Basic configuration commands to set up an ERL for Google Fiber

ERL GF Commands

set firewall all-ping enable
set firewall broadcast-ping disable
set firewall ipv6-name WANv6_IN default-action drop
set firewall ipv6-name WANv6_IN description 'WAN inbound traffic forwarded to LAN'
set firewall ipv6-name WANv6_IN rule 10 action accept
set firewall ipv6-name WANv6_IN rule 10 description 'Allow established/related'
set firewall ipv6-name WANv6_IN rule 10 state established enable
set firewall ipv6-name WANv6_IN rule 10 state related enable
set firewall ipv6-name WANv6_IN rule 20 action drop
set firewall ipv6-name WANv6_IN rule 20 description 'Drop invalid state'
set firewall ipv6-name WANv6_IN rule 20 state invalid enable
set firewall ipv6-name WANv6_IN rule 30 action accept
set firewall ipv6-name WANv6_IN rule 30 description 'Allow ICMPv6'
set firewall ipv6-name WANv6_IN rule 30 protocol icmpv6
set firewall ipv6-name WANv6_LOCAL default-action drop
set firewall ipv6-name WANv6_LOCAL description 'WAN inbound traffic to the router'
set firewall ipv6-name WANv6_LOCAL rule 10 action accept
set firewall ipv6-name WANv6_LOCAL rule 10 description 'Allow established/related'
set firewall ipv6-name WANv6_LOCAL rule 10 state established enable
set firewall ipv6-name WANv6_LOCAL rule 10 state related enable
set firewall ipv6-name WANv6_LOCAL rule 20 action drop
set firewall ipv6-name WANv6_LOCAL rule 20 description 'Drop invalid state'
set firewall ipv6-name WANv6_LOCAL rule 20 state invalid enable
set firewall ipv6-name WANv6_LOCAL rule 30 action accept
set firewall ipv6-name WANv6_LOCAL rule 30 description 'Allow ICMPv6'
set firewall ipv6-name WANv6_LOCAL rule 30 protocol icmpv6
set firewall ipv6-name WANv6_LOCAL rule 40 action accept
set firewall ipv6-name WANv6_LOCAL rule 40 description 'Allow DHCPv6'
set firewall ipv6-name WANv6_LOCAL rule 40 destination port 546
set firewall ipv6-name WANv6_LOCAL rule 40 protocol udp
set firewall ipv6-name WANv6_LOCAL rule 40 source port 547
set firewall ipv6-name WANv6_OUT default-action accept
set firewall ipv6-name WANv6_OUT description 'WAN outbound traffic'
set firewall ipv6-name WANv6_OUT rule 10 action accept
set firewall ipv6-name WANv6_OUT rule 10 description 'Allow established/related'
set firewall ipv6-name WANv6_OUT rule 10 state established enable
set firewall ipv6-name WANv6_OUT rule 10 state related enable
set firewall ipv6-name WANv6_OUT rule 20 action reject
set firewall ipv6-name WANv6_OUT rule 20 description 'Reject invalid state'
set firewall ipv6-name WANv6_OUT rule 20 state invalid enable
set firewall ipv6-receive-redirects disable
set firewall ipv6-src-route disable
set firewall ip-src-route disable
set firewall log-martians enable
set firewall name LAN_IN default-action accept
set firewall name LAN_IN description 'LAN to Internal'
set firewall name LAN_IN rule 10 action drop
set firewall name LAN_IN rule 10 description 'drop invalid state'
set firewall name LAN_IN rule 10 state invalid enable
set firewall name WAN_IN default-action drop
set firewall name WAN_IN description 'WAN to Internal'
set firewall name WAN_IN rule 10 action accept
set firewall name WAN_IN rule 10 description 'Allow established/related'
set firewall name WAN_IN rule 10 log disable
set firewall name WAN_IN rule 10 state established enable
set firewall name WAN_IN rule 10 state invalid disable
set firewall name WAN_IN rule 10 state new disable
set firewall name WAN_IN rule 10 state related enable
set firewall name WAN_IN rule 20 action accept
set firewall name WAN_IN rule 20 description 'Allow ICMP'
set firewall name WAN_IN rule 20 log disable
set firewall name WAN_IN rule 20 protocol icmp
set firewall name WAN_IN rule 20 state established enable
set firewall name WAN_IN rule 20 state related enable
set firewall name WAN_IN rule 100 action drop
set firewall name WAN_IN rule 100 description 'Drop invalid state'
set firewall name WAN_IN rule 100 log enable
set firewall name WAN_IN rule 100 state invalid enable
set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL description 'WAN to Router'
set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 description 'Allow established/related'
set firewall name WAN_LOCAL rule 10 log disable
set firewall name WAN_LOCAL rule 10 state established enable
set firewall name WAN_LOCAL rule 10 state related enable
set firewall name WAN_LOCAL rule 20 action accept
set firewall name WAN_LOCAL rule 20 description 'Port Forward - Router SSH'
set firewall name WAN_LOCAL rule 20 destination address 192.168.1.1
set firewall name WAN_LOCAL rule 20 destination port 22
set firewall name WAN_LOCAL rule 20 protocol tcp
set firewall name WAN_LOCAL rule 30 action accept
set firewall name WAN_LOCAL rule 30 description 'Port Forward - Router HTTPS'
set firewall name WAN_LOCAL rule 30 destination address 192.168.1.1
set firewall name WAN_LOCAL rule 30 destination port 443
set firewall name WAN_LOCAL rule 30 protocol tcp
set firewall name WAN_LOCAL rule 100 action drop
set firewall name WAN_LOCAL rule 100 description 'Drop invalid state'
set firewall name WAN_LOCAL rule 100 log enable
set firewall name WAN_LOCAL rule 100 protocol all
set firewall name WAN_LOCAL rule 100 state established disable
set firewall name WAN_LOCAL rule 100 state invalid enable
set firewall name WAN_LOCAL rule 100 state new disable
set firewall name WAN_LOCAL rule 100 state related disable
set firewall name WAN_OUT default-action accept
set firewall name WAN_OUT description 'Internal to WAN'
set firewall name WAN_OUT rule 10 action accept
set firewall name WAN_OUT rule 10 description 'Allow established/related'
set firewall name WAN_OUT rule 10 log disable
set firewall name WAN_OUT rule 10 state established enable
set firewall name WAN_OUT rule 10 state related enable
set firewall name WAN_OUT rule 20 action reject
set firewall name WAN_OUT rule 20 description 'Reject invalid state'
set firewall name WAN_OUT rule 20 state invalid enable
set firewall options mss-clamp interface-type all
set firewall options mss-clamp mss 1460
set firewall receive-redirects disable
set firewall send-redirects enable
set firewall source-validation disable
set firewall syn-cookies enable
set interfaces ethernet eth0 description 'Google Fiber Jack'
set interfaces ethernet eth0 duplex auto
set interfaces ethernet eth0 speed auto
set interfaces ethernet eth0 vif 2 address dhcp
set interfaces ethernet eth0 vif 2 description 'Google Fiber WAN'
set interfaces ethernet eth0 vif 2 dhcpv6-pd pd 0 interface eth1 host-address '::1'
set interfaces ethernet eth0 vif 2 dhcpv6-pd pd 0 interface eth1 prefix-id ':0'
set interfaces ethernet eth0 vif 2 dhcpv6-pd pd 0 interface eth1 service slaac
set interfaces ethernet eth0 vif 2 dhcpv6-pd pd 0 interface eth2 host-address '::1'
set interfaces ethernet eth0 vif 2 dhcpv6-pd pd 0 interface eth2 prefix-id ':1'
set interfaces ethernet eth0 vif 2 dhcpv6-pd pd 0 interface eth2 service slaac
set interfaces ethernet eth0 vif 2 dhcpv6-pd pd 0 interface eth2.102 host-address '::1'
set interfaces ethernet eth0 vif 2 dhcpv6-pd pd 0 interface eth2.102 prefix-id ':2'
set interfaces ethernet eth0 vif 2 dhcpv6-pd pd 0 interface eth2.102 service slaac
set interfaces ethernet eth0 vif 2 dhcpv6-pd pd 0 prefix-length /56
set interfaces ethernet eth0 vif 2 dhcpv6-pd rapid-commit enable
set interfaces ethernet eth0 vif 2 egress-qos '0:3 1:3 2:3 3:3 4:3 5:3 6:3 7:3'
set interfaces ethernet eth0 vif 2 firewall in ipv6-name WANv6_IN
set interfaces ethernet eth0 vif 2 firewall in name WAN_IN
set interfaces ethernet eth0 vif 2 firewall local ipv6-name WANv6_LOCAL
set interfaces ethernet eth0 vif 2 firewall local name WAN_LOCAL
set interfaces ethernet eth0 vif 2 firewall out ipv6-name WANv6_OUT
set interfaces ethernet eth0 vif 2 firewall out name WAN_OUT
set interfaces ethernet eth0 vif 2 mtu 1500
set interfaces ethernet eth1 address 192.168.99.1/24
set interfaces ethernet eth1 description 'Local Config Port'
set interfaces ethernet eth1 duplex auto
set interfaces ethernet eth1 firewall in name LAN_IN
set interfaces ethernet eth1 speed auto
set interfaces ethernet eth2 address 192.168.1.1/24
set interfaces ethernet eth2 description LAN
set interfaces ethernet eth2 duplex auto
set interfaces ethernet eth2 firewall in name LAN_IN
set interfaces ethernet eth2 speed auto
set interfaces ethernet eth2 vif 102 address 10.0.0.1/24
set interfaces ethernet eth2 vif 102 description 'Guest Network VLAN'
set interfaces ethernet eth2 vif 102 mtu 1500
set interfaces loopback lo
set port-forward auto-firewall enable
set port-forward hairpin-nat enable
set port-forward lan-interface eth2
set port-forward rule 10 description 'Router SSH'
set port-forward rule 10 forward-to address 192.168.1.1
set port-forward rule 10 forward-to port 22
set port-forward rule 10 original-port 2323
set port-forward rule 10 protocol tcp_udp
set port-forward rule 20 description 'Router HTTPS'
set port-forward rule 20 forward-to address 192.168.1.1
set port-forward rule 20 forward-to port 443
set port-forward rule 20 original-port 8080
set port-forward rule 20 protocol tcp_udp
set port-forward wan-interface eth0.2
set service dhcp-server disabled false
set service dhcp-server hostfile-update enable
set service dhcp-server shared-network-name Config authoritative disable
set service dhcp-server shared-network-name Config subnet 192.168.99.0/24 default-router 192.168.99.1
set service dhcp-server shared-network-name Config subnet 192.168.99.0/24 dns-server 8.8.8.8
set service dhcp-server shared-network-name Config subnet 192.168.99.0/24 dns-server 8.8.4.4
set service dhcp-server shared-network-name Config subnet 192.168.99.0/24 lease 86400
set service dhcp-server shared-network-name Config subnet 192.168.99.0/24 start 192.168.99.101 stop 192.168.99.254
set service dhcp-server shared-network-name Guest authoritative disable
set service dhcp-server shared-network-name Guest subnet 10.0.0.0/24 default-router 10.0.0.1
set service dhcp-server shared-network-name Guest subnet 10.0.0.0/24 dns-server 8.8.8.8
set service dhcp-server shared-network-name Guest subnet 10.0.0.0/24 dns-server 8.8.4.4
set service dhcp-server shared-network-name Guest subnet 10.0.0.0/24 domain-name guest.example.com
set service dhcp-server shared-network-name Guest subnet 10.0.0.0/24 lease 86400
set service dhcp-server shared-network-name Guest subnet 10.0.0.0/24 start 10.0.0.10 stop 10.0.0.199
set service dhcp-server shared-network-name LAN authoritative disable
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 default-router 192.168.1.1
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 dns-server 8.8.8.8
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 dns-server 8.8.4.4
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 domain-name local
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 lease 86400
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 start 192.168.1.101 stop 192.168.1.254
set service dhcp-server use-dnsmasq disable
set service dns forwarding cache-size 500
set service dns forwarding listen-on eth2
set service dns forwarding name-server '2001:4860:4860::8888'
set service dns forwarding name-server '2001:4860:4860::8844'
set service dns forwarding name-server 8.8.8.8
set service dns forwarding name-server 8.8.4.4
set service gui http-port 80
set service gui https-port 443
set service gui older-ciphers enable
set service nat rule 5000 description 'Masquerade for WAN'
set service nat rule 5000 log disable
set service nat rule 5000 outbound-interface eth0.2
set service nat rule 5000 protocol all
set service nat rule 5000 type masquerade
set service ssh port 22
set service ssh protocol-version v2
set service unms disable
set service upnp2 listen-on eth2
set service upnp2 nat-pmp disable
set service upnp2 secure-mode disable
set service upnp2 wan eth0.2
set system domain-name gateway.example.com
set system host-name ubnt-gateway
set system name-server '2001:4860:4860::8888'
set system name-server '2001:4860:4860::8844'
set system name-server 8.8.8.8
set system name-server 8.8.4.4
set system ntp server 0.ubnt.pool.ntp.org
set system ntp server 1.ubnt.pool.ntp.org
set system ntp server 2.ubnt.pool.ntp.org
set system offload hwnat disable
set system offload ipsec enable
set system offload ipv4 forwarding enable
set system offload ipv4 vlan enable
set system offload ipv6 forwarding enable
set system offload ipv6 vlan enable
set system package repository wheezy components 'main contrib non-free'
set system package repository wheezy distribution wheezy
set system package repository wheezy password ''
set system package repository wheezy url 'http://http.us.debian.org/debian'
set system package repository wheezy username ''
set system syslog global facility all level notice
set system syslog global facility protocols level debug
set system time-zone America/Denver
set system traffic-analysis dpi enable
set system traffic-analysis export enable
comment firewall 'Google Fiber ER-Lite Config'