pfSense

<?xml version="1.0"?>

<pfsense>

	<version>11.6</version>

	<lastchange/>

	<theme>pfsense_ng_fs</theme>

	<sysctl>

		<item>

			<descr><![CDATA[Disable the pf ftp proxy handler.]]></descr>

			<tunable>debug.pfftpproxy</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Increase UFS read-ahead speeds to match current state of hard drives and NCQ. More information here: http://ivoras.sharanet.org/blog/tree/2010-11-19.ufs-read-ahead.html]]></descr>

			<tunable>vfs.read_max</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Set the ephemeral port range to be lower.]]></descr>

			<tunable>net.inet.ip.portrange.first</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Drop packets to closed TCP ports without returning a RST]]></descr>

			<tunable>net.inet.tcp.blackhole</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Do not send ICMP port unreachable messages for closed UDP ports]]></descr>

			<tunable>net.inet.udp.blackhole</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Randomize the ID field in IP packets (default is 0: sequential IP IDs)]]></descr>

			<tunable>net.inet.ip.random_id</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Drop SYN-FIN packets (breaks RFC1379, but nobody uses it anyway)]]></descr>

			<tunable>net.inet.tcp.drop_synfin</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Enable sending IPv4 redirects]]></descr>

			<tunable>net.inet.ip.redirect</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Enable sending IPv6 redirects]]></descr>

			<tunable>net.inet6.ip6.redirect</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Generate SYN cookies for outbound SYN-ACK packets]]></descr>

			<tunable>net.inet.tcp.syncookies</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Maximum incoming/outgoing TCP datagram size (receive)]]></descr>

			<tunable>net.inet.tcp.recvspace</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Maximum incoming/outgoing TCP datagram size (send)]]></descr>

			<tunable>net.inet.tcp.sendspace</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[IP Fastforwarding]]></descr>

			<tunable>net.inet.ip.fastforwarding</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Do not delay ACK to try and piggyback it onto a data packet]]></descr>

			<tunable>net.inet.tcp.delayed_ack</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Maximum outgoing UDP datagram size]]></descr>

			<tunable>net.inet.udp.maxdgram</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Handling of non-IP packets which are not passed to pfil (see if_bridge(4))]]></descr>

			<tunable>net.link.bridge.pfil_onlyip</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Set to 0 to disable filtering on the incoming and outgoing member interfaces.]]></descr>

			<tunable>net.link.bridge.pfil_member</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Set to 1 to enable filtering on the bridge interface]]></descr>

			<tunable>net.link.bridge.pfil_bridge</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Allow unprivileged access to tap(4) device nodes]]></descr>

			<tunable>net.link.tap.user_open</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Randomize PID's (see src/sys/kern/kern_fork.c: sysctl_kern_randompid())]]></descr>

			<tunable>kern.randompid</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Maximum size of the IP input queue]]></descr>

			<tunable>net.inet.ip.intr_queue_maxlen</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Disable CTRL+ALT+Delete reboot from keyboard.]]></descr>

			<tunable>hw.syscons.kbd_reboot</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Enable TCP Inflight mode]]></descr>

			<tunable>net.inet.tcp.inflight.enable</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Enable TCP extended debugging]]></descr>

			<tunable>net.inet.tcp.log_debug</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Set ICMP Limits]]></descr>

			<tunable>net.inet.icmp.icmplim</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[TCP Offload Engine]]></descr>

			<tunable>net.inet.tcp.tso</tunable>

			<value>default</value>

		</item>

		<item>

			<descr><![CDATA[Maximum socket buffer size]]></descr>

			<tunable>kern.ipc.maxsockbuf</tunable>

			<value>default</value>

		</item>

	</sysctl>

	<system>

		<optimization>normal</optimization>

		<hostname>gateway2</hostname>

		<domain>siteA.com</domain>

		<group>

			<name>admins</name>

			<description><![CDATA[System Administrators]]></description>

			<scope>system</scope>

			<gid>1999</gid>

			<member>0</member>

			<priv>page-all</priv>

			<priv>user-copy-files</priv>

			<priv>user-shell-access</priv>

			<priv>user-ssh-tunnel</priv>

		</group>

		<group>

			<name>all</name>

			<description><![CDATA[All Users]]></description>

			<scope>system</scope>

			<gid>1998</gid>

		</group>

		<group>

			<name>Guests</name>

			<description><![CDATA[Wireless Guests]]></description>

			<member>2002</member>

			<gid>2001</gid>

			<priv>user-services-captiveportal-login</priv>

		</group>

		<group>

			<name>MobileVPNusers</name>

			<description><![CDATA[Mobile VPN users]]></description>

			<member>2000</member>

			<gid>2000</gid>

			<priv>user-ipsec-xauth-dialin</priv>

		</group>

		<user>

			<name>admin</name>

			<descr><![CDATA[System Administrator]]></descr>

			<scope>system</scope>

			<groupname>admins</groupname>

			<password>$1$W19XXHLB$h8Lrs8T6f2.uKz/Lj1MpI0</password>

			<uid>0</uid>

			<priv>user-shell-access</priv>

			<md5-hash>3a4b4c4dde494d2cec3e0ea68e437e17</md5-hash>

			<nt-hash>3338333834323034353935373932633863623430663264336164663532353636</nt-hash>

		</user>

		<user>

			<scope>user</scope>

			<password/>

			<md5-hash>a9ddef8076a0e96323ed2b1d0629a6d0</md5-hash>

			<nt-hash>3431393438343561626164393135393738666234666664363161663438323931</nt-hash>

			<name>dei</name>

			<descr><![CDATA[DEI]]></descr>

			<expires/>

			<authorizedkeys/>

			<ipsecpsk/>

			<uid>2000</uid>

			<cert>52f5f81960248</cert>

		</user>

		<user>

			<scope>user</scope>

			<password/>

			<md5-hash>a9ddef8076a1e96325cd2b1d0d29a6d0</md5-hash>

			<nt-hash>3431393438343565626164393135593938666214666664363161663438323931</nt-hash>

			<name>guest</name>

			<descr><![CDATA[Wireless Guest User]]></descr>

			<expires/>

			<authorizedkeys/>

			<ipsecpsk/>

			<uid>2002</uid>

			<priv>user-services-captiveportal-login</priv>

		</user>

		<nextuid>2004</nextuid>

		<nextgid>2003</nextgid>

		<timezone>America/Vancouver</timezone>

		<time-update-interval/>

		<timeservers>time.apple.com</timeservers>

		<webgui>

			<protocol>http</protocol>

			<ssl-certref>52d8ee4f992fc</ssl-certref>

			<port/>

			<max_procs>4</max_procs>

			<quietlogin/>

			<session_timeout>120</session_timeout>

			<authmode>Local Database</authmode>

			<backend/>

			<nodnsrebindcheck/>

			<loginautocomplete/>

		</webgui>

		<disablesegmentationoffloading/>

		<disablelargereceiveoffloading/>

		<dns1gwint>none</dns1gwint>

		<dns2gwint>none</dns2gwint>

		<dns3gwint>none</dns3gwint>

		<dns4gwint>none</dns4gwint>

		<enablesshd>enabled</enablesshd>

		<maximumstates>32000</maximumstates>

		<maximumtableentries>3500000</maximumtableentries>

		<reflectiontimeout>3600</reflectiontimeout>

		<maximumtables>300</maximumtables>

		<kill_states/>

		<aliasesresolveinterval/>

		<bogons>

			<interval>daily</interval>

		</bogons>

		<powerd_ac_mode>hadp</powerd_ac_mode>

		<powerd_battery_mode>hadp</powerd_battery_mode>

		<skip_rules_gw_down/>

		<use_mfs_tmp_size/>

		<use_mfs_var_size/>

		<enablenatreflectionhelper>yes</enablenatreflectionhelper>

		<language>en_US</language>

		<dns1gw>none</dns1gw>

		<dns2gw>none</dns2gw>

		<dns3gw>none</dns3gw>

		<dns4gw>none</dns4gw>

		<serialspeed>9600</serialspeed>

		<gitsync>

			<repositoryurl/>

			<branch/>

		</gitsync>

		<ipv6allow/>

		<primaryconsole>serial</primaryconsole>

		<dnslocalhost/>

		<firmware>

			<disablecheck/>

		</firmware>

		<prefer_ipv4/>

		<powerd_enable/>

		<powerd_normal_mode>hadp</powerd_normal_mode>

		<thermal_hardware>coretemp</thermal_hardware>

		<dnsserver>172.24.16.166</dnsserver>

	</system>

	<interfaces>

		<wan>

			<enable/>

			<if>igb1</if>

			<blockpriv/>

			<blockbogons/>

			<descr><![CDATA[WAN_DEI]]></descr>

			<spoofmac/>

			<ipaddr>dhcp</ipaddr>

			<dhcphostname/>

			<alias-address/>

			<alias-subnet>32</alias-subnet>

			<dhcprejectfrom/>

			<adv_dhcp_pt_timeout/>

			<adv_dhcp_pt_retry/>

			<adv_dhcp_pt_select_timeout/>

			<adv_dhcp_pt_reboot/>

			<adv_dhcp_pt_backoff_cutoff/>

			<adv_dhcp_pt_initial_interval/>

			<adv_dhcp_pt_values>SavedCfg</adv_dhcp_pt_values>

			<adv_dhcp_send_options/>

			<adv_dhcp_request_options/>

			<adv_dhcp_required_options/>

			<adv_dhcp_option_modifiers/>

			<adv_dhcp_config_advanced/>

			<adv_dhcp_config_file_override/>

			<adv_dhcp_config_file_override_path/>

		</wan>

		<lan>

			<enable/>

			<if>igb0_vlan16</if>

			<descr><![CDATA[LAN1]]></descr>

			<spoofmac/>

			<blockbogons/>

			<ipaddr>172.24.16.2</ipaddr>

			<subnet>24</subnet>

		</lan>

		<opt1>

			<descr><![CDATA[LAN2]]></descr>

			<if>igb0_vlan17</if>

			<spoofmac/>

			<blockbogons/>

			<enable/>

			<ipaddr>172.24.17.2</ipaddr>

			<subnet>24</subnet>

		</opt1>

		<opt2>

			<descr><![CDATA[LAN3]]></descr>

			<if>igb0_vlan18</if>

			<enable/>

			<blockbogons/>

			<spoofmac/>

			<ipaddr>172.24.18.2</ipaddr>

			<subnet>24</subnet>

		</opt2>

	</interfaces>

	<staticroutes/>

	<dhcpd>

		<lan>

			<range>

				<from>172.24.16.112</from>

				<to>172.24.16.116</to>

			</range>

			<defaultleasetime>18000</defaultleasetime>

			<maxleasetime>18060</maxleasetime>

			<netmask/>

			<failover_peerip/>

			<gateway/>

			<ddnsdomain/>

			<filename/>

			<staticmap/>

			<denyunknown/>

			<domain/>

			<domainsearchlist/>

			<tftp/>

			<ldap/>

			<rootpath/>

			<numberoptions/>

			<dhcpleaseinlocaltime>yes</dhcpleaseinlocaltime>

			<mac_allow/>

			<mac_deny/>

			<nextserver/>

			<dnsserver>172.24.16.1</dnsserver>

			<ddnsdomainprimary/>

			<ddnsdomainkeyname/>

			<ddnsdomainkey/>

			<filename32/>

			<filename64/>

		</lan>

		<opt1>

			<range>

				<from>172.24.17.110</from>

				<to>172.24.17.119</to>

			</range>

			<failover_peerip/>

			<dhcpleaseinlocaltime>yes</dhcpleaseinlocaltime>

			<defaultleasetime>18000</defaultleasetime>

			<maxleasetime>18060</maxleasetime>

			<netmask/>

			<gateway>172.24.17.1</gateway>

			<domain>siteA.com</domain>

			<domainsearchlist>siteA.com</domainsearchlist>

			<ddnsdomain/>

			<mac_allow/>

			<mac_deny/>

			<tftp/>

			<ldap/>

			<nextserver/>

			<filename/>

			<rootpath/>

			<numberoptions/>

			<dnsserver>172.24.17.1</dnsserver>

			<ddnsdomainprimary/>

			<ddnsdomainkeyname/>

			<ddnsdomainkey/>

			<ntpserver>172.24.17.1</ntpserver>

			<filename32/>

			<filename64/>

		</opt1>

	</dhcpd>

	<pptpd>

		<redir/>

		<localip>172.24.16.252</localip>

		<remoteip>172.24.16.48</remoteip>

		<radius>

			<server>

				<ip/>

				<port/>

				<acctport/>

				<secret/>

			</server>

			<secret/>

			<server2>

				<ip/>

				<port/>

				<acctport/>

				<secret2/>

			</server2>

			<nasip/>

			<acct_update/>

		</radius>

		<wins/>

		<req128/>

		<n_pptp_units>4</n_pptp_units>

		<dns1>172.24.16.1</dns1>

		<mode>off</mode>

	</pptpd>

	<dnsmasq>

		<custom_options>addn-hosts=/usr/local/etc/hosts

cache-size=96000</custom_options>

		<interface>lan,opt1,opt2,lo0</interface>

		<enable/>

		<domainoverrides>

			<domain>siteA.com</domain>

			<ip>172.24.16.166</ip>

			<descr><![CDATA[Internal siteA.com DNS]]></descr>

		</domainoverrides>

		<domainoverrides>

			<domain>siteB.com</domain>

			<ip>172.24.16.166</ip>

			<descr><![CDATA[Internal siteB.com DNS]]></descr>

		</domainoverrides>

		<domainoverrides>

			<domain>siteC.com</domain>

			<ip>172.24.16.166</ip>

			<descr><![CDATA[Internal siteC.com DNS]]></descr>

		</domainoverrides>

		<strictbind/>

		<hosts>

			<host>no-ads-dev</host>

			<domain>siteA.com</domain>

			<ip>172.24.16.99</ip>

			<descr><![CDATA[The v4 IP for the development Ad-blocking server]]></descr>

			<aliases/>

		</hosts>

		<hosts>

			<host>no-ads-server</host>

			<domain>siteA.com</domain>

			<ip>172.24.18.99</ip>

			<descr><![CDATA[The v4 IP for the production Ad-blocking server]]></descr>

			<aliases/>

		</hosts>

		<hosts>

			<host>no-ads-server-v6</host>

			<domain>siteA.com</domain>

			<ip>fe80:4::ca2a:14ff:fe51:c80</ip>

			<descr><![CDATA[The v6 IP for the production Ad-blocking server]]></descr>

			<aliases/>

		</hosts>

	</dnsmasq>

	<snmpd>

		<syslocation/>

		<syscontact/>

		<rocommunity>DEI</rocommunity>

		<modules>

			<mibii/>

			<netgraph/>

			<pf/>

			<hostres/>

			<ucd/>

			<regex/>

		</modules>

		<enable/>

		<pollport>161</pollport>

		<trapserver/>

		<trapserverport/>

		<trapstring/>

		<bindip>lan</bindip>

	</snmpd>

	<diag>

		<ipv6nat/>

	</diag>

	<bridge/>

	<syslog>

		<nentries>750</nentries>

		<reverse/>

		<filterdescriptions>1</filterdescriptions>

		<sourceip/>

		<ipproto>ipv4</ipproto>

		<nologdefaultblock/>

		<nologbogons/>

		<nologprivatenets/>

	</syslog>

	<nat>

		<rule>

			<source>

				<address>NUTclientsOnLAN1</address>

			</source>

			<destination>

				<address>NUTserver</address>

				<port>NUTport</port>

			</destination>

			<protocol>tcp</protocol>

			<target>pfSenseInternal</target>

			<local-port>NUTport</local-port>

			<interface>lan</interface>

			<descr><![CDATA[Allow certain NUT clients on LAN1]]></descr>

			<associated-rule-id>nat_54ac784ef1d582.91727783</associated-rule-id>

			<created>

				<time>1420589134</time>

				<username>admin@172.24.16.235</username>

			</created>

			<updated>

				<time>1425641161</time>

				<username>admin@172.24.16.235</username>

			</updated>

		</rule>

		<rule>

			<source>

				<address>NUTclientsOnLAN2</address>

			</source>

			<destination>

				<address>NUTserver</address>

				<port>NUTport</port>

			</destination>

			<protocol>tcp</protocol>

			<target>pfSenseInternal</target>

			<local-port>NUTport</local-port>

			<interface>opt1</interface>

			<descr><![CDATA[Allow certain NUT clients on LAN2]]></descr>

			<associated-rule-id>nat_52c28163251599.67326802</associated-rule-id>

			<created>

				<time>1388478819</time>

				<username>admin@172.24.17.234</username>

			</created>

			<updated>

				<time>1423791584</time>

				<username>admin@172.24.16.235</username>

			</updated>

			<tracker>1424949565</tracker>

		</rule>

		<rule>

			<source>

				<address>DevServersAndClients</address>

			</source>

			<destination>

				<address>WAN1_DEI</address>

				<port>PublicServerPorts</port>

			</destination>

			<protocol>tcp</protocol>

			<target>DEIdevServer</target>

			<local-port>PublicServerPorts</local-port>

			<interface>wan</interface>

			<descr><![CDATA[Pass siteA.com test server traffic]]></descr>

			<associated-rule-id>nat_4f34ef8f23d3f2.59828398</associated-rule-id>

			<updated>

				<time>1425802933</time>

				<username>admin@172.24.16.235</username>

			</updated>

		</rule>

		<rule>

			<source>

				<address>DevServersAndClients</address>

			</source>

			<destination>

				<address>WAN3_TAK</address>

				<port>PublicServerPorts</port>

			</destination>

			<protocol>tcp</protocol>

			<target>TAKdevServer</target>

			<local-port>PublicServerPorts</local-port>

			<interface>wan</interface>

			<descr><![CDATA[Pass siteB.com test server traffic]]></descr>

			<associated-rule-id>nat_4f34efdc5ee0d7.11748463</associated-rule-id>

			<updated>

				<time>1420452557</time>

				<username>admin@172.24.16.235</username>

			</updated>

			<tracker>1424949567</tracker>

		</rule>

		<rule>

			<source>

				<address>DevServersAndClients</address>

			</source>

			<destination>

				<address>WAN2_SE</address>

				<port>PublicServerPorts</port>

			</destination>

			<protocol>tcp</protocol>

			<target>SEdevServer</target>

			<local-port>PublicServerPorts</local-port>

			<interface>wan</interface>

			<descr><![CDATA[Pass siteC.com test server traffic]]></descr>

			<associated-rule-id>nat_4f34efbc3d3a27.03111339</associated-rule-id>

			<updated>

				<time>1420452543</time>

				<username>admin@172.24.16.235</username>

			</updated>

			<tracker>1424949568</tracker>

		</rule>

		<rule>

			<source>

				<any/>

			</source>

			<destination>

				<address>WAN1_DEI</address>

				<port>PublicServerPorts</port>

			</destination>

			<protocol>tcp</protocol>

			<target>DEIvServer</target>

			<local-port>PublicServerPorts</local-port>

			<interface>wan</interface>

			<descr><![CDATA[Pass siteA.com public server traffic]]></descr>

			<associated-rule-id>nat_549565338d1bb8.05530663</associated-rule-id>

			<created>

				<time>1419076915</time>

				<username>admin@172.24.16.235</username>

			</created>

			<updated>

				<time>1420445048</time>

				<username>admin@172.24.16.235</username>

			</updated>

			<tracker>1424949569</tracker>

		</rule>

		<rule>

			<source>

				<any/>

			</source>

			<destination>

				<address>WAN3_TAK</address>

				<port>PublicServerPorts</port>

			</destination>

			<protocol>tcp</protocol>

			<target>TAKvServer</target>

			<local-port>PublicServerPorts</local-port>

			<interface>wan</interface>

			<descr><![CDATA[Pass siteB.com public server traffic]]></descr>

			<associated-rule-id>nat_5496bf6b6806d0.74246506</associated-rule-id>

			<created>

				<time>1419165547</time>

				<username>admin@172.24.16.235</username>

			</created>

			<updated>

				<time>1420445040</time>

				<username>admin@172.24.16.235</username>

			</updated>

			<tracker>1424949570</tracker>

		</rule>

		<rule>

			<source>

				<any/>

			</source>

			<destination>

				<address>WAN2_SE</address>

				<port>PublicServerPorts</port>

			</destination>

			<protocol>tcp</protocol>

			<target>SEvServer</target>

			<local-port>PublicServerPorts</local-port>

			<interface>wan</interface>

			<descr><![CDATA[Pass siteC.com public server traffic]]></descr>

			<associated-rule-id>nat_5496bf4d23c6b1.56363454</associated-rule-id>

			<created>

				<time>1419165517</time>

				<username>admin@172.24.16.235</username>

			</created>

			<updated>

				<time>1420445029</time>

				<username>admin@172.24.16.235</username>

			</updated>

			<tracker>1424949571</tracker>

		</rule>

		<rule>

			<disabled/>

			<source>

				<any/>

			</source>

			<destination>

				<address>WAN1_DEI</address>

				<port>21</port>

			</destination>

			<protocol>tcp</protocol>

			<target>DEIvServer</target>

			<local-port>21</local-port>

			<interface>wan</interface>

			<descr><![CDATA[Pass siteA.com FTP traffic]]></descr>

			<associated-rule-id>nat_4f34ec0b306bb1.09804029</associated-rule-id>

			<updated>

				<time>1420446747</time>

				<username>admin@172.24.16.235</username>

			</updated>

			<tracker>1424949572</tracker>

		</rule>

		<rule>

			<disabled/>

			<source>

				<any/>

			</source>

			<destination>

				<address>WAN1_DEI</address>

				<port>5400-5416</port>

			</destination>

			<protocol>tcp</protocol>

			<target>DEIvServer</target>

			<local-port>5400</local-port>

			<interface>wan</interface>

			<descr><![CDATA[Pass siteA.com FTP traffic]]></descr>

			<associated-rule-id>nat_4f34ec66a20d96.02288737</associated-rule-id>

			<updated>

				<time>1420446732</time>

				<username>admin@172.24.16.235</username>

			</updated>

			<tracker>1424949573</tracker>

		</rule>

		<rule>

			<disabled/>

			<source>

				<any/>

			</source>

			<destination>

				<address>WAN1_DEI</address>

				<port>2427</port>

			</destination>

			<protocol>tcp/udp</protocol>

			<target>VoIProuter</target>

			<local-port>2427</local-port>

			<interface>wan</interface>

			<descr><![CDATA[Pass VoIP (MGCP port for gateways)]]></descr>

			<associated-rule-id>nat_4f34f155ba0fc8.73668051</associated-rule-id>

			<tracker>1424949574</tracker>

		</rule>

		<rule>

			<disabled/>

			<source>

				<any/>

			</source>

			<destination>

				<address>WAN1_DEI</address>

				<port>2727</port>

			</destination>

			<protocol>tcp/udp</protocol>

			<target>VoIProuter</target>

			<local-port>2727</local-port>

			<interface>wan</interface>

			<descr><![CDATA[Pass VoIP (MGCP port for call agents)]]></descr>

			<associated-rule-id>nat_4f34f195ec63a4.01374927</associated-rule-id>

			<tracker>1424949575</tracker>

		</rule>

		<rule>

			<disabled/>

			<source>

				<any/>

			</source>

			<destination>

				<address>WAN1_DEI</address>

				<port>5062</port>

			</destination>

			<protocol>tcp/udp</protocol>

			<target>VoIProuter</target>

			<local-port>5062</local-port>

			<interface>wan</interface>

			<descr><![CDATA[Pass VoIP (control)]]></descr>

			<associated-rule-id>nat_4f34f1c6f2eeb5.63147915</associated-rule-id>

			<tracker>1424949576</tracker>

		</rule>

		<rule>

			<disabled/>

			<source>

				<any/>

			</source>

			<destination>

				<address>WAN1_DEI</address>

				<port>16384-32767</port>

			</destination>

			<protocol>udp</protocol>

			<target>VoIProuter</target>

			<local-port>16384</local-port>

			<interface>wan</interface>

			<descr><![CDATA[Pass VoIP (data)]]></descr>

			<associated-rule-id>nat_4f34f1f9a6f7c6.60710030</associated-rule-id>

			<tracker>1424949577</tracker>

		</rule>

		<rule>

			<disabled/>

			<source>

				<any/>

			</source>

			<destination>

				<address>WAN1_DEI</address>

				<port>5900-5909</port>

			</destination>

			<protocol>tcp</protocol>

			<target>BEDiMac</target>

			<local-port>5900</local-port>

			<interface>wan</interface>

			<descr><![CDATA[Pass traffic to VNC server]]></descr>

			<associated-rule-id>nat_4f34f259975314.00748715</associated-rule-id>

			<updated>

				<time>1420497774</time>

				<username>admin@172.24.16.235</username>

			</updated>

			<tracker>1424949578</tracker>

		</rule>

		<rule>

			<disabled/>

			<source>

				<any/>

			</source>

			<destination>

				<network>wanip</network>

				<port>BittorrentPort</port>

			</destination>

			<protocol>tcp/udp</protocol>

			<target>BEDiMacOnLAN1</target>

			<local-port>BittorrentPort</local-port>

			<interface>wan</interface>

			<descr><![CDATA[Pass Transmission's bittorrent P2P traffic]]></descr>

			<associated-rule-id/>

			<created>

				<time>1415047261</time>

				<username>admin@172.24.16.234</username>

			</created>

			<updated>

				<time>1415047713</time>

				<username>admin@172.24.16.234</username>

			</updated>

			<tracker>1424949579</tracker>

		</rule>

		<rule>

			<disabled/>

			<source>

				<any/>

			</source>

			<destination>

				<address>WAN4_Spare</address>

				<port>BittorrentPort</port>

			</destination>

			<protocol>tcp/udp</protocol>

			<target>BEDiMacOnLAN1</target>

			<local-port>BittorrentPort</local-port>

			<interface>wan</interface>

			<descr><![CDATA[Pass Transmission's bittorrent P2P traffic]]></descr>

			<associated-rule-id/>

			<created>

				<time>1387526105</time>

				<username>admin@172.24.16.234</username>

			</created>

			<updated>

				<time>1409472629</time>

				<username>admin@172.24.16.234</username>

			</updated>

			<tracker>1424949580</tracker>

		</rule>

		<rule>

			<disabled/>

			<source>

				<any/>

			</source>

			<destination>

				<address>WAN5_Test</address>

				<port>BittorrentPort</port>

			</destination>

			<protocol>tcp/udp</protocol>

			<target>BEDiMacOnLAN1</target>

			<local-port>BittorrentPort</local-port>

			<interface>wan</interface>

			<descr><![CDATA[Pass Transmission's bittorrent P2P traffic]]></descr>

			<associated-rule-id>nat_50cd94bf3dee27.37073586</associated-rule-id>

			<updated>

				<time>1396422587</time>

				<username>admin@172.24.16.234</username>

			</updated>

			<tracker>1424949581</tracker>

		</rule>

		<rule>

			<disabled/>

			<source>

				<any/>

			</source>

			<destination>

				<address>WAN4_Spare</address>

				<port>GnutellaPort</port>

			</destination>

			<protocol>tcp/udp</protocol>

			<target>BEDiMacOnLAN1</target>

			<local-port>GnutellaPort</local-port>

			<interface>wan</interface>

			<descr><![CDATA[Pass Gtk-Guntella's P2P traffic]]></descr>

			<associated-rule-id/>

			<created>

				<time>1387526089</time>

				<username>admin@172.24.16.234</username>

			</created>

			<updated>

				<time>1414863343</time>

				<username>admin@172.24.16.234</username>

			</updated>

			<tracker>1424949582</tracker>

		</rule>

		<rule>

			<disabled/>

			<source>

				<any/>

			</source>

			<destination>

				<address>WAN5_Test</address>

				<port>GnutellaPort</port>

			</destination>

			<protocol>tcp/udp</protocol>

			<target>BEDiMacOnLAN1</target>

			<local-port>GnutellaPort</local-port>

			<interface>wan</interface>

			<descr><![CDATA[Pass Gtk-Guntella's P2P traffic]]></descr>

			<associated-rule-id>nat_5289db443d9f36.25480489</associated-rule-id>

			<updated>

				<time>1393244755</time>

				<username>admin@172.24.16.234</username>

			</updated>

			<tracker>1424949583</tracker>

		</rule>

		<outbound>

			<rule>

				<source>

					<network>BEDiMacLAN1</network>

				</source>

				<sourceport/>

				<descr><![CDATA[WAN for BED's iMac's I'net traffic]]></descr>

				<target/>

				<targetip/>

				<targetip_subnet>0</targetip_subnet>

				<interface>wan</interface>

				<poolopts/>

				<destination>

					<any/>

				</destination>

				<created>

					<time>1385877143</time>

					<username>admin@172.24.16.234</username>

				</created>

				<updated>

					<time>1418160381</time>

					<username>admin@172.24.16.235</username>

				</updated>

			</rule>

			<rule>

				<source>

					<network>DEIsLAN1</network>

				</source>

				<sourceport/>

				<descr><![CDATA[LAN1 to WAN_DEI]]></descr>

				<target/>

				<targetip/>

				<targetip_subnet>0</targetip_subnet>

				<interface>wan</interface>

				<poolopts/>

				<destination>

					<any/>

				</destination>

				<created>

					<time>1389661167</time>

					<username>admin@172.24.16.234</username>

				</created>

				<updated>

					<time>1391676498</time>

					<username>admin@172.24.16.234</username>

				</updated>

			</rule>

			<rule>

				<source>

					<network>DEIsLAN2</network>

				</source>

				<sourceport/>

				<descr><![CDATA[LAN2 to WAN_DEI]]></descr>

				<target/>

				<targetip/>

				<targetip_subnet>0</targetip_subnet>

				<interface>wan</interface>

				<poolopts/>

				<destination>

					<any/>

				</destination>

				<created>

					<time>1388456948</time>

					<username>admin@172.24.17.234</username>

				</created>

				<updated>

					<time>1391676718</time>

					<username>admin@172.24.16.234</username>

				</updated>

			</rule>

			<rule>

				<source>

					<network>DEIsLAN3</network>

				</source>

				<sourceport/>

				<descr><![CDATA[LAN3 to WAN_DEI]]></descr>

				<target/>

				<targetip/>

				<targetip_subnet>0</targetip_subnet>

				<interface>wan</interface>

				<poolopts/>

				<destination>

					<any/>

				</destination>

				<updated>

					<time>1399184169</time>

					<username>admin@172.24.16.234</username>

				</updated>

				<created>

					<time>1399184169</time>

					<username>admin@172.24.16.234</username>

				</created>

			</rule>

			<rule>

				<source>

					<network>MobileVPNlans</network>

				</source>

				<sourceport/>

				<descr><![CDATA[Mobile virtual VPN LANs to WAN used for mobile VPNs]]></descr>

				<target>MobileVPNwan</target>

				<targetip/>

				<targetip_subnet>0</targetip_subnet>

				<interface>wan</interface>

				<poolopts/>

				<destination>

					<any/>

				</destination>

				<created>

					<time>1390079920</time>

					<username>admin@172.24.16.234</username>

				</created>

				<updated>

					<time>1425803103</time>

					<username>admin@172.24.16.235</username>

				</updated>

			</rule>

			<rule>

				<source>

					<network>127.0.0.0/8</network>

				</source>

				<sourceport/>

				<descr><![CDATA[Auto-created: localhost to WAN_DEI]]></descr>

				<target/>

				<targetip/>

				<targetip_subnet>0</targetip_subnet>

				<interface>wan</interface>

				<poolopts/>

				<destination>

					<any/>

				</destination>

				<natport>1024:65535</natport>

				<created>

					<time>1385876023</time>

					<username>Manual Outbound NAT Switch</username>

				</created>

				<updated>

					<time>1391675182</time>

					<username>admin@172.24.16.234</username>

				</updated>

			</rule>

			<mode>advanced</mode>

		</outbound>

	</nat>

	<filter>

		<rule>

			<id/>

			<type>match</type>

			<interface>wan,enc0,openvpn</interface>

			<ipprotocol>inet</ipprotocol>

			<tag/>

			<tagged/>

			<direction>any</direction>

			<floating>yes</floating>

			<max/>

			<max-src-nodes/>

			<max-src-conn/>

			<max-src-states/>

			<statetimeout/>

			<statetype>keep state</statetype>

			<os/>

			<protocol>udp</protocol>

			<source>

				<any/>

			</source>

			<destination>

				<any/>

			</destination>

			<disabled/>

			<descr><![CDATA[Reserved for WAN &amp; VPN VoiP UDP]]></descr>

			<created>

				<time>1392069648</time>

				<username>Traffic Shaper Wizard</username>

			</created>

			<updated>

				<time>1421574966</time>

				<username>admin@172.24.16.235</username>

			</updated>

			<tracker>1424949564</tracker>

		</rule>

		<rule>

			<id/>

			<type>match</type>

			<interface>lan</interface>

			<ipprotocol>inet</ipprotocol>

			<tag/>

			<tagged/>

			<direction>any</direction>

			<floating>yes</floating>

			<max/>

			<max-src-nodes/>

			<max-src-conn/>

			<max-src-states/>

			<statetimeout/>

			<statetype>keep state</statetype>

			<os/>

			<protocol>udp</protocol>

			<source>

				<any/>

			</source>

			<destination>

				<any/>

			</destination>

			<disabled/>

			<descr><![CDATA[Reserved for LAN1 VoiP UDP]]></descr>

			<updated>

				<time>1421568857</time>

				<username>admin@172.24.16.235</username>

			</updated>

			<created>

				<time>1421568857</time>

				<username>admin@172.24.16.235</username>

			</created>

			<tracker>1424949565</tracker>

		</rule>

		<rule>

			<id/>

			<type>match</type>

			<interface>opt1</interface>

			<ipprotocol>inet</ipprotocol>

			<tag/>

			<tagged/>

			<direction>any</direction>

			<floating>yes</floating>

			<max/>

			<max-src-nodes/>

			<max-src-conn/>

			<max-src-states/>

			<statetimeout/>

			<statetype>keep state</statetype>

			<os/>

			<protocol>udp</protocol>

			<source>

				<any/>

			</source>

			<destination>

				<any/>

			</destination>

			<disabled/>

			<descr><![CDATA[Reserved for LAN2 VoiP UDP]]></descr>

			<updated>

				<time>1421568886</time>

				<username>admin@172.24.16.235</username>

			</updated>

			<created>

				<time>1421568886</time>

				<username>admin@172.24.16.235</username>

			</created>

			<tracker>1424949566</tracker>

		</rule>

		<rule>

			<id/>

			<type>match</type>

			<interface>opt2</interface>

			<ipprotocol>inet</ipprotocol>

			<tag/>

			<tagged/>

			<direction>any</direction>

			<floating>yes</floating>

			<max/>

			<max-src-nodes/>

			<max-src-conn/>

			<max-src-states/>

			<statetimeout/>

			<statetype>keep state</statetype>

			<os/>

			<protocol>udp</protocol>

			<source>

				<any/>

			</source>

			<destination>

				<any/>

			</destination>

			<disabled/>

			<descr><![CDATA[Reserved for LAN3 VoiP UDP]]></descr>

			<created>

				<time>1421568895</time>

				<username>admin@172.24.16.235</username>

			</created>

			<updated>

				<time>1421654203</time>

				<username>admin@172.24.16.235</username>

			</updated>

			<tracker>1424949567</tracker>

		</rule>

		<rule>

			<id/>

			<type>match</type>