InfraRefresh/routing

Routing policy for traffic from Nurdspace network

modify Nurdspace-Client-IN {
       rule 1 {
           action modify
           description restore-mark
           modify {
               connmark {
                   restore-mark
               }
           }
       }
       rule 4 {
           action accept
           description "Keep local local"
           destination {
               group {
                   network-group RFC1918
               }
           }
       }
       rule 5 {
           action modify
           description "route irc over BIT"
           destination {
               port 6667,6697
           }
           modify {
               table 2
           }
           protocol tcp
       }
       rule 6 {
           action modify
           description "Spacenet radius"
           destination {
               address 194.171.96.99
           }
           modify {
               table 2
           }
       }
       rule 8 {
           action modify
           description "Http/Https over DSL"
           destination {
               port 80,443
           }
           modify {
               table 2
           }
           protocol tcp
       }
       rule 10 {
           action modify
           description "route traffic from BIT back over BIT"
           mark 2
           modify {
               table 2
           }
       }
       rule 11 {
           action modify
           description "Outbound email v4"
           destination {
               port 25
           }
           modify {
               table 2
           }
           protocol tcp
           source {
               address 10.208.10.5
           }
       }
       rule 98 {
           action modify
           description "route over dsl"
           disable
           modify {
               table 2
           }
       }
       rule 99 {
           action accept
           description "Accept all"
       }
   }

Bit incomming

rule 16 {
    destination {
        address 213.154.252.130
        port 1812
    }
    inbound-interface eth2
    inside-address {
        address 192.168.1.2
    }
    protocol udp
    type destination
}

UPC incomming

rule 1 {
    destination {
        address 77.251.168.181
        port 80
    }
    inbound-interface eth1
    inside-address {
        address 10.208.11.6
    }
    log disable
    protocol tcp
    type destination
}
rule 2 {
    destination {
        address 77.251.168.181
        port 443
    }
    inbound-interface eth1
    inside-address {
        address 10.208.11.6
    }
    log disable
    protocol tcp
    type destination
}

rule 6 {
    destination {
        address 77.251.168.181
        port 22
    }
    inbound-interface eth1
    inside-address {
        address 10.208.11.2
    }
    log disable
    protocol tcp
    type destination
}
rule 9 {
    destination {
        address 77.251.168.181
        port 122
    }
    inbound-interface eth1
    inside-address {
        address 10.208.11.250
        port 22
    }
    log disable
    protocol tcp
    type destination
}
rule 10 {
    destination {
        address 77.251.168.181
        port 60000-60050
    }
    inbound-interface eth1
    inside-address {
        address 10.208.11.250
    }
    log disable
    protocol udp
    type destination
}

Hairpin natting

rule 7 {
    destination {
        address 77.251.168.181
        port 22
    }
    inbound-interface eth0
    inside-address {
        address 10.208.11.2
    }
    log disable
    protocol tcp
    type destination
}
 rule 3 {
    destination {
        address 77.251.168.181
        port 80
    }
    inbound-interface eth0
    inside-address {
        address 10.208.11.6
    }
    log disable
    protocol tcp
    type destination
}
rule 4 {
    destination {
        address 77.251.168.181
        port 443
    }
    inbound-interface eth0
    inside-address {
        address 10.208.11.6
    }
    log disable
    protocol tcp
    type destination
}
rule 5 {
    destination {
        address 77.251.168.181
        port 22
    }
    inbound-interface eth0
    inside-address {
        address 10.208.11.2
    }
    log disable
    protocol tcp
    type destination
}