FW-01.txt

firewall {
    ipv4 {
        forward {
            filter {
                rule 10 {
                    action drop
                    description "Block VLAN40 to VLAN10"
                    destination {
                        address 192.168.10.0/24
                    }
                    inbound-interface {
                        name eth0.40
                    }
                }
                rule 20 {
                    action drop
                    description "Block VLAN40 to VLAN20"
                    destination {
                        address 192.168.20.0/24
                    }
                    inbound-interface {
                        name eth0.40
                    }
                }
                rule 30 {
                    action drop
                    description "Block VLAN40 to VLAN30"
                    destination {
                        address 192.168.30.0/24
                    }
                    inbound-interface {
                        name eth0.40
                    }
                }
                rule 40 {
                    action drop
                    description "Block VLAN10 to VLAN30"
                    destination {
                        address 192.168.30.0/24
                    }
                    inbound-interface {
                        name eth0.10
                    }
                }
                rule 50 {
                    action drop
                    description "Block VLAN10 to NAS"
                    destination {
                        address 192.168.20.11
                    }
                    inbound-interface {
                        name eth0.10
                    }
                }
                rule 60 {
                    action drop
                    description "Block VLAN30 to NAS"
                    destination {
                        address 192.168.20.11
                    }
                    inbound-interface {
                        name eth0.30
                    }
                }
                rule 70 {
                    action drop
                    description "Block VLAN40 to NAS"
                    destination {
                        address 192.168.20.11
                    }
                    inbound-interface {
                        name eth0.40
                    }
                }
                rule 1000 {
                    action accept
                    description "Default allow all other traffic"
                }
            }
        }
    }
}
interfaces {
    ethernet eth0 {
        description TRUNK
        hw-id 0c:e7:8c:0e:00:00
        vif 1 {
            address 192.168.1.1/24
            description MGMT
        }
        vif 10 {
            address 192.168.10.1/24
            description PRODUCTION
        }
        vif 20 {
            address 192.168.20.1/24
            description POST-PRODUCTION
        }
        vif 30 {
            address 192.168.30.1/24
            description BUSINESS-ADMIN
        }
        vif 40 {
            address 192.168.40.1/24
            description GUEST-CONTRACTOR
        }
    }
    ethernet eth1 {
        address dhcp
        description WAN
        hw-id 0c:e7:8c:0e:00:01
    }
    loopback lo {
    }
    vti vti0 {
        address 169.254.235.54/30
        description "AWS VPN Tunnel 1"
        mtu 1436
    }
}
nat {
    source {
        rule 10 {
            outbound-interface {
                name eth1
            }
            source {
                address 192.168.0.0/16
            }
            translation {
                address masquerade
            }
        }
    }
}
protocols {
    static {
        route 0.0.0.0/0 {
            next-hop 192.168.122.1 {
            }
        }
        route 10.0.0.0/16 {
            next-hop 169.254.235.53 {
            }
        }
    }
}
service {
    dhcp-server {
        shared-network-name VLAN10-PRODUCTION {
            subnet 192.168.10.0/24 {
                option {
                    default-router 192.168.10.1
                    domain-name openframestudios.local
                    name-server 192.168.1.10
                }
                range 0 {
                    start 192.168.10.100
                    stop 192.168.10.200
                }
                subnet-id 10
            }
        }
        shared-network-name VLAN20-POSTPROD {
            subnet 192.168.20.0/24 {
                option {
                    default-router 192.168.20.1
                    domain-name openframestudios.local
                    name-server 192.168.1.10
                }
                range 0 {
                    start 192.168.20.100
                    stop 192.168.20.200
                }
                subnet-id 20
            }
        }
        shared-network-name VLAN30-ADMIN {
            subnet 192.168.30.0/24 {
                option {
                    default-router 192.168.30.1
                    domain-name openframestudios.local
                    name-server 192.168.1.10
                }
                range 0 {
                    start 192.168.30.100
                    stop 192.168.30.200
                }
                subnet-id 30
            }
        }
        shared-network-name VLAN40-GUEST {
            subnet 192.168.40.0/24 {
                option {
                    default-router 192.168.40.1
                    domain-name openframestudios.local
                    name-server 192.168.1.10
                }
                range 0 {
                    start 192.168.40.100
                    stop 192.168.40.200
                }
                subnet-id 40
            }
        }
    }
    ntp {
        allow-client {
            address 127.0.0.0/8
            address 169.254.0.0/16
            address 10.0.0.0/8
            address 172.16.0.0/12
            address 192.168.0.0/16
            address ::1/128
            address fe80::/10
            address fc00::/7
        }
        server time1.vyos.net {
        }
        server time2.vyos.net {
        }
        server time3.vyos.net {
        }
    }
}
system {
    config-management {
        commit-revisions 100
    }
    console {
        device ttyS0 {
            speed 115200
        }
    }
    host-name vyos
    login {
        user vyos {
            authentication {
                encrypted-password ****************
                plaintext-password ****************
            }
        }
    }
    option {
        reboot-on-upgrade-failure 5
    }
    syslog {
        local {
            facility all {
                level info
            }
            facility local7 {
                level debug
            }
        }
    }
}
vpn {
    ipsec {
        authentication {
            psk AWS-PSK {
                id 192.168.122.7
                secret HtsxyDyv7PXrvKJ7dnu6wtLZ8EFyIKo8
            }
        }
        esp-group AWS-ESP-GROUP {
            lifetime 3600
            mode tunnel
            pfs dh-group2
            proposal 1 {
                encryption aes128
                hash sha1
            }
        }
        ike-group AWS-IKE-GROUP {
            dead-peer-detection {
                action restart
                interval 10
                timeout 30
            }
            key-exchange ikev1
            lifetime 28800
            proposal 1 {
                dh-group 2
                encryption aes128
                hash sha1
            }
        }
        options {
            disable-route-autoinstall
            interface eth1
        }
        site-to-site {
            peer AWS-TUNNEL-1 {
                authentication {
                    mode pre-shared-secret
                }
                connection-type initiate
                ike-group AWS-IKE-GROUP
                local-address 192.168.122.7
                remote-address 34.215.151.237
                vti {
                    bind vti0
                    esp-group AWS-ESP-GROUP
                }
            }
        }
    }
}