防火墙

set firewall global-options all-ping enable

set firewall zone LOCAL local-zone

set firewall zone LAN member interface br0

set firewall zone WAN member interface pppoe0

set firewall zone LAN interface br0

set firewall zone WAN interface pppoe0

set firewall ipv4 name LAN-LOCAL default-action accept

set firewall zone LOCAL from LAN firewall name LAN-LOCAL

set firewall ipv6 name LAN-LOCAL-6 default-action accept

set firewall zone LOCAL from LAN firewall ipv6-name LAN-LOCAL-6

set firewall ipv4 name LOCAL-LAN default-action accept

set firewall zone LAN from LOCAL firewall name LOCAL-LAN

set firewall ipv6 name LOCAL-LAN-6 default-action accept

set firewall zone LAN from LOCAL firewall ipv6-name LOCAL-LAN-6

set firewall ipv4 name LAN-WAN default-action accept

set firewall zone WAN from LAN firewall name LAN-WAN

set firewall ipv6 name LAN-WAN-6 default-action accept

set firewall zone WAN from LAN firewall ipv6-name LAN-WAN-6

set firewall ipv4 name WAN-LAN default-action drop

set firewall ipv4 name WAN-LAN rule 1 action accept

set firewall ipv4 name WAN-LAN rule 1 state established

set firewall ipv4 name WAN-LAN rule 1 state related

set firewall zone LAN from WAN firewall name WAN-LAN

set firewall ipv6 name WAN-LAN-6 default-action drop

set firewall ipv6 name WAN-LAN-6 rule 1 action accept

set firewall ipv6 name WAN-LAN-6 rule 1 state established

set firewall ipv6 name WAN-LAN-6 rule 1 state related

set firewall zone LAN from WAN firewall ipv6-name WAN-LAN-6

set firewall ipv4 name LOCAL-WAN default-action accept

set firewall zone WAN from LOCAL firewall name LOCAL-WAN

set firewall ipv6 name LOCAL-WAN-6 default-action accept

set firewall zone WAN from LOCAL firewall ipv6-name LOCAL-WAN-6

set firewall ipv4 name WAN-LOCAL default-action drop

set firewall ipv4 name WAN-LOCAL rule 1 action accept

set firewall ipv4 name WAN-LOCAL rule 1 state established

set firewall ipv4 name WAN-LOCAL rule 1 state related

set firewall ipv4 name WAN-LOCAL rule 10 action accept

set firewall ipv4 name WAN-LOCAL rule 10 protocol icmp

set firewall ipv4 name WAN-LOCAL rule 10 icmp type 3   # destination-unreachable

set firewall ipv4 name WAN-LOCAL rule 11 action accept

set firewall ipv4 name WAN-LOCAL rule 11 protocol icmp

set firewall ipv4 name WAN-LOCAL rule 11 icmp type 11  # time-exceeded

set firewall ipv4 name WAN-LOCAL rule 12 action accept

set firewall ipv4 name WAN-LOCAL rule 12 protocol icmp

set firewall ipv4 name WAN-LOCAL rule 12 icmp type 0    # echo-reply

set firewall ipv4 name WAN-LOCAL rule 12 limit rate 10/second

set firewall ipv4 name WAN-LOCAL rule 12 limit burst 20

set firewall ipv4 name WAN-LOCAL rule 20 action accept

set firewall ipv4 name WAN-LOCAL rule 20 protocol icmp

set firewall ipv4 name WAN-LOCAL rule 20 icmp type 8   # echo-request

set firewall ipv4 name WAN-LOCAL rule 20 limit rate 10/second

set firewall ipv4 name WAN-LOCAL rule 20 limit burst 20

set firewall zone LOCAL from WAN firewall name WAN-LOCAL

set firewall ipv6 name WAN-LOCAL-6 default-action drop

set firewall ipv6 name WAN-LOCAL-6 rule 1 action accept

set firewall ipv6 name WAN-LOCAL-6 rule 1 state established

set firewall ipv6 name WAN-LOCAL-6 rule 1 state related

set firewall ipv6 name WAN-LOCAL-6 rule 10 action accept

set firewall ipv6 name WAN-LOCAL-6 rule 10 protocol ipv6-icmp

set firewall ipv6 name WAN-LOCAL-6 rule 10 icmpv6 type 1   # destination-unreachable

set firewall ipv6 name WAN-LOCAL-6 rule 11 action accept

set firewall ipv6 name WAN-LOCAL-6 rule 11 protocol ipv6-icmp

set firewall ipv6 name WAN-LOCAL-6 rule 11 icmpv6 type 2   # packet-too-big

set firewall ipv6 name WAN-LOCAL-6 rule 12 action accept

set firewall ipv6 name WAN-LOCAL-6 rule 12 protocol ipv6-icmp

set firewall ipv6 name WAN-LOCAL-6 rule 12 icmpv6 type 3   # time-exceeded

set firewall ipv6 name WAN-LOCAL-6 rule 13 action accept

set firewall ipv6 name WAN-LOCAL-6 rule 13 protocol ipv6-icmp

set firewall ipv6 name WAN-LOCAL-6 rule 13 icmpv6 type 4   # parameter-problem

set firewall ipv6 name WAN-LOCAL-6 rule 15 action accept

set firewall ipv6 name WAN-LOCAL-6 rule 15 protocol ipv6-icmp

set firewall ipv6 name WAN-LOCAL-6 rule 15 icmpv6 type 128   # echo-request

set firewall ipv6 name WAN-LOCAL-6 rule 15 limit rate 10/second

set firewall ipv6 name WAN-LOCAL-6 rule 15 limit burst 20

set firewall ipv6 name WAN-LOCAL-6 rule 16 action accept

set firewall ipv6 name WAN-LOCAL-6 rule 16 protocol ipv6-icmp

set firewall ipv6 name WAN-LOCAL-6 rule 16 icmpv6 type 133   # router-solicit

set firewall ipv6 name WAN-LOCAL-6 rule 17 action accept

set firewall ipv6 name WAN-LOCAL-6 rule 17 protocol ipv6-icmp

set firewall ipv6 name WAN-LOCAL-6 rule 17 icmpv6 type 134   # router-advertisement

set firewall ipv6 name WAN-LOCAL-6 rule 18 action accept

set firewall ipv6 name WAN-LOCAL-6 rule 18 protocol ipv6-icmp

set firewall ipv6 name WAN-LOCAL-6 rule 18 icmpv6 type 135   # nd-neighbor-solicit

set firewall ipv6 name WAN-LOCAL-6 rule 19 action accept

set firewall ipv6 name WAN-LOCAL-6 rule 19 protocol ipv6-icmp

set firewall ipv6 name WAN-LOCAL-6 rule 19 icmpv6 type 136   # nd-neighbor-advert

set firewall ipv6 name WAN-LOCAL-6 rule 20 action accept

set firewall ipv6 name WAN-LOCAL-6 rule 20 protocol udp

set firewall ipv6 name WAN-LOCAL-6 rule 20 destination port 546

set firewall ipv6 name WAN-LOCAL-6 rule 20 source port 547

set firewall zone LOCAL from WAN firewall ipv6-name WAN-LOCAL-6