2700/ http://firebrick.ltd.uk/download/FB2701/xml/fb2700/1.38.001.xsd" patch="22527">
   <system contact="John Doe" log-panic="fb-support"/>
   <user name="admin" password="secret" timeout="1:00:00"/>
   <log name="default" comment="General logging for web viewing"/>
   <log name="fb-support" comment="Log target for sending logs to FireBrick support team">
      <email to="crashlog@firebrick.ltd.uk" delay="10" comment="Crash logs emailed to FireBrick support team"/>
   </log>
   <services>
      <ntp ntpserver="time.aa.net.uk"/>
      <telnet/>
      <http/>
      <dns resolvers="2001:8b0::2020 2001:8b0::2021 217.169.20.20 217.169.20.21"/>
   </services>
   <port name="LAN" ports="1 2 3"/>
   <port name="WAN" ports="4"/>
   <interface name="LAN" port="LAN" ra-client="false">
      <subnet ip="2001:8b0:119c:acf2::1/64 217.169.11.113/29"/>
      <dhcp name="DHCP" ip="217.169.11.114-118" lease="1:00:00"/>
   </interface>
   <interface name="WAN" port="WAN" ra-client="true"/>
   <ppp name="AAISP" port="WAN" username="me@a.1" password="secret" graph="AAISP" log="default" nat="false"/>
   <rule-set name="Firewall: LAN" target-interface="LAN" no-match-action="reject" comment="Default firewall rule for traffic to LAN">
      <rule name="Allow Firebrick" source-interface="self" comment="Allow all from the FireBrick to LAN"/>
   </rule-set>
</config>


VoIP

Here we have an example of setting up VoIP on the FireBrick, inbound and outbound calls, inbound URI calls, and outbound URI calls to AAISP:

<voip source-ip4="217.169.11.113" source-ip6="2001:8b0:119c:acf2::1">
   <carrier name="AASIP+441234567890" allow="81.187.30.110-119 90.155.3.0/24 90.155.103.0/24 2001:8b0:0:30::5060:0/112 2001:8b0:5060::/48"
            registrar="voiceless.aa.net.uk" username="+441234567890" password="secret" extn="1000"/>
   <carrier name="URI" to="@domain.name" trust-cli="true" extn="1000"/>
   <telephone name="John" display-name="John" username="John" password="secret" extn="1000" carrier="AASIP+441234567890"/>
   <telephone name="AAISP-Sales" extn="400222" uri="sales@aa.net.uk"/>
   <telephone name="AAISP-Accounts" extn="400666" uri="accounts@aa.net.uk"/>
   <telephone name="AAISP-Support" extn="400999" uri="support@aa.net.uk"/>
</voip>

and here we use Direct Dial In, extn= is removed from <carrier> element and ddi= added to <telephone> element:

<voip source-ip4="217.169.11.113" source-ip6="2001:8b0:119c:acf2::1">
   <carrier name="AASIP+441234567890" allow="81.187.30.110-119 90.155.3.0/24 90.155.103.0/24 2001:8b0:0:30::5060:0/112 2001:8b0:5060::/48"
            registrar="voiceless.aa.net.uk" username="+441234567890" password="secret"/>
   <carrier name="URI" to="@domain.name" trust-cli="true" extn="1000"/>
   <telephone name="John" display-name="John" username="John" password="secret" extn="1000" ddi="+441234567890" carrier="AASIP+441234567890"/>
   <telephone name="AAISP-Sales" extn="400222" uri="sales@aa.net.uk"/>
   <telephone name="AAISP-Accounts" extn="400666" uri="accounts@aa.net.uk"/>
   <telephone name="AAISP-Support" extn="400999" uri="support@aa.net.uk"/>
</voip>


Remote Login

Here we allow limited IPv6 addresses access to Telnet and HTTP, this stops you locking yourself out, in the example below 2001:8b0:119c:acf2::2/64 is used but you will need to use your own IP address instead, it also allows AAISP staff to login:

<telnet allow="2001:8b0:119c:acf2::2/64 2001:8b0::/47" local-only="false"/>
<http allow="2001:8b0:119c:acf2::2/64 2001:8b0::/47" local-only="false"/>

then add a user account for AAISP, don't forgot to change password to something else:

<user name="AAISP" password="secret" timeout="1:00:00"/>


Two Lines with 3G Dongle - Bonded

Ports - LAN is on ports 1 and 2, WAN1 is on port 4, WAN2 is on port 3:

<port name="LAN" ports="1 2"/>
<port name="WAN2" ports="3"/>
<port name="WAN1" ports="4"/>

Interface - LAN interface, with DHCP for IPv4 addresses and RA for IPv6 addresses, assumes PPP session is 1500 MTU, if PPP session is 1492 MTU then change 1472 to 1464 in second ra-mtu= element:

<interface name="LAN" port="LAN" ra-client="false">
<subnet ip="2001:8b0:119c:acf2::1/64 217.169.11.113/29" ra="true" ra-mtu="1412" ra-dns="2001:8b0::2020 2001:8b0::2021" profile="DSL-Down"/>
<subnet ip="2001:8b0:119c:acf2::1/64 217.169.11.113/29" ra="true" ra-mtu="1472" ra-dns="2001:8b0::2020 2001:8b0::2021" profile="DSL-Up"/>
<dhcp name="DHCP" ip="217.169.11.114-118" lease="1:00:00"/>
</interface>

Interface - WAN interfaces, RA client is enabled:

<interface name="WAN1" port="WAN1" ra-client="true"/>
<interface name="WAN2" port="WAN2" ra-client="true"/>

PPP - Connect to both lines, MTU is 1500, timeout is 5 seconds:

<ppp name="AAISP1" port="WAN1" username="me@a.1" password="secret" mtu="1500" lcp-rate="1" lcp-timeout="5" graph="AAISP1" log="default" nat="false"/>
<ppp name="AAISP2" port="WAN2" username="me@a.2" password="secret" mtu="1500" lcp-rate="1" lcp-timeout="5" graph="AAISP2" log="default" nat="false"/>

Dongle - Connect over 3G:

<usb>
<dongle name="AAISP3" username="me@a.3" password="secret" nat="false" graph="AAISP3" log="default"/>
</usb>

Static Route - Brings up IPv6 default route using IPv4 tunnel when both lines are down or unplugged:

<route ip="::/0" gateway="81.187.81.6" profile="DSL-Down" comment="IPv6 default route using IPv4 tunnel"/>

Profiles - Checks if both lines are up or down:

<profile name="DSL-Down" interval="1" timeout="5" recover="1" ppp="AAISP1 AAISP2" invert="true" comment="DSL is Down"/>
<profile name="DSL-Up" not="DSL-Down" comment="DSL is Up"/>


Two Lines with 3G Dongle - Fallover

Ports - LAN is on ports 1 and 2, WAN1 is on port 4, WAN2 is on port 3:

<port name="LAN" ports="1 2"/>
<port name="WAN2" ports="3"/>
<port name="WAN1" ports="4"/>

Interface - LAN interface, with DHCP for IPv4 addresses and RA for IPv6 addresses, assumes PPP session is 1500 MTU, if PPP session is 1492 MTU then change 1472 to 1464 in second ra-mtu= element:

<interface name="LAN" port="LAN" ra-client="false">
<subnet ip="2001:8b0:119c:acf2::1/64 217.169.11.113/29" ra="true" ra-mtu="1412" ra-dns="2001:8b0::2020 2001:8b0::2021" profile="DSL-Down"/>
<subnet ip="2001:8b0:119c:acf2::1/64 217.169.11.113/29" ra="true" ra-mtu="1472" ra-dns="2001:8b0::2020 2001:8b0::2021" profile="DSL-Up"/>
<dhcp name="DHCP" ip="217.169.11.114-118" lease="1:00:00"/>
</interface>

Interface - WAN interfaces, RA client is enabled:

<interface name="WAN1" port="WAN1" ra-client="true"/>
<interface name="WAN2" port="WAN2" ra-client="true"/>

PPP - Connect to both lines, MTU is 1500, timeout is 5 seconds, localpref= gives priority to the highest value:

<ppp name="AAISP1" port="WAN1" username="me@a.1" password="secret" mtu="1500" lcp-rate="1" lcp-timeout="5" localpref="1000" graph="AAISP1" log="default" nat="false"/>
<ppp name="AAISP2" port="WAN2" username="me@a.2" password="secret" mtu="1500" lcp-rate="1" lcp-timeout="5" localpref="100" graph="AAISP2" log="default" nat="false"/>

Dongle - Connect over 3G, localpref= gives this connection the lowest priority:

<usb>
<dongle name="AAISP3" username="me@a.3" password="secret" nat="false" localpref="10" graph="AAISP3" log="default"/>
</usb>

Static Route - Brings up IPv6 default route using IPv4 tunnel when both lines are down or unplugged:

<route ip="::/0" gateway="81.187.81.6" profile="DSL-Down" comment="IPv6 default route using IPv4 tunnel"/>

Profiles - Checks if both lines are up or down:

<profile name="DSL-Down" interval="1" timeout="5" recover="1" ppp="AAISP1 AAISP2" invert="true" comment="DSL is Down"/>
<profile name="DSL-Up" not="DSL-Down" comment="DSL is Up"/>


Firewall

Here are some pre-written firewall rules: