Skip to content

O
OpnSense
Commit f763c7cd authored by Franco Fichtner's avatar Franco Fichtner
Browse files
Options

config: reformat config.xml sample, some additions

parent 06723bcf
Hide whitespace changes
Inline Side-by-side
Showing with 613 additions and 674 deletions
src/etc/config.xml.sample
View file @ f763c7cd
<?xml version="1.0"?> <?xml version="1.0"?>
<opnsense> <opnsense>
<trigger_initial_wizard/> <trigger_initial_wizard/>
<version>9.9</version> <version>11.2</version>
<lastchange></lastchange> <lastchange></lastchange>
<theme>opnsense</theme> <theme>opnsense</theme>
<sysctl> <sysctl>
<item> <item>
<descr><![CDATA[Disable the pf ftp proxy handler.]]></descr> <descr><![CDATA[Disable the pf ftp proxy handler.]]></descr>
<tunable>debug.pfftpproxy</tunable> <tunable>debug.pfftpproxy</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Increase UFS read-ahead speeds to match current state of hard drives and NCQ. More information here: http://ivoras.sharanet.org/blog/tree/2010-11-19.ufs-read-ahead.html]]></descr> <descr><![CDATA[Increase UFS read-ahead speeds to match current state of hard drives and NCQ. More information here: http://ivoras.sharanet.org/blog/tree/2010-11-19.ufs-read-ahead.html]]></descr>
<tunable>vfs.read_max</tunable> <tunable>vfs.read_max</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Set the ephemeral port range to be lower.]]></descr> <descr><![CDATA[Set the ephemeral port range to be lower.]]></descr>
<tunable>net.inet.ip.portrange.first</tunable> <tunable>net.inet.ip.portrange.first</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Drop packets to closed TCP ports without returning a RST]]></descr> <descr><![CDATA[Drop packets to closed TCP ports without returning a RST]]></descr>
<tunable>net.inet.tcp.blackhole</tunable> <tunable>net.inet.tcp.blackhole</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Do not send ICMP port unreachable messages for closed UDP ports]]></descr> <descr><![CDATA[Do not send ICMP port unreachable messages for closed UDP ports]]></descr>
<tunable>net.inet.udp.blackhole</tunable> <tunable>net.inet.udp.blackhole</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Randomize the ID field in IP packets (default is 0: sequential IP IDs)]]></descr> <descr><![CDATA[Randomize the ID field in IP packets (default is 0: sequential IP IDs)]]></descr>
<tunable>net.inet.ip.random_id</tunable> <tunable>net.inet.ip.random_id</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[ <descr><![CDATA[
Source routing is another way for an attacker to try to reach non-routable addresses behind your box. Source routing is another way for an attacker to try to reach non-routable addresses behind your box.
It can also be used to probe for information about your internal networks. These functions come enabled It can also be used to probe for information about your internal networks. These functions come enabled
as part of the standard FreeBSD core system. as part of the standard FreeBSD core system.
]]></descr> ]]></descr>
<tunable>net.inet.ip.sourceroute</tunable> <tunable>net.inet.ip.sourceroute</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[ <descr><![CDATA[
Source routing is another way for an attacker to try to reach non-routable addresses behind your box. Source routing is another way for an attacker to try to reach non-routable addresses behind your box.
It can also be used to probe for information about your internal networks. These functions come enabled It can also be used to probe for information about your internal networks. These functions come enabled
as part of the standard FreeBSD core system. as part of the standard FreeBSD core system.
]]></descr> ]]></descr>
<tunable>net.inet.ip.accept_sourceroute</tunable> <tunable>net.inet.ip.accept_sourceroute</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[ <descr><![CDATA[
Redirect attacks are the purposeful mass-issuing of ICMP type 5 packets. In a normal network, redirects Redirect attacks are the purposeful mass-issuing of ICMP type 5 packets. In a normal network, redirects
to the end stations should not be required. This option enables the NIC to drop all inbound ICMP redirect to the end stations should not be required. This option enables the NIC to drop all inbound ICMP redirect
packets without returning a response. packets without returning a response.
]]></descr> ]]></descr>
<tunable>net.inet.icmp.drop_redirect</tunable> <tunable>net.inet.icmp.drop_redirect</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[ <descr><![CDATA[
This option turns off the logging of redirect packets because there is no limit and this could fill This option turns off the logging of redirect packets because there is no limit and this could fill
up your logs consuming your whole hard drive. up your logs consuming your whole hard drive.
]]></descr> ]]></descr>
<tunable>net.inet.icmp.log_redirect</tunable> <tunable>net.inet.icmp.log_redirect</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Drop SYN-FIN packets (breaks RFC1379, but nobody uses it anyway)]]></descr> <descr><![CDATA[Drop SYN-FIN packets (breaks RFC1379, but nobody uses it anyway)]]></descr>
<tunable>net.inet.tcp.drop_synfin</tunable> <tunable>net.inet.tcp.drop_synfin</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Enable sending IPv4 redirects]]></descr> <descr><![CDATA[Enable sending IPv4 redirects]]></descr>
<tunable>net.inet.ip.redirect</tunable> <tunable>net.inet.ip.redirect</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Enable sending IPv6 redirects]]></descr> <descr><![CDATA[Enable sending IPv6 redirects]]></descr>
<tunable>net.inet6.ip6.redirect</tunable> <tunable>net.inet6.ip6.redirect</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Enable privacy settings for IPv6 (RFC 4941)]]></descr> <descr><![CDATA[Enable privacy settings for IPv6 (RFC 4941)]]></descr>
<tunable>net.inet6.ip6.use_tempaddr</tunable> <tunable>net.inet6.ip6.use_tempaddr</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Prefer privacy addresses and use them over the normal addresses]]></descr> <descr><![CDATA[Prefer privacy addresses and use them over the normal addresses]]></descr>
<tunable>net.inet6.ip6.prefer_tempaddr</tunable> <tunable>net.inet6.ip6.prefer_tempaddr</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Generate SYN cookies for outbound SYN-ACK packets]]></descr> <descr><![CDATA[Generate SYN cookies for outbound SYN-ACK packets]]></descr>
<tunable>net.inet.tcp.syncookies</tunable> <tunable>net.inet.tcp.syncookies</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Maximum incoming/outgoing TCP datagram size (receive)]]></descr> <descr><![CDATA[Maximum incoming/outgoing TCP datagram size (receive)]]></descr>
<tunable>net.inet.tcp.recvspace</tunable> <tunable>net.inet.tcp.recvspace</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Maximum incoming/outgoing TCP datagram size (send)]]></descr> <descr><![CDATA[Maximum incoming/outgoing TCP datagram size (send)]]></descr>
<tunable>net.inet.tcp.sendspace</tunable> <tunable>net.inet.tcp.sendspace</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[IP Fastforwarding]]></descr> <descr><![CDATA[IP Fastforwarding]]></descr>
<tunable>net.inet.ip.fastforwarding</tunable> <tunable>net.inet.ip.fastforwarding</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Do not delay ACK to try and piggyback it onto a data packet]]></descr> <descr><![CDATA[Do not delay ACK to try and piggyback it onto a data packet]]></descr>
<tunable>net.inet.tcp.delayed_ack</tunable> <tunable>net.inet.tcp.delayed_ack</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Maximum outgoing UDP datagram size]]></descr> <descr><![CDATA[Maximum outgoing UDP datagram size]]></descr>
<tunable>net.inet.udp.maxdgram</tunable> <tunable>net.inet.udp.maxdgram</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Handling of non-IP packets which are not passed to pfil (see if_bridge(4))]]></descr> <descr><![CDATA[Handling of non-IP packets which are not passed to pfil (see if_bridge(4))]]></descr>
<tunable>net.link.bridge.pfil_onlyip</tunable> <tunable>net.link.bridge.pfil_onlyip</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Set to 0 to disable filtering on the incoming and outgoing member interfaces.]]></descr> <descr><![CDATA[Set to 0 to disable filtering on the incoming and outgoing member interfaces.]]></descr>
<tunable>net.link.bridge.pfil_member</tunable> <tunable>net.link.bridge.pfil_member</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Set to 1 to enable filtering on the bridge interface]]></descr> <descr><![CDATA[Set to 1 to enable filtering on the bridge interface]]></descr>
<tunable>net.link.bridge.pfil_bridge</tunable> <tunable>net.link.bridge.pfil_bridge</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Allow unprivileged access to tap(4) device nodes]]></descr> <descr><![CDATA[Allow unprivileged access to tap(4) device nodes]]></descr>
<tunable>net.link.tap.user_open</tunable> <tunable>net.link.tap.user_open</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Randomize PID's (see src/sys/kern/kern_fork.c: sysctl_kern_randompid())]]></descr> <descr><![CDATA[Randomize PID's (see src/sys/kern/kern_fork.c: sysctl_kern_randompid())]]></descr>
<tunable>kern.randompid</tunable> <tunable>kern.randompid</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Maximum size of the IP input queue]]></descr> <descr><![CDATA[Maximum size of the IP input queue]]></descr>
<tunable>net.inet.ip.intr_queue_maxlen</tunable> <tunable>net.inet.ip.intr_queue_maxlen</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Disable CTRL+ALT+Delete reboot from keyboard.]]></descr> <descr><![CDATA[Disable CTRL+ALT+Delete reboot from keyboard.]]></descr>
<tunable>hw.syscons.kbd_reboot</tunable> <tunable>hw.syscons.kbd_reboot</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Enable TCP extended debugging]]></descr> <descr><![CDATA[Enable TCP extended debugging]]></descr>
<tunable>net.inet.tcp.log_debug</tunable> <tunable>net.inet.tcp.log_debug</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Set ICMP Limits]]></descr> <descr><![CDATA[Set ICMP Limits]]></descr>
<tunable>net.inet.icmp.icmplim</tunable> <tunable>net.inet.icmp.icmplim</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[TCP Offload Engine]]></descr> <descr><![CDATA[TCP Offload Engine]]></descr>
<tunable>net.inet.tcp.tso</tunable> <tunable>net.inet.tcp.tso</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[UDP Checksums]]></descr> <descr><![CDATA[UDP Checksums]]></descr>
<tunable>net.inet.udp.checksum</tunable> <tunable>net.inet.udp.checksum</tunable>
<value>default</value> <value>default</value>
</item> </item>
<item> <item>
<descr><![CDATA[Maximum socket buffer size]]></descr> <descr><![CDATA[Maximum socket buffer size]]></descr>
<tunable>kern.ipc.maxsockbuf</tunable> <tunable>kern.ipc.maxsockbuf</tunable>
<value>default</value> <value>default</value>
</item> </item>
</sysctl> </sysctl>
<system> <system>
<optimization>normal</optimization> <optimization>normal</optimization>
<hostname>OPNsense</hostname> <hostname>OPNsense</hostname>
<domain>localdomain</domain> <domain>localdomain</domain>
<dnsserver/> <dnsserver/>
<dnsallowoverride/> <dnsallowoverride/>
<group> <group>
<name>admins</name> <name>admins</name>
<description><![CDATA[System Administrators]]></description> <description><![CDATA[System Administrators]]></description>
<scope>system</scope> <scope>system</scope>
<gid>1999</gid> <gid>1999</gid>
<member>0</member> <member>0</member>
<priv>page-all</priv> <priv>page-all</priv>
</group> </group>
<user> <user>
<name>root</name> <name>root</name>
<descr><![CDATA[System Administrator]]></descr> <descr><![CDATA[System Administrator]]></descr>
<scope>system</scope> <scope>system</scope>
<groupname>admins</groupname> <groupname>admins</groupname>
<password>$6$$Y8Et6wWDdXO2tJZRabvSfQvG2Lc8bAS6D9COIsMXEJ2KjA27wqDuAyd/CdazBQc3H3xQX.JXMKxJeRz2OqTkl.</password> <password>$6$$Y8Et6wWDdXO2tJZRabvSfQvG2Lc8bAS6D9COIsMXEJ2KjA27wqDuAyd/CdazBQc3H3xQX.JXMKxJeRz2OqTkl.</password>
<uid>0</uid> <uid>0</uid>
<priv>user-shell-access</priv> <priv>user-shell-access</priv>
</user> </user>
<nextuid>2000</nextuid> <nextuid>2000</nextuid>
<nextgid>2000</nextgid> <nextgid>2000</nextgid>
<timezone>Etc/UTC</timezone> <timezone>Europe/Amsterdam</timezone>
<time-update-interval>300</time-update-interval> <time-update-interval>300</time-update-interval>
<timeservers>0.nl.pool.ntp.org</timeservers> <timeservers>0.nl.pool.ntp.org</timeservers>
<webgui> <webgui>
<protocol>https</protocol> <protocol>https</protocol>
</webgui> </webgui>
<disablenatreflection>yes</disablenatreflection> <disablenatreflection>yes</disablenatreflection>
<disableconsolemenu/> <disableconsolemenu/>
<!-- <harddiskstandby></harddiskstandby> --> <disablesegmentationoffloading/>
<disablesegmentationoffloading/> <disablelargereceiveoffloading/>
<disablelargereceiveoffloading/> <ipv6allow/>
<ipv6allow/> <powerd_ac_mode>hadp</powerd_ac_mode>
<powerd_ac_mode>hadp</powerd_ac_mode> <powerd_battery_mode>hadp</powerd_battery_mode>
<powerd_battery_mode>hadp</powerd_battery_mode> <powerd_normal_mode>hadp</powerd_normal_mode>
<powerd_normal_mode>hadp</powerd_normal_mode> <bogons>
<bogons> <interval>monthly</interval>
<interval>monthly</interval> </bogons>
</bogons> <kill_states/>
<kill_states/> </system>
<ssh> <interfaces>
<sshdkeyonly/> <wan>
</ssh> <enable/>
</system> <if>mismatch1</if>
<interfaces> <mtu></mtu>
<wan> <ipaddr>dhcp</ipaddr>
<enable/> <ipaddrv6>dhcp6</ipaddrv6>
<if>mismatch1</if> <subnet></subnet>
<mtu></mtu> <gateway></gateway>
<ipaddr>dhcp</ipaddr> <blockpriv/>
<ipaddrv6>dhcp6</ipaddrv6> <blockbogons/>
<!-- *or* ipv4-address *or* 'pppoe' *or* 'pptp' *or* 'bigpond' --> <dhcphostname></dhcphostname>
<subnet></subnet> <media></media>
<gateway></gateway> <mediaopt></mediaopt>
<blockpriv/> <dhcp6-duid></dhcp6-duid>
<blockbogons/> <dhcp6-ia-pd-len>0</dhcp6-ia-pd-len>
<dhcphostname></dhcphostname> </wan>
<media></media> <lan>
<mediaopt></mediaopt> <enable/>
<dhcp6-duid></dhcp6-duid> <if>mismatch0</if>
<dhcp6-ia-pd-len>0</dhcp6-ia-pd-len> <ipaddr>192.168.1.1</ipaddr>
<!-- <subnet>24</subnet>
<wireless> <ipaddrv6>track6</ipaddrv6>
*see below (opt[n])* <subnetv6>64</subnetv6>
</wireless> <media></media>
--> <mediaopt></mediaopt>
</wan> <track6-interface>wan</track6-interface>
<lan> <track6-prefix-id>0</track6-prefix-id>
<enable/> </lan>
<if>mismatch0</if> </interfaces>
<ipaddr>192.168.1.1</ipaddr> <staticroutes>
<subnet>24</subnet> <!--
<ipaddrv6>track6</ipaddrv6> <route>
<subnetv6>64</subnetv6> <interface>lan|opt[n]|pptp</interface>
<media></media> <network>xxx.xxx.xxx.xxx/xx</network>
<mediaopt></mediaopt> <gateway>xxx.xxx.xxx.xxx</gateway>
<track6-interface>wan</track6-interface> <descr></descr>
<track6-prefix-id>0</track6-prefix-id> </route>
<!-- -->
<wireless> </staticroutes>
*see below (opt[n])* <dhcpd>
</wireless> <lan>
--> <enable/>
</lan> <range>
<!-- <from>192.168.1.100</from>
<opt[n]> <to>192.168.1.199</to>
<enable/> </range>
<descr></descr> <!--
<if></if> <winsserver>xxx.xxx.xxx.xxx</winsserver>
<ipaddr></ipaddr> <defaultleasetime></defaultleasetime>
<subnet></subnet> <maxleasetime></maxleasetime>
<media></media> <gateway>xxx.xxx.xxx.xxx</gateway>
<mediaopt></mediaopt> <domain></domain>
<bridge>lan|wan|opt[n]</bridge> <dnsserver></dnsserver>
<wireless> <ntpserver>xxx.xxx.xxx.xxx</ntpserver>
<mode>hostap *or* bss *or* ibss</mode> <next-server></next-server>
<ssid></ssid> <filename></filename>
<channel></channel> <filename32></filename32>
<wep> <filename64></filename64>
<enable/> -->
<key> </lan>
<txkey/> <!--
<value></value> <opt[n]>
</key> ...
</wep> </opt[n]>
</wireless> -->
</opt[n]> <!--
--> <staticmap>
</interfaces> <mac>xx:xx:xx:xx:xx:xx</mac>
<!-- <ipaddr>xxx.xxx.xxx.xxx</ipaddr>
<vlans> <descr></descr>
<vlan> </staticmap>
<tag></tag> -->
<if></if> </dhcpd>
<descr></descr> <pptpd>
</vlan> <mode><!-- off *or* server *or* redir --></mode>
</vlans> <redir/>
--> <localip/>
<staticroutes> <remoteip/>
<!-- <!-- <accounting/> -->
<route> <!--
<interface>lan|opt[n]|pptp</interface> <user>
<network>xxx.xxx.xxx.xxx/xx</network> <name></name>
<gateway>xxx.xxx.xxx.xxx</gateway> <password></password>
<descr></descr> </user>
</route> -->
--> </pptpd>
</staticroutes> <dnsmasq>
<dhcpd> <enable/>
<lan> <!--
<enable/> <hosts>
<range> <host></host>
<from>192.168.1.100</from> <domain></domain>
<to>192.168.1.199</to> <ip></ip>
</range> <descr></descr>
<!-- </hosts>
<winsserver>xxx.xxx.xxx.xxx</winsserver> -->
<defaultleasetime></defaultleasetime> </dnsmasq>
<maxleasetime></maxleasetime> <snmpd>
<gateway>xxx.xxx.xxx.xxx</gateway> <!-- <enable/> -->
<domain></domain> <syslocation/>
<dnsserver></dnsserver> <syscontact/>
<ntpserver>xxx.xxx.xxx.xxx</ntpserver> <rocommunity>public</rocommunity>
<next-server></next-server> </snmpd>
<filename></filename> <diag>
<filename32></filename32> <ipv6nat>
<filename64></filename64> <!-- <enable/> -->
--> <ipaddr/>
</lan> </ipv6nat>
<!-- </diag>
<opt[n]> <bridge>
... <!-- <filteringbridge/> -->
</opt[n]> </bridge>
--> <syslog>
<!-- <reverse/>
<staticmap> <!--
<mac>xx:xx:xx:xx:xx:xx</mac> <enable/>
<ipaddr>xxx.xxx.xxx.xxx</ipaddr> <remoteserver>xxx.xxx.xxx.xxx</remoteserver>
<descr></descr> <filter/>
</staticmap> <dhcp/>
--> <system/>
</dhcpd> <nologdefaultblock/>
<pptpd> -->
<mode><!-- off *or* server *or* redir --></mode> </syslog>
<redir/> <nat>
<localip/> <outbound>
<remoteip/> <mode>automatic</mode>
<!-- <accounting/> --> <!--
<!-- <rule>
<user> <interface></interface>
<name></name> <source>
<password></password> <network>xxx.xxx.xxx.xxx/xx</network>
</user> </source>
--> <destination>
</pptpd> <not/>
<dnsmasq> <any/>
<enable/> *or*
<!-- <network>xxx.xxx.xxx.xxx/xx</network>
<hosts> </destination>
<host></host> <target>xxx.xxx.xxx.xxx</target>
<domain></domain> <descr></descr>
<ip></ip> </rule>
<descr></descr> -->
</hosts> </outbound>
--> <!--
</dnsmasq> <rule>
<snmpd> <interface></interface>
<!-- <enable/> --> <external-address></external-address>
<syslocation/> <protocol></protocol>
<syscontact/> <external-port></external-port>
<rocommunity>public</rocommunity> <target></target>
</snmpd> <local-port></local-port>
<diag> <descr></descr>
<ipv6nat> </rule>
<!-- <enable/> --> -->
<ipaddr/> <!--
</ipv6nat> <onetoone>
</diag> <interface></interface>
<bridge> <external>xxx.xxx.xxx.xxx</external>
<!-- <filteringbridge/> --> <internal>xxx.xxx.xxx.xxx</internal>
</bridge> <subnet></subnet>
<syslog> <descr></descr>
<reverse/> </onetoone>
<!-- -->
<enable/> <!--
<remoteserver>xxx.xxx.xxx.xxx</remoteserver> <servernat>
<filter/> <ipaddr></ipaddr>
<dhcp/> <descr></descr>
<system/> </servernat>
<nologdefaultblock/> -->
--> </nat>
</syslog> <filter>
<!-- <!-- <tcpidletimeout></tcpidletimeout> -->
<captiveportal> <rule>
<enable/> <type>pass</type>
<interface>lan|opt[n]</interface> <ipprotocol>inet</ipprotocol>
<idletimeout>minutes</idletimeout> <descr><![CDATA[Default allow LAN to any rule]]></descr>
<timeout>minutes</timeout> <interface>lan</interface>
<page> <source>
<htmltext></htmltext> <network>lan</network>
<errtext></errtext> </source>
</page> <destination>
<httpslogin/> <any/>
<httpsname></httpsname> </destination>
<redirurl></redirurl> </rule>
<radiusip></radiusip> <rule>
<radiusport></radiusport> <type>pass</type>
<radiuskey></radiuskey> <ipprotocol>inet6</ipprotocol>
<nomacfilter/> <descr><![CDATA[Default allow LAN IPv6 to any rule]]></descr>
</captiveportal> <interface>lan</interface>
--> <source>
<nat> <network>lan</network>
<outbound> </source>
<mode>automatic</mode> <destination>
<!-- <any/>
<rule> </destination>
<interface></interface> </rule>
<source> <!-- rule syntax:
<network>xxx.xxx.xxx.xxx/xx</network> <rule>
</source> <disabled/>
<destination> <id>[0-9]*</id>
<not/> <type>pass|block|reject</type>
<any/> <ipprotocol>inet|inet6</ipprotocol>
*or* <descr>...</descr>
<network>xxx.xxx.xxx.xxx/xx</network> <interface>lan|opt[n]|wan|pptp</interface>
</destination> <protocol>tcp|udp|tcp/udp|...</protocol>
<target>xxx.xxx.xxx.xxx</target> <icmptype></icmptype>
<descr></descr> <source>
</rule> <not/>
-->
</outbound>
<!--
<rule>
<interface></interface>
<external-address></external-address>
<protocol></protocol>
<external-port></external-port>
<target></target>
<local-port></local-port>
<descr></descr>
</rule>
-->
<!--
<onetoone>
<interface></interface>
<external>xxx.xxx.xxx.xxx</external>
<internal>xxx.xxx.xxx.xxx</internal>
<subnet></subnet>
<descr></descr>
</onetoone>
-->
<!--
<servernat>
<ipaddr></ipaddr>
<descr></descr>
</servernat>
-->
</nat>
<filter>
<!-- <tcpidletimeout></tcpidletimeout> -->
<rule>
<type>pass</type>
<ipprotocol>inet</ipprotocol>
<descr><![CDATA[Default allow LAN to any rule]]></descr>
<interface>lan</interface>
<source>
<network>lan</network>
</source>
<destination>
<any/>
</destination>
</rule>
<rule>
<type>pass</type>
<ipprotocol>inet6</ipprotocol>
<descr><![CDATA[Default allow LAN IPv6 to any rule]]></descr>
<interface>lan</interface>
<source>
<network>lan</network>
</source>
<destination>
<any/>
</destination>
</rule>
<!-- rule syntax:
<rule>
<disabled/>
<id>[0-9]*</id>
<type>pass|block|reject</type>
<ipprotocol>inet|inet6</ipprotocol>
<descr>...</descr>
<interface>lan|opt[n]|wan|pptp</interface>
<protocol>tcp|udp|tcp/udp|...</protocol>
<icmptype></icmptype>
<source>
<not/>
<address>xxx.xxx.xxx.xxx(/xx) or alias</address> <address>xxx.xxx.xxx.xxx(/xx) or alias</address>
*or* *or*
<network>lan|opt[n]|pptp</network> <network>lan|opt[n]|pptp</network>
*or* *or*
<any/> <any/>
<port>a[-b]</port> <port>a[-b]</port>
</source> </source>
<destination> <destination>
*same as for source* *same as for source*
</destination> </destination>
<frags/> <frags/>
<log/> <log/>
</rule> </rule>
--> -->
</filter> </filter>
<proxyarp> <proxyarp>
<!-- <!--
<proxyarpnet> <proxyarpnet>
<network>xxx.xxx.xxx.xxx/xx</network> <network>xxx.xxx.xxx.xxx/xx</network>
*or* *or*
<range> <range>
<from>xxx.xxx.xxx.xxx</from> <from>xxx.xxx.xxx.xxx</from>
<to>xxx.xxx.xxx.xxx</to> <to>xxx.xxx.xxx.xxx</to>
</range> </range>
</proxyarpnet> </proxyarpnet>
--> -->
</proxyarp> </proxyarp>
<cron> <cron>
<item> <item>
<minute>1,31</minute> <minute>1,31</minute>
<hour>0-5</hour> <hour>0-5</hour>
<mday>*</mday> <mday>*</mday>
<month>*</month> <month>*</month>
<wday>*</wday> <wday>*</wday>
<who>root</who> <who>root</who>
<command>adjkerntz -a</command> <command>adjkerntz -a</command>
</item> </item>
<item> <item>
<minute>1</minute> <minute>1</minute>
<hour>3</hour> <hour>3</hour>
<mday>1</mday> <mday>1</mday>
<month>*</month> <month>*</month>
<wday>*</wday> <wday>*</wday>
<who>root</who> <who>root</who>
<command>/usr/local/etc/rc.update_bogons</command> <command>/usr/local/etc/rc.update_bogons</command>
</item> </item>
<item> <item>
<minute>*/60</minute> <minute>*/60</minute>
<hour>*</hour> <hour>*</hour>
<mday>*</mday> <mday>*</mday>
<month>*</month> <month>*</month>
<wday>*</wday> <wday>*</wday>
<who>root</who> <who>root</who>
<command>/usr/local/sbin/expiretable -v -t 3600 sshlockout</command> <command>/usr/local/sbin/expiretable -v -t 3600 sshlockout</command>
</item> </item>
<item> <item>
<minute>1</minute> <minute>1</minute>
<hour>1</hour> <hour>1</hour>
<mday>*</mday> <mday>*</mday>
<month>*</month> <month>*</month>
<wday>*</wday> <wday>*</wday>
<who>root</who> <who>root</who>
<command>/usr/local/etc/rc.dyndns.update</command> <command>/usr/local/etc/rc.dyndns.update</command>
</item> </item>
<item> <item>
<minute>*/60</minute> <minute>*/60</minute>
<hour>*</hour> <hour>*</hour>
<mday>*</mday> <mday>*</mday>
<month>*</month> <month>*</month>
<wday>*</wday> <wday>*</wday>
<who>root</who> <who>root</who>
<command>/usr/local/sbin/expiretable -v -t 3600 virusprot</command> <command>/usr/local/sbin/expiretable -v -t 3600 virusprot</command>
</item> </item>
<item> <item>
<minute>30</minute> <minute>30</minute>
<hour>12</hour> <hour>12</hour>
<mday>*</mday> <mday>*</mday>
<month>*</month> <month>*</month>
<wday>*</wday> <wday>*</wday>
<who>root</who> <who>root</who>
<command>/usr/local/etc/rc.update_urltables</command> <command>/usr/local/etc/rc.update_urltables</command>
</item> </item>
</cron> </cron>
<wol> <wol>
<!-- <!--
<wolentry> <wolentry>
<interface>lan|opt[n]</interface> <interface>lan|opt[n]</interface>
<mac>xx:xx:xx:xx:xx:xx</mac> <mac>xx:xx:xx:xx:xx:xx</mac>
<descr></descr> <descr></descr>
</wolentry> </wolentry>
--> -->
</wol> </wol>
<rrd> <rrd>
<enable/> <enable/>
</rrd> </rrd>
<load_balancer> <load_balancer>
<monitor_type> <monitor_type>
<name>ICMP</name> <name>ICMP</name>
<type>icmp</type> <type>icmp</type>
<descr><![CDATA[ICMP]]></descr> <descr><![CDATA[ICMP]]></descr>
<options/> <options/>
</monitor_type> </monitor_type>
<monitor_type> <monitor_type>
<name>TCP</name> <name>TCP</name>
<type>tcp</type> <type>tcp</type>
<descr><![CDATA[Generic TCP]]></descr> <descr><![CDATA[Generic TCP]]></descr>
<options/> <options/>
</monitor_type> </monitor_type>
<monitor_type> <monitor_type>
<name>HTTP</name> <name>HTTP</name>
<type>http</type> <type>http</type>
<descr><![CDATA[Generic HTTP]]></descr> <descr><![CDATA[Generic HTTP]]></descr>
<options> <options>
<path>/</path> <path>/</path>
<host/> <host/>
<code>200</code> <code>200</code>
</options> </options>
</monitor_type> </monitor_type>
<monitor_type> <monitor_type>
<name>HTTPS</name> <name>HTTPS</name>
<type>https</type> <type>https</type>
<descr><![CDATA[Generic HTTPS]]></descr> <descr><![CDATA[Generic HTTPS]]></descr>
<options> <options>
<path>/</path> <path>/</path>
<host/> <host/>
<code>200</code> <code>200</code>
</options> </options>
</monitor_type> </monitor_type>
<monitor_type> <monitor_type>
<name>SMTP</name> <name>SMTP</name>
<type>send</type> <type>send</type>
<descr><![CDATA[Generic SMTP]]></descr> <descr><![CDATA[Generic SMTP]]></descr>
<options> <options>
<send></send> <send></send>
<expect>220 *</expect> <expect>220 *</expect>
</options> </options>
</monitor_type> </monitor_type>
</load_balancer> </load_balancer>
<widgets> <widgets>
<sequence>system_information-container:col1:show,captive_portal_status-container:col1:close,carp_status-container:col1:close,cpu_graphs-container:col1:close,gateways-container:col1:close,gmirror_status-container:col1:close,installed_packages-container:col1:close,interface_statistics-container:col1:close,interface_list-container:col2:show,ipsec-container:col2:close,load_balancer_status-container:col2:close,log-container:col2:close,picture-container:col2:close,rss-container:col2:close,services_status-container:col2:close,traffic_graphs-container:col2:close</sequence> <sequence>system_information-container:col1:show,captive_portal_status-container:col1:close,carp_status-container:col1:close,cpu_graphs-container:col1:close,gateways-container:col1:close,gmirror_status-container:col1:close,installed_packages-container:col1:close,interface_statistics-container:col1:close,interface_list-container:col2:show,ipsec-container:col2:close,load_balancer_status-container:col2:close,log-container:col2:close,picture-container:col2:close,rss-container:col2:close,services_status-container:col2:close,traffic_graphs-container:col2:close</sequence>
</widgets> </widgets>
</opnsense> </opnsense>
src/etc/inc/config.lib.inc
View file @ f763c7cd
...@@ -37,7 +37,6 @@ require_once("legacy_bindings.inc"); ...@@ -37,7 +37,6 @@ require_once("legacy_bindings.inc");
require_once('upgrade_config.inc'); require_once('upgrade_config.inc');
require_once("certs.inc"); require_once("certs.inc");
/* make a global alias table (for faster lookups) */ /* make a global alias table (for faster lookups) */
function alias_make_table($config) function alias_make_table($config)
{ {
...@@ -98,11 +97,19 @@ function parse_config() ...@@ -98,11 +97,19 @@ function parse_config()
* null * null
******/ ******/
/* convert configuration, if necessary */ /* convert configuration, if necessary */
function convert_config() { function convert_config()
{
global $config, $g; global $config, $g;
$now = date("H:i:s");
log_error(sprintf(gettext("Start Configuration upgrade at %s, set execution timeout to 15 minutes"), $now)); if (!isset($config['revision'])) {
//ini_set("max_execution_time", "900"); /* force a revision tag for proper handling in config history */
write_config('Factory configuration', false);
}
if ($config['version'] == $g['latest_config']) {
/* already at latest version */
return;
}
/* special case upgrades */ /* special case upgrades */
/* fix every minute crontab bogons entry */ /* fix every minute crontab bogons entry */
...@@ -118,8 +125,6 @@ function convert_config() { ...@@ -118,8 +125,6 @@ function convert_config() {
} }
} }
} }
if ($config['version'] == $g['latest_config'])
return; /* already at latest version */
// Save off config version // Save off config version
$prev_version = $config['version']; $prev_version = $config['version'];
...@@ -134,11 +139,9 @@ function convert_config() { ...@@ -134,11 +139,9 @@ function convert_config() {
$config['version'] = sprintf('%.1f', $next / 10); $config['version'] = sprintf('%.1f', $next / 10);
} }
$now = date("H:i:s"); if ($prev_version != $config['version']) {
log_error(sprintf(gettext("Ended Configuration upgrade at %s"), $now));
if ($prev_version != $config['version'])
write_config(sprintf(gettext('Upgraded config version level from %1$s to %2$s'), $prev_version, $config['version'])); write_config(sprintf(gettext('Upgraded config version level from %1$s to %2$s'), $prev_version, $config['version']));
}
} }
...@@ -318,7 +321,10 @@ function set_device_perms() { ...@@ -318,7 +321,10 @@ function set_device_perms() {
} }
function make_config_revision_entry($desc = null, $override_user = null) { function make_config_revision_entry($desc = null, $override_user = null)
{
global $config;
if (empty($override_user)) { if (empty($override_user)) {
if (empty($_SESSION["Username"])) { if (empty($_SESSION["Username"])) {
$username = getenv("USER"); $username = getenv("USER");
...@@ -330,22 +336,26 @@ function make_config_revision_entry($desc = null, $override_user = null) { ...@@ -330,22 +336,26 @@ function make_config_revision_entry($desc = null, $override_user = null) {
if (!empty($_SERVER['REMOTE_ADDR'])) { if (!empty($_SERVER['REMOTE_ADDR'])) {
$username .= '@' . $_SERVER['REMOTE_ADDR']; $username .= '@' . $_SERVER['REMOTE_ADDR'];
} }
} } else {
else {
$username = $override_user; $username = $override_user;
} }
$revision = array(); $revision = array();
if (time() > mktime(0, 0, 0, 9, 1, 2004)) /* make sure the clock settings are plausible */
$revision['time'] = time();
/* Log the running script so it's not entirely unlogged what changed */
if ($desc == "Unknown")
$desc = sprintf(gettext("%s made unknown change"), $_SERVER['SCRIPT_NAME']);
if (!empty($desc))
$revision['description'] = "{$username}: " . $desc;
$revision['username'] = $username; $revision['username'] = $username;
$revision['time'] = time();
if ($revision['time'] == $config['revision']['time']) {
/* avoid conflicting timestamps (a second is long) */
$revision['time'] = intval($revision['time']) + 1;
}
if ($desc == null || $desc == 'Unknown') {
$revision['description'] = sprintf(gettext("%s made unknown change"), $_SERVER['SCRIPT_NAME']);
} else {
$revision['description'] = $desc;
}
return $revision; return $revision;
} }
......
src/etc/rc.bootup
View file @ f763c7cd
...@@ -162,6 +162,7 @@ if (is_install_media()) { ...@@ -162,6 +162,7 @@ if (is_install_media()) {
echo "Loading configuration..."; echo "Loading configuration...";
global $config; global $config;
$config = parse_config(); $config = parse_config();
convert_config();
echo "done.\n"; echo "done.\n";
/* /*
...@@ -177,11 +178,6 @@ if (is_interface_mismatch()) { ...@@ -177,11 +178,6 @@ if (is_interface_mismatch()) {
led_kitt(); led_kitt();
} }
/* convert config and clean backups */
echo "Updating configuration...";
convert_config();
echo "done.\n";
/* read in /etc/sysctl.conf and set values if needed */ /* read in /etc/sysctl.conf and set values if needed */
echo "Setting up extended sysctls..."; echo "Setting up extended sysctls...";
system_setup_sysctl(); system_setup_sysctl();
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment

Technounit-GROUP 2023