Beruflich Dokumente
Kultur Dokumente
KRIEGSMAN.io
Home Contact
January 2016
The EdgeRouter Lite is configured by default on eth0. Connect an
Ethernet cable from the Ethernet port of your computer to the port labeled
eth0 on the EdgeRouter Lite.
Social
Configure the Ethernet adapter on your host system with a static IP
address on the 192.168.1.x subnet (e.g., 192.168.1.100).
To Access the routers command line interface. You can use the CLI
button while inside the Web UI or by using an SSH program such as
PuTTY. PuTTY is generally quicker.
1 configure
2
3 set interfaces ethernet eth1 address
192.168.2.254/24
4 set interfaces ethernet eth1 description "eth1
- LAN"
5 set interfaces ethernet eth1 duplex auto
6 set interfaces ethernet eth1 speed auto
7
1 of 18 07/10/2016 11:00 AM
Conguring a Ubiquiti EdgeRouter Lite for KPN |... https://kriegsman.io/2016/01/conguring-a-ubiquit...
Reconnect the Ethernet cable from the Ethernet port of your computer to
the port labeled eth1 on the EdgeRouter Lite.
Connect an Ethernet cable from the NTU to the port labeled eth0 and
connect an Ethernet cable from the WAN port of the ExperiaBox to the
port labeled eth2.
) Configure firewall
1 configure
2
3 set firewall all-ping enable
4 set firewall broadcast-ping disable
5 set firewall ipv6-receive-redirects disable
6 set firewall ipv6-src-route disable
7 set firewall ip-src-route disable
8 set firewall log-martians enable
9 set firewall receive-redirects disable
10 set firewall send-redirects enable
2 of 18 07/10/2016 11:00 AM
Conguring a Ubiquiti EdgeRouter Lite for KPN |... https://kriegsman.io/2016/01/conguring-a-ubiquit...
3 of 18 07/10/2016 11:00 AM
Conguring a Ubiquiti EdgeRouter Lite for KPN |... https://kriegsman.io/2016/01/conguring-a-ubiquit...
) Generate the configuration line for user-id, used to set the pppoe
authentication
1 sudo su
2 pppoe_id=$(ifconfig | grep -m 1 eth0 | awk
'{print $5}' | awk -F':' '{print "set
interfaces ethernet eth0 vif 6 pppoe 0 user-id
"$1"-"$2"-"$3"-"$4"-"$5"-"$6"@internet"}')
3 echo "$pppoe_id"
4 exit
1 configure
2
3 delete interfaces ethernet eth0 address
4
5 set interfaces ethernet eth0 description "eth0
- FTTH"
6 set interfaces ethernet eth0 duplex auto
7 set interfaces ethernet eth0 speed auto
8 set interfaces ethernet eth0 mtu 1512
9
10 set interfaces ethernet eth0 vif 6 description
"eth0.6 - Internet"
11 set interfaces ethernet eth0 vif 6 mtu 1508
12
13 (YOUR SET LINE FOR USER-ID, received from
previous step)
14 set interfaces ethernet eth0 vif 6 pppoe 0
password kpn
15 set interfaces ethernet eth0 vif 6 pppoe 0
default-route auto
16 set interfaces ethernet eth0 vif 6 pppoe 0
name-server auto
17 set interfaces ethernet eth0 vif 6 pppoe 0
idle-timeout 180
18 set interfaces ethernet eth0 vif 6 pppoe 0 mtu
1500
19
20 set interfaces ethernet eth0 vif 6 pppoe 0
firewall in name WAN_IN
21 set interfaces ethernet eth0 vif 6 pppoe 0
firewall local name WAN_LOCAL
22
4 of 18 07/10/2016 11:00 AM
Conguring a Ubiquiti EdgeRouter Lite for KPN |... https://kriegsman.io/2016/01/conguring-a-ubiquit...
1 configure
2
3 set system offload ipv4 forwarding enable
4 set system offload ipv4 pppoe enable
5 set system offload ipv4 vlan enable
6
7 commit
8 save
9 exit
1 configure
2
3 set service nat rule 5010 description "KPN
Internet"
4 set service nat rule 5010 log enable
5 set service nat rule 5010 outbound-interface
pppoe0
6 set service nat rule 5010 protocol all
7 set service nat rule 5010 source address
192.168.2.0/24
8 set service nat rule 5010 type masquerade
9
10 commit
11 save
12 exit
1 configure
2
3 set system traffic-analysis dpi enable
4 set system traffic-analysis export enable
5
6 commit
7 save
8 exit
) Add the Debian APT repository (to install tools like nano/iptraf)
5 of 18 07/10/2016 11:00 AM
Conguring a Ubiquiti EdgeRouter Lite for KPN |... https://kriegsman.io/2016/01/conguring-a-ubiquit...
1 configure
2
3 set system package repository wheezy components
"main contrib non-free"
4 set system package repository wheezy
distribution wheezy
5 set system package repository wheezy url
http://mirror.leaseweb.com/debian
6 set system package repository wheezy-security
components main
7 set system package repository wheezy-security
distribution wheezy/updates
8 set system package repository wheezy-security
url http://security.debian.org
9
10 commit
11 save
12 exit
13
14 sudo apt-get update
1 configure
2
3 set interfaces bridge br0
4 set interfaces ethernet eth0 vif 7 bridge-group
bridge br0
5 set interfaces ethernet eth0 vif 7 description
"eth0.7 - VOIP"
6 set interfaces ethernet eth0 vif 7 mtu 1500
7
8 set interfaces ethernet eth2 description "eth2
- ExperiaBox"
9 set interfaces ethernet eth2 duplex auto
10 set interfaces ethernet eth2 speed auto
11 set interfaces ethernet eth2 vif 7 bridge-group
bridge br0
12 set interfaces ethernet eth2 vif 7 description
"eth2.7 - ExperiaBox VOIP"
13 set interfaces ethernet eth2 vif 7 mtu 1500
14
15 commit
16 save
17 exit
1 configure
6 of 18 07/10/2016 11:00 AM
Conguring a Ubiquiti EdgeRouter Lite for KPN |... https://kriegsman.io/2016/01/conguring-a-ubiquit...
2
3 set interfaces ethernet eth0 vif 4 address dhcp
4 set interfaces ethernet eth0 vif 4 description
"eth0.4 - IPTV"
5 set interfaces ethernet eth0 vif 4 dhcp-options
client-option "send vendor-class-identifier
"IPTV_RG";"
6 set interfaces ethernet eth0 vif 4 dhcp-options
client-option "request subnet-mask, routers,
rfc3442-classless-static-routes;"
7 set interfaces ethernet eth0 vif 4 dhcp-options
default-route no-update
8 set interfaces ethernet eth0 vif 4 dhcp-options
default-route-distance 210
9 set interfaces ethernet eth0 vif 4 dhcp-options
name-server update
10
11 commit
12 save
13 exit
1 configure
2
3 set service dhcp-server global-parameters
"option vendor-class-identifier code 60 =
string;"
4 set service dhcp-server global-parameters
"option broadcast-address code 28 =
ip-address;"
5
6 commit
7 save
8 exit
) NAT rules are required for the IPTV settop box to connect to the IPTV
platform
) The following commands will return 2 configuration lines required.
1 sudo su
2 r_ip=$(show dhcp client leases | grep router |
awk '{ print $3 }');
3 iptv_static=$(echo "set protocols static route
213.75.112.0/21 next-hop $r_ip")
4 echo -e "$iptv_static"
5 exit
1 configure
2
3 set service nat rule 5000 description IPTV
4 set service nat rule 5000 log disable
7 of 18 07/10/2016 11:00 AM
Conguring a Ubiquiti EdgeRouter Lite for KPN |... https://kriegsman.io/2016/01/conguring-a-ubiquit...
1 configure
2
3 set protocols igmp-proxy interface eth0.4
alt-subnet 0.0.0.0/0
4 set protocols igmp-proxy interface eth0.4 role
upstream
5 set protocols igmp-proxy interface eth0.4
threshold 1
6 set protocols igmp-proxy interface eth1
alt-subnet 0.0.0.0/0
7 set protocols igmp-proxy interface eth1 role
downstream
8 set protocols igmp-proxy interface eth1
threshold 1
9
10 commit
11 save
12 exit
1 configure
2
3 set firewall ipv6-name WANv6_IN default-action
drop
4 set firewall ipv6-name WANv6_IN description
"WAN inbound traffic forwarded to LAN"
5 set firewall ipv6-name WANv6_IN enable-
default-log
6
7 set firewall ipv6-name WANv6_IN rule 10 action
accept
8 set firewall ipv6-name WANv6_IN rule 10
description "Allow established/related
sessions"
9 set firewall ipv6-name WANv6_IN rule 10 state
established enable
10 set firewall ipv6-name WANv6_IN rule 10 state
related enable
11 set firewall ipv6-name WANv6_IN rule 20 action
8 of 18 07/10/2016 11:00 AM
Conguring a Ubiquiti EdgeRouter Lite for KPN |... https://kriegsman.io/2016/01/conguring-a-ubiquit...
drop
12 set firewall ipv6-name WANv6_IN rule 20
description "Drop invalid state"
13 set firewall ipv6-name WANv6_IN rule 20 state
invalid enable
14
15 set firewall ipv6-name WANv6_LOCAL default-
action drop
16 set firewall ipv6-name WANv6_LOCAL description
"WAN inbound traffic to the router"
17 set firewall ipv6-name WANv6_LOCAL enable-
default-log
18
19 set firewall ipv6-name WANv6_LOCAL rule 10
action accept
20 set firewall ipv6-name WANv6_LOCAL rule 10
description "Allow established/related
sessions"
21 set firewall ipv6-name WANv6_LOCAL rule 10
state established enable
22 set firewall ipv6-name WANv6_LOCAL rule 10
state related enable
23
24 set firewall ipv6-name WANv6_LOCAL rule 20
action drop
25 set firewall ipv6-name WANv6_LOCAL rule 20
description "Drop invalid state"
26
27 set firewall ipv6-name WANv6_LOCAL rule 20
state invalid enable
28 set firewall ipv6-name WANv6_LOCAL rule 30
action accept
29 set firewall ipv6-name WANv6_LOCAL rule 30
description "Allow IPv6 icmp"
30 set firewall ipv6-name WANv6_LOCAL rule 30
protocol ipv6-icmp
31
32 set firewall ipv6-name WANv6_LOCAL rule 40
action accept
33 set firewall ipv6-name WANv6_LOCAL rule 40
description "allow dhcpv6"
34 set firewall ipv6-name WANv6_LOCAL rule 40
destination port 546
35 set firewall ipv6-name WANv6_LOCAL rule 40
protocol udp
36 set firewall ipv6-name WANv6_LOCAL rule 40
source port 547
37
38 commit
39 save
40 exit
) Setup IPv6 on the pppoe interface and create a static route over the
pppoe interface
1 configure
2
3 set interfaces ethernet eth0 vif 6 pppoe 0
9 of 18 07/10/2016 11:00 AM
Conguring a Ubiquiti EdgeRouter Lite for KPN |... https://kriegsman.io/2016/01/conguring-a-ubiquit...
1 configure
2
3 set interfaces ethernet eth1 ipv6 dup-addr-
detect-transmits 1
4 set interfaces ethernet eth1 ipv6 router-advert
cur-hop-limit 64
5 set interfaces ethernet eth1 ipv6 router-advert
link-mtu 0
6 set interfaces ethernet eth1 ipv6 router-advert
managed-flag false
7 set interfaces ethernet eth1 ipv6 router-advert
max-interval 600
8 set interfaces ethernet eth1 ipv6 router-advert
name-server 2001:4860:4860::8888
9 set interfaces ethernet eth1 ipv6 router-advert
name-server 2001:4860:4860::8844
10 set interfaces ethernet eth1 ipv6 router-advert
radvd-options "RDNSS 2001:4860:4860::8888
2001:4860:4860::8844 {};"
11
12 set interfaces ethernet eth1 ipv6 router-advert
other-config-flag false
13 set interfaces ethernet eth1 ipv6 router-advert
reachable-time 0
14 set interfaces ethernet eth1 ipv6 router-advert
retrans-timer 0
15 set interfaces ethernet eth1 ipv6 router-advert
10 of 18 07/10/2016 11:00 AM
Conguring a Ubiquiti EdgeRouter Lite for KPN |... https://kriegsman.io/2016/01/conguring-a-ubiquit...
send-advert true
16 set interfaces ethernet eth1 ipv6 router-advert
prefix ::/64 autonomous-flag true
17 set interfaces ethernet eth1 ipv6 router-advert
prefix ::/64 on-link-flag true
18 set interfaces ethernet eth1 ipv6 router-advert
prefix ::/64 valid-lifetime 2592000
19
20 set system name-server 2001:4860:4860::8888
21 set system name-server 2001:4860:4860::8844
22
23 commit
24 save
25 exit
1 configure
2
3 set system offload ipv6 forwarding enable
4 set system offload ipv6 pppoe enable
5
6 commit
7 save
8 exit
1 reboot
Here is the full configuration file (/config/config.boot). Before you load the
full configuration on your edgerouter, make sure you replace the following
[MAC] [ROUTER-IP] [NAT-MASK]
1 firewall {
2 all-ping enable
3 broadcast-ping disable
4 ipv6-name WANv6_IN {
5 default-action drop
6 description "WAN inbound traffic
forwarded to LAN"
7 enable-default-log
11 of 18 07/10/2016 11:00 AM
Conguring a Ubiquiti EdgeRouter Lite for KPN |... https://kriegsman.io/2016/01/conguring-a-ubiquit...
8 rule 10 {
9 action accept
10 description "Allow
established/related sessions"
11 state {
12 established enable
13 related enable
14 }
15 }
16 rule 20 {
17 action drop
18 description "Drop invalid state"
19 state {
20 invalid enable
21 }
22 }
23 }
24 ipv6-name WANv6_LOCAL {
25 default-action drop
26 description "WAN inbound traffic to the
router"
27 enable-default-log
28 rule 10 {
29 action accept
30 description "Allow
established/related sessions"
31 state {
32 established enable
33 related enable
34 }
35 }
36 rule 20 {
37 action drop
38 description "Drop invalid state"
39 state {
40 invalid enable
41 }
42 }
43 rule 30 {
44 action accept
45 description "Allow IPv6 icmp"
46 protocol ipv6-icmp
47 }
48 rule 40 {
49 action accept
50 description "allow dhcpv6"
51 destination {
52 port 546
53 }
54 protocol udp
55 source {
56 port 547
57 }
58 }
59 }
60 ipv6-receive-redirects disable
61 ipv6-src-route disable
62 ip-src-route disable
63 log-martians enable
64 name WAN_IN {
65 default-action drop
12 of 18 07/10/2016 11:00 AM
Conguring a Ubiquiti EdgeRouter Lite for KPN |... https://kriegsman.io/2016/01/conguring-a-ubiquit...
13 of 18 07/10/2016 11:00 AM
Conguring a Ubiquiti EdgeRouter Lite for KPN |... https://kriegsman.io/2016/01/conguring-a-ubiquit...
14 of 18 07/10/2016 11:00 AM
Conguring a Ubiquiti EdgeRouter Lite for KPN |... https://kriegsman.io/2016/01/conguring-a-ubiquit...
183 ipv6 {
184 address {
185 autoconf
186 }
187 dup-addr-detect-transmits 1
188 enable {
189 }
190 }
191 mtu 1500
192 name-server auto
193 password kpn
194 user-id [MAC]@internet
195 }
196 }
197 vif 7 {
198 bridge-group {
199 bridge br0
200 }
201 description "eth0.7 - Telefonie"
202 mtu 1500
203 }
204 }
205 ethernet eth1 {
206 address 192.168.2.254/24
207 description "eth1 - LAN"
208 duplex auto
209 ipv6 {
210 dup-addr-detect-transmits 1
211 router-advert {
212 cur-hop-limit 64
213 link-mtu 0
214 managed-flag false
215 max-interval 600
216 name-server
2001:4860:4860::8888
217 name-server
2001:4860:4860::8844
218 other-config-flag false
219 prefix ::/64 {
220 autonomous-flag true
221 on-link-flag true
222 valid-lifetime 2592000
223 }
224 radvd-options "RDNSS
2001:4860:4860::8888 2001:4860:4860::8844 {};"
225 reachable-time 0
226 retrans-timer 0
227 send-advert true
228 }
229 }
230 speed auto
231 }
232 ethernet eth2 {
233 description "eth2 - ExperiaBox"
234 duplex auto
235 speed auto
236 vif 7 {
237 bridge-group {
238 bridge br0
239 }
240 description "eth2.7 - ExperiaBox
15 of 18 07/10/2016 11:00 AM
Conguring a Ubiquiti EdgeRouter Lite for KPN |... https://kriegsman.io/2016/01/conguring-a-ubiquit...
VOIP"
241 mtu 1500
242 }
243 }
244 loopback lo {
245 }
246 }
247 protocols {
248 igmp-proxy {
249 interface eth0.4 {
250 alt-subnet 0.0.0.0/0
251 role upstream
252 threshold 1
253 }
254 interface eth1 {
255 alt-subnet 0.0.0.0/0
256 role downstream
257 threshold 1
258 }
259 }
260 static {
261 interface-route6 ::/0 {
262 next-hop-interface pppoe0 {
263 }
264 }
265 route 213.75.112.0/21 {
266 next-hop [ROUTER-IP] {
267 }
268 }
269 }
270 }
271 service {
272 dhcp-server {
273 disabled false
274 global-parameters "option vendor-class-
identifier code 60 = string;"
275 global-parameters "option broadcast-
address code 28 = ip-address;"
276 hostfile-update disable
277 shared-network-name LAN {
278 authoritative enable
279 subnet 192.168.2.0/24 {
280 default-router 192.168.2.254
281 dns-server 8.8.8.8
282 dns-server 8.8.4.4
283 lease 86400
284 start 192.168.2.50 {
285 stop 192.168.2.200
286 }
287 }
288 }
289 }
290 dns {
291 forwarding {
292 cache-size 150
293 listen-on eth1
294 name-server 8.8.8.8
295 name-server 8.8.4.4
296 options listen-
address=192.168.2.254
297 }
16 of 18 07/10/2016 11:00 AM
Conguring a Ubiquiti EdgeRouter Lite for KPN |... https://kriegsman.io/2016/01/conguring-a-ubiquit...
298 }
299 gui {
300 https-port 443
301 }
302 nat {
303 rule 5000 {
304 description IPTV
305 destination {
306 address 213.75.112.0/21
307 }
308 log disable
309 outbound-interface eth0.4
310 protocol all
311 source {
312 }
313 type masquerade
314 }
315 rule 5010 {
316 description "KPN Internet"
317 log enable
318 outbound-interface pppoe0
319 protocol all
320 source {
321 address 192.168.2.0/24
322 }
323 type masquerade
324 }
325 }
326 ssh {
327 port 22
328 protocol-version v2
329 }
330 }
331 system {
332 host-name ubnt
333 login {
334 user ubnt {
335 authentication {
336 encrypted-password
$1$zKNoUbAo$gomzUbYvgyUMcD436Wo66.
337 }
338 level admin
339 }
340 }
341 name-server 2001:4860:4860::8888
342 name-server 2001:4860:4860::8844
343 name-server 8.8.8.8
344 name-server 8.8.4.4
345 ntp {
346 server 0.ubnt.pool.ntp.org {
347 }
348 server 1.ubnt.pool.ntp.org {
349 }
350 server 2.ubnt.pool.ntp.org {
351 }
352 server 3.ubnt.pool.ntp.org {
353 }
354 }
355 offload {
356 ipv4 {
357 forwarding enable
17 of 18 07/10/2016 11:00 AM
Conguring a Ubiquiti EdgeRouter Lite for KPN |... https://kriegsman.io/2016/01/conguring-a-ubiquit...
18 of 18 07/10/2016 11:00 AM