config defaults
        option syn_flood '1'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option flow_offloading '1'

# Dom / LAN1 - 192.168.1.0/24 -> SNAT 194.24.244.149
config zone
        option name 'home'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

# LAN2 - 192.168.2.0/24 -> SNAT 194.24.244.150
config zone
        option name 'server2'
        list network 'server2'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

# LAN3 - Ubiquiti / 192.168.12.0/24 -> SNAT 194.24.244.147
config zone
        option name 'ubnt'
        list network 'ubnt'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

# LAN4 - administracja
config zone
        option name 'admin'
        list network 'admin'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'wan'
        list network 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option mtu_fix '1'

# Dostep do Internetu z kazdej prywatnej sieci
config forwarding
        option src 'home'
        option dest 'wan'

config forwarding
        option src 'server2'
        option dest 'wan'

config forwarding
        option src 'ubnt'
        option dest 'wan'

config forwarding
        option src 'admin'
        option dest 'wan'

# Z portu administracyjnego mozna zarzadzac pozostalymi sieciami.
config forwarding
        option src 'admin'
        option dest 'home'

config forwarding
        option src 'admin'
        option dest 'server2'

config forwarding
        option src 'admin'
        option dest 'ubnt'

# Podstawowe reguly WAN
config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

# Jawny SNAT: kazda podsiec wychodzi swoim publicznym IP z routowanej puli /29.
# Nie wlaczamy masquerade na WAN, bo wtedy ruch moglby wychodzic jako 194.24.244.102.
config nat
        option name 'SNAT-HOME-149'
        option src 'wan'
        option src_ip '192.168.1.0/24'
        option target 'SNAT'
        option snat_ip '194.24.244.149'
        option family 'ipv4'

config nat
        option name 'SNAT-SERVER2-150'
        option src 'wan'
        option src_ip '192.168.2.0/24'
        option target 'SNAT'
        option snat_ip '194.24.244.150'
        option family 'ipv4'

config nat
        option name 'SNAT-UBNT-147'
        option src 'wan'
        option src_ip '192.168.12.0/24'
        option target 'SNAT'
        option snat_ip '194.24.244.147'
        option family 'ipv4'

# Port administracyjny dzieli wyjscie .149 z siecia domowa.
config nat
        option name 'SNAT-ADMIN-149'
        option src 'wan'
        option src_ip '192.168.10.0/24'
        option target 'SNAT'
        option snat_ip '194.24.244.149'
        option family 'ipv4'
