pfSense

<?xml version="1.0"?>

<pfsense>

<version>9.7</version>

<lastchange/>

<theme>pfsense_ng</theme>

<sysctl>

<item>

<descr><![CDATA[Disable the pf ftp proxy handler.]]></descr>

<tunable>debug.pfftpproxy</tunable>

<value>default</value>

</item>

<item>

<descr><![CDATA[Increase UFS read-ahead speeds to match current state of hard drives and NCQ. More information here: http://ivoras.sharanet.org/blog/tree/2010-11-19.ufs-read-ahead.html]]></descr>

<tunable>vfs.read_max</tunable>

<value>default</value>

</item>

<item>

<descr><![CDATA[Set the ephemeral port range to be lower.]]></descr>

<tunable>net.inet.ip.portrange.first</tunable>

<value>default</value>

</item>

<item>

<descr><![CDATA[Drop packets to closed TCP ports without returning a RST]]></descr>

<tunable>net.inet.tcp.blackhole</tunable>

<value>default</value>

</item>

<item>

<descr><![CDATA[Do not send ICMP port unreachable messages for closed UDP ports]]></descr>

<tunable>net.inet.udp.blackhole</tunable>

<value>default</value>

</item>

<item>

<descr><![CDATA[Randomize the ID field in IP packets (default is 0: sequential IP IDs)]]></descr>

<tunable>net.inet.ip.random_id</tunable>

<value>default</value>

</item>

<item>

<descr><![CDATA[Drop SYN-FIN packets (breaks RFC1379, but nobody uses it anyway)]]></descr>

<tunable>net.inet.tcp.drop_synfin</tunable>

<value>default</value>

</item>

<item>

<descr><![CDATA[Enable sending IPv4 redirects]]></descr>

<tunable>net.inet.ip.redirect</tunable>

<value>default</value>

</item>

<item>

<descr><![CDATA[Enable sending IPv6 redirects]]></descr>

<tunable>net.inet6.ip6.redirect</tunable>

<value>default</value>

</item>

<item>

<descr><![CDATA[Generate SYN cookies for outbound SYN-ACK packets]]></descr>

<tunable>net.inet.tcp.syncookies</tunable>

<value>default</value>

</item>

<item>

<tunable>net.inet.tcp.recvspace</tunable>

<value>1048576</value>

<descr><![CDATA[Maximum incoming/outgoing TCP datagram size (receive)]]></descr>

</item>

<item>

<tunable>net.inet.tcp.sendspace</tunable>

<value>1048576</value>

<descr><![CDATA[Maximum incoming/outgoing TCP datagram size (send)]]></descr>

</item>

<item>

<tunable>net.inet.ip.fastforwarding</tunable>

<value>default</value>

<descr><![CDATA[IP Fastforwarding]]></descr>

</item>

<item>

<descr><![CDATA[Do not delay ACK to try and piggyback it onto a data packet]]></descr>

<tunable>net.inet.tcp.delayed_ack</tunable>

<value>default</value>

</item>

<item>

<descr><![CDATA[Maximum outgoing UDP datagram size]]></descr>

<tunable>net.inet.udp.maxdgram</tunable>

<value>default</value>

</item>

<item>

<descr><![CDATA[Handling of non-IP packets which are not passed to pfil (see if_bridge(4))]]></descr>

<tunable>net.link.bridge.pfil_onlyip</tunable>

<value>default</value>

</item>

<item>

<descr><![CDATA[Set to 0 to disable filtering on the incoming and outgoing member interfaces.]]></descr>

<tunable>net.link.bridge.pfil_member</tunable>

<value>default</value>

</item>

<item>

<descr><![CDATA[Set to 1 to enable filtering on the bridge interface]]></descr>

<tunable>net.link.bridge.pfil_bridge</tunable>

<value>default</value>

</item>

<item>

<descr><![CDATA[Allow unprivileged access to tap(4) device nodes]]></descr>

<tunable>net.link.tap.user_open</tunable>

<value>default</value>

</item>

<item>

<descr><![CDATA[Randomize PID's (see src/sys/kern/kern_fork.c: sysctl_kern_randompid())]]></descr>

<tunable>kern.randompid</tunable>

<value>default</value>

</item>

<item>

<descr><![CDATA[Maximum size of the IP input queue]]></descr>

<tunable>net.inet.ip.intr_queue_maxlen</tunable>

<value>default</value>

</item>

<item>

<descr><![CDATA[Disable CTRL+ALT+Delete reboot from keyboard.]]></descr>

<tunable>hw.syscons.kbd_reboot</tunable>

<value>default</value>

</item>

<item>

<tunable>net.inet.tcp.inflight.enable</tunable>

<value>0</value>

<descr><![CDATA[Enable TCP Inflight mode]]></descr>

</item>

<item>

<descr><![CDATA[Enable TCP extended debugging]]></descr>

<tunable>net.inet.tcp.log_debug</tunable>

<value>default</value>

</item>

<item>

<descr><![CDATA[Set ICMP Limits]]></descr>

<tunable>net.inet.icmp.icmplim</tunable>

<value>default</value>

</item>

<item>

<descr><![CDATA[TCP Offload Engine]]></descr>

<tunable>net.inet.tcp.tso</tunable>

<value>default</value>

</item>

<item>

<tunable>kern.ipc.maxsockbuf</tunable>

<value>16777216</value>

<descr><![CDATA[Maximum socket buffer size]]></descr>

</item>

<item>

<tunable>hw.intr_storm_threshold</tunable>

<value>0</value>

<descr/>

</item>

<item>

<tunable>kern.ipc.nmbjumbop</tunable>

<value>262144</value>

<descr/>

</item>

<item>

<tunable>net.inet.tcp.sendbuf_max</tunable>

<value>16777216</value>

<descr/>

</item>

<item>

<tunable>net.inet.tcp.recvbuf_max</tunable>

<value>16777216</value>

<descr/>

</item>

<item>

<tunable>net.inet.tcp.sendbuf_auto</tunable>

<value>1</value>

<descr/>

</item>

<item>

<tunable>net.inet.tcp.recvbuf_auto</tunable>

<value>1</value>

<descr/>

</item>

<item>

<tunable>net.inet.tcp.sendbuf_inc</tunable>

<value>16384</value>

<descr/>

</item>

<item>

<tunable>net.inet.tcp.recvbuf_inc</tunable>

<value>524288</value>

<descr/>

</item>

</sysctl>

<system>

<optimization>normal</optimization>

<hostname>************-FW3</hostname>

<domain>****************</domain>

<dnsserver>10.165.200.100</dnsserver>

<dnsserver>10.165.200.101</dnsserver>

<dnsallowoverride>on</dnsallowoverride>

<group>

<name>all</name>

<description><![CDATA[All Users]]></description>

<scope>system</scope>

<gid>1998</gid>

</group>

<group>

<name>admins</name>

<description><![CDATA[System Administrators]]></description>

<scope>system</scope>

<gid>1999</gid>

<member>0</member>

<priv>page-all</priv>

</group>

<user>

<name>admin</name>

<descr><![CDATA[System Administrator]]></descr>

<scope>system</scope>

<groupname>admins</groupname>

<password>$1$rjK8yu1K$S2viNI/Wn2qkAXy4DXbfU1</password>

<uid>0</uid>

<priv>user-shell-access</priv>

<md5-hash>9132f164344106689f370606a5beadcb</md5-hash>

<nt-hash>2fbac3ca08d276bd1ac8ed01f36059cf</nt-hash>

</user>

<nextuid>2001</nextuid>

<nextgid>2000</nextgid>

<timezone>Asia/Jerusalem</timezone>

<time-update-interval>300</time-update-interval>

<timeservers>10.61.240.190</timeservers>

<webgui>

<protocol>http</protocol>

<ssl-certref>4fb89e8447e7f</ssl-certref>

<port/>

<max_procs>2</max_procs>

<nohttpreferercheck/>

</webgui>

<gitsync>

<repositoryurl/>

<branch/>

</gitsync>

<enablesshd>enabled</enablesshd>

<scrubnodf>enabled</scrubnodf>

<maximumstates/>

<maximumtables/>

<maximumtableentries/>

<enablebinatreflection>yes</enablebinatreflection>

<enablenatreflectionhelper>yes</enablenatreflectionhelper>

<reflectiontimeout/>

<disablescrub>yes</disablescrub>

<sharednet/>

<proxyuser>admin</proxyuser>

<proxypass>*************</proxypass>

<lb_use_sticky/>

<schedule_states/>

<disablesegmentationoffloading/>

<powerd_ac_mode>hadp</powerd_ac_mode>

<powerd_battery_mode>hadp</powerd_battery_mode>

<thermal_hardware>coretemp</thermal_hardware>

<use_mfs_tmp_size/>

<use_mfs_var_size/>

<firmware>

<alturl>

<enable/>

<firmwareurl>http://snapshots.pfsense.org/FreeBSD_RELENG_8_3/amd64/pfSense_RELENG_2_1/.updaters</firmwareurl>

</alturl>

<allowinvalidsig/>

</firmware>

<disablelargereceiveoffloading/>

</system>

<interfaces>

<wan>

<enable/>

<if>lagg1</if>

<descr><![CDATA[WAN]]></descr>

<spoofmac/>

<ipaddr>10.165.128.213</ipaddr>

<subnet>24</subnet>

<gateway>WANGW</gateway>

</wan>

<lan>

<descr><![CDATA[MNG]]></descr>

<if>igb0</if>

<enable/>

<spoofmac/>

<ipaddr>192.168.100.3</ipaddr>

<subnet>24</subnet>

</lan>

<opt1>

<descr><![CDATA[165_240]]></descr>

<if>lagg0_vlan640</if>

<enable/>

<spoofmac/>

<ipaddr>10.165.240.212</ipaddr>

<subnet>24</subnet>

</opt1>

<opt2>

<descr><![CDATA[165_241]]></descr>

<if>lagg0_vlan641</if>

<enable/>

<spoofmac/>

<ipaddr>10.165.241.212</ipaddr>

<subnet>24</subnet>

</opt2>

<opt3>

<descr><![CDATA[165_242]]></descr>

<if>lagg0_vlan642</if>

<enable/>

<spoofmac/>

<ipaddr>10.165.242.212</ipaddr>

<subnet>24</subnet>

</opt3>

<opt4>

<descr><![CDATA[165_243]]></descr>

<if>lagg0_vlan643</if>

<enable/>

<spoofmac/>

<ipaddr>10.165.243.212</ipaddr>

<subnet>24</subnet>

</opt4>

<opt5>

<descr><![CDATA[165_244]]></descr>

<if>lagg0_vlan644</if>

<enable/>

<spoofmac/>

<ipaddr>10.165.244.212</ipaddr>

<subnet>24</subnet>

</opt5>

<opt6>

<descr><![CDATA[165_245]]></descr>

<if>lagg0_vlan645</if>

<enable/>

<spoofmac/>

<ipaddr>10.165.245.212</ipaddr>

<subnet>24</subnet>

</opt6>

<opt7>

<descr><![CDATA[165_246]]></descr>

<if>lagg0_vlan646</if>

<enable/>

<spoofmac/>

<ipaddr>10.165.246.212</ipaddr>

<subnet>24</subnet>

</opt7>

<opt8>

<descr><![CDATA[165_247]]></descr>

<if>lagg0_vlan647</if>

<enable/>

<spoofmac/>

<ipaddr>10.165.247.212</ipaddr>

<subnet>24</subnet>

</opt8>

<opt9>

<descr><![CDATA[LAB_INFRA]]></descr>

<if>lagg0_vlan600</if>

<enable/>

<ipaddr>10.165.200.213</ipaddr>

<subnet>24</subnet>

<spoofmac/>

</opt9>

<opt10>

<descr><![CDATA[165_140]]></descr>

<if>lagg0_vlan540</if>

<enable/>

<ipaddr>10.165.140.212</ipaddr>

<subnet>24</subnet>

<spoofmac/>

</opt10>

<opt11>

<descr><![CDATA[165_141]]></descr>

<if>lagg0_vlan541</if>

<enable/>

<ipaddr>10.165.141.212</ipaddr>

<subnet>24</subnet>

<spoofmac/>

</opt11>

<opt12>

<descr><![CDATA[165_130]]></descr>

<if>lagg0_vlan530</if>

<enable/>

<spoofmac/>

<ipaddr>10.165.130.212</ipaddr>

<subnet>24</subnet>

</opt12>

<opt13>

<descr><![CDATA[vlan60]]></descr>

<if>lagg0_vlan60</if>

<enable/>

<spoofmac/>

<ipaddr>10.161.60.254</ipaddr>

<subnet>24</subnet>

</opt13>

<opt14>

<descr><![CDATA[165_223]]></descr>

<if>lagg0_vlan623</if>

<enable/>

<ipaddr>10.165.223.212</ipaddr>

<subnet>24</subnet>

<spoofmac/>

</opt14>

<opt15>

<descr><![CDATA[165_142]]></descr>

<if>lagg0_vlan542</if>

<enable/>

<ipaddr>10.165.142.212</ipaddr>

<subnet>24</subnet>

<spoofmac/>

</opt15>

<opt16>

<descr><![CDATA[161_134]]></descr>

<if>lagg0_vlan134</if>

<enable/>

<spoofmac/>

<ipaddr>10.161.134.212</ipaddr>

<subnet>24</subnet>

</opt16>

<opt17>

<descr><![CDATA[161_135]]></descr>

<if>lagg0_vlan135</if>

<enable/>

<ipaddr>10.161.135.212</ipaddr>

<subnet>24</subnet>

<spoofmac/>

</opt17>

<opt18>

<descr><![CDATA[VLAN20]]></descr>

<if>lagg0_vlan20</if>

<enable/>

<spoofmac/>

<ipaddr>10.161.20.254</ipaddr>

<subnet>24</subnet>

</opt18>

<opt19>

<descr><![CDATA[165_143]]></descr>

<if>lagg0_vlan543</if>

<enable/>

<spoofmac/>

<ipaddr>10.165.143.212</ipaddr>

<subnet>24</subnet>

</opt19>

<opt20>

<descr><![CDATA[165_144]]></descr>

<if>lagg0_vlan544</if>

<enable/>

<ipaddr>10.165.144.212</ipaddr>

<subnet>24</subnet>

<spoofmac/>

</opt20>

<opt21>

<descr><![CDATA[165_145]]></descr>

<if>lagg0_vlan545</if>

<enable/>

<ipaddr>10.165.145.212</ipaddr>

<subnet>24</subnet>

<spoofmac/>

</opt21>

<opt22>

<descr><![CDATA[165_146]]></descr>

<if>lagg0_vlan546</if>

<enable/>

<spoofmac/>

<ipaddr>10.165.146.212</ipaddr>

<subnet>24</subnet>

</opt22>

</interfaces>

<staticroutes/>

<dhcpd>

<opt13>

<range>

<from>10.161.60.1</from>

<to>10.161.60.50</to>

</range>

<defaultleasetime/>

<maxleasetime/>

<netmask/>

<failover_peerip/>

<gateway>10.161.60.245</gateway>

<domain>************************</domain>

<domainsearchlist/>

<ddnsdomain/>

<tftp/>

<ldap/>

<next-server/>

<filename/>

<rootpath/>

<numberoptions/>

<dnsserver>10.61.240.131</dnsserver>

<dnsserver>10.61.240.121</dnsserver>

<enable/>

<ntpserver>10.61.240.190</ntpserver>

</opt13>

<lan>

<range>

<from>10.161.223.10</from>

<to>10.161.223.245</to>

</range>

</lan>

<opt18>

<range>

<from>10.161.20.1</from>

<to>10.161.20.199</to>

</range>

<defaultleasetime/>

<maxleasetime/>

<netmask/>

<failover_peerip/>

<dnsserver>10.61.240.121</dnsserver>

<dnsserver>10.61.240.131</dnsserver>

<gateway>10.161.20.210</gateway>

<domain>****************************</domain>

<domainsearchlist/>

<enable/>

<ddnsdomain/>

<ntpserver>10.61.240.121</ntpserver>

<ntpserver>10.61.240.131</ntpserver>

<tftp/>

<ldap/>

<next-server/>

<filename/>

<rootpath/>

<numberoptions/>

</opt18>

<wan>

<range>

<from>10.165.128.220</from>

<to>10.165.128.240</to>

</range>

<defaultleasetime/>

<maxleasetime/>

<netmask/>

<failover_peerip/>

<dnsserver>10.165.200.100</dnsserver>

<dnsserver>10.165.200.101</dnsserver>

<gateway>10.165.128.210</gateway>

<domain/>

<domainsearchlist/>

<enable/>

<ddnsdomain/>

<tftp/>

<ldap/>

<next-server/>

<filename/>

<rootpath/>

<numberoptions/>

</wan>

<opt19>

<range>

<from>10.165.143.100</from>

<to>10.165.143.110</to>

</range>

<defaultleasetime/>

<maxleasetime/>

<netmask/>

<failover_peerip/>

<dnsserver>10.165.200.100</dnsserver>

<dnsserver>10.165.200.101</dnsserver>

<gateway>10.165.143.210</gateway>

<domain/>

<domainsearchlist/>

<enable/>

<ddnsdomain/>

<tftp/>

<ldap/>

<next-server/>

<filename/>

<rootpath/>

<numberoptions/>

</opt19>

</dhcpd>

<pptpd>

<mode/>

<redir/>

<localip/>

<remoteip/>

</pptpd>

<dnsmasq>

<enable/>

<domainoverrides>

<domain>****************************</domain>

<ip>10.61.240.121</ip>

<descr/>

</domainoverrides>

</dnsmasq>

<snmpd>

<syslocation>Floor 0, Black Rack</syslocation>

<syscontact/>

<rocommunity>public</rocommunity>

<modules>

<mibii/>

<netgraph/>

<pf/>

<hostres/>

</modules>

<enable/>

<pollport>161</pollport>

<trapserver/>

<trapserverport/>

<trapstring/>

<bindip/>

</snmpd>

<diag>

<ipv6nat/>

</diag>

<bridge/>

<syslog>

<reverse/>

<nentries>2000</nentries>

<nologdefaultblock/>

<remoteserver>10.165.200.84</remoteserver>

<remoteserver2/>

<remoteserver3/>

<apinger/>

<system/>

<enable/>

<nologbogons/>

<nologprivatenets/>

</syslog>

<nat>

<ipsecpassthru>

<enable/>

</ipsecpassthru>

<advancedoutbound>

<rule>

<source>

<network>any</network>

</source>

<sourceport/>

<descr><![CDATA[Auto created rule for MNG to WAN]]></descr>

<target/>

<targetip/>

<targetip_subnet/>

<interface>wan</interface>

<poolopts/>

<nonat/>

<destination>

<address>10.0.0.0/8</address>

</destination>

</rule>

<rule>

<source>

<network>127.0.0.0/8</network>

</source>

<dstport/>

<descr><![CDATA[Auto created rule for localhost to WAN]]></descr>

<target/>

<interface>wan</interface>

<destination>

<any/>

</destination>

<natport>1024:65535</natport>

</rule>

<rule>

<source>

<network>Internet_Access_Net</network>

</source>

<sourceport/>

<descr/>

<target/>

<targetip/>

<targetip_subnet>0</targetip_subnet>

<interface>wan</interface>

<poolopts/>

<destination>

<any/>

</destination>

</rule>

<rule>

<source>

<network>Internet_Access_hosts</network>

</source>

<sourceport/>

<descr/>

<target/>

<targetip/>

<targetip_subnet>0</targetip_subnet>

<interface>wan</interface>

<poolopts/>

<destination>

<any/>

</destination>

</rule>

<rule>

<source>

<network>any</network>

</source>

<sourceport/>

<descr/>

<target/>

<targetip/>

<targetip_subnet>0</targetip_subnet>

<interface>wan</interface>

<poolopts/>

<destination>

<any/>

</destination>

<dstport>3218</dstport>

</rule>

<rule>

<source>

<network>any</network>

</source>

<sourceport/>

<descr/>

<target/>

<targetip/>

<targetip_subnet/>

<interface>wan</interface>

<poolopts/>

<nonat/>

<destination>

<any/>

</destination>

</rule>

<rule>

<source>

<network>any</network>

</source>

<sourceport/>

<descr/>

<target/>

<targetip/>

<targetip_subnet>0</targetip_subnet>

<interface>wan</interface>

<poolopts/>

<destination>

<address>10.165.128.0/24</address>

</destination>

</rule>

<enable/>

</advancedoutbound>

</nat>

<filter>

<rule>

<id/>

<type>pass</type>

<interface>ADomains,Desktops,Recorders,DataCenter,wan,lan,opt1,opt2,opt3,opt4,opt5,opt6,opt7,opt8,opt9,opt10,opt11,opt12,opt13,opt14</interface>

<tag/>

<tagged/>

<direction>any</direction>

<floating>yes</floating>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<source>

<any/>

</source>

<destination>

<address>224.0.0.18</address>

</destination>

<descr/>

</rule>

<rule>

<id/>

<type>pass</type>

<interface>wan</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<source>

<any/>

</source>

<destination>

<any/>

</destination>

<descr/>

</rule>

<rule>

<id/>

<type>pass</type>

<interface>lan</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<source>

<any/>

</source>

<destination>

<any/>

</destination>

<descr><![CDATA[Default allow LAN to any rule]]></descr>

</rule>

<rule>

<id/>

<type>block</type>

<interface>ADomains</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<protocol>tcp/udp</protocol>

<source>

<address>DC_DOMAINS</address>

</source>

<destination>

<address>DC_DOMAINS</address>

<port>DC_PORTS_Blocked</port>

</destination>

<log/>

<descr/>

</rule>

<rule>

<id/>

<type>pass</type>

<interface>ADomains</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<protocol>icmp</protocol>

<source>

<address>DC_DOMAINS</address>

</source>

<destination>

<address>DC_DOMAINS</address>

</destination>

<descr/>

</rule>

<rule>

<id/>

<type>pass</type>

<interface>ADomains</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<protocol>tcp</protocol>

<source>

<address>DC_DOMAINS</address>

</source>

<destination>

<address>DC_DOMAINS</address>

<port>DC_PORTS_TCP</port>

</destination>

<descr/>

</rule>

<rule>

<id/>

<type>pass</type>

<interface>ADomains</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<protocol>udp</protocol>

<source>

<address>DC_DOMAINS</address>

</source>

<destination>

<address>DC_DOMAINS</address>

<port>DC_PORTS_UDP</port>

</destination>

<descr/>

</rule>

<rule>

<id/>

<type>pass</type>

<interface>ADomains</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<protocol>udp</protocol>

<source>

<address>DC_DOMAINS</address>

<port>DC_PORTS_UDP</port>

</source>

<destination>

<address>DC_DOMAINS</address>

</destination>

<descr/>

</rule>

<rule>

<id/>

<type>pass</type>

<interface>ADomains</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<protocol>tcp/udp</protocol>

<source>

<address>DC_DOMAINS</address>

</source>

<destination>

<address>DC_DOMAINS</address>

<port>DC_PORTS_TCP_UDP</port>

</destination>

<descr/>

</rule>

<rule>

<id/>

<type>block</type>

<interface>ADomains</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<source>

<address>DC_DOMAINS</address>

</source>

<destination>

<address>DC_DOMAINS</address>

</destination>

<log/>

<descr/>

</rule>

<rule>

<id/>

<type>pass</type>

<interface>DataCenter</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<protocol>icmp</protocol>

<source>

<address>DataCenter_net</address>

</source>

<destination>

<address>DC_DOMAINS</address>

</destination>

<descr/>

</rule>

<rule>

<id/>

<type>block</type>

<interface>DataCenter</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<protocol>tcp/udp</protocol>

<source>

<address>DataCenter_net</address>

</source>

<destination>

<address>DC_DOMAINS</address>

<port>DC_PORTS_Blocked</port>

</destination>

<log/>

<descr/>

</rule>

<rule>

<id/>

<type>pass</type>

<interface>DataCenter</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<protocol>tcp</protocol>

<source>

<address>DataCenter_net</address>

</source>

<destination>

<address>DC_DOMAINS</address>

<port>DC_PORTS_TCP</port>

</destination>

<descr/>

</rule>

<rule>

<id/>

<type>pass</type>

<interface>DataCenter</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<protocol>udp</protocol>

<source>

<address>DataCenter_net</address>

</source>

<destination>

<address>DC_DOMAINS</address>

<port>DC_PORTS_UDP</port>

</destination>

<descr/>

</rule>

<rule>

<id/>

<type>pass</type>

<interface>DataCenter</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<protocol>tcp/udp</protocol>

<source>

<address>DataCenter_net</address>

</source>

<destination>

<address>DC_DOMAINS</address>

<port>DC_PORTS_TCP_UDP</port>

</destination>

<descr/>

</rule>

<rule>

<id/>

<type>block</type>

<interface>DataCenter</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<source>

<address>DataCenter_net</address>

</source>

<destination>

<address>DC_DOMAINS</address>

</destination>

<log/>

<descr/>

</rule>

<rule>

<id/>

<type>pass</type>

<interface>DataCenter</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<protocol>icmp</protocol>

<source>

<address>DataCenter_net</address>

</source>

<destination>

<address>Desktop_Net</address>

</destination>

<descr/>

</rule>

<rule>

<id/>

<type>pass</type>

<interface>DataCenter</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<protocol>udp</protocol>

<source>

<address>DataCenter_net</address>

</source>

<destination>

<address>Desktop_Net</address>

<port>DC_2_DESK_UDP</port>

</destination>

<descr/>

</rule>

<rule>

<id/>

<type>block</type>

<interface>DataCenter</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<source>

<address>DataCenter_net</address>

</source>

<destination>

<address>Desktop_Net</address>

</destination>

<log/>

<descr/>

</rule>

<rule>

<id/>

<type>pass</type>

<interface>DataCenter</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<protocol>icmp</protocol>

<source>

<address>DataCenter_net</address>

</source>

<destination>

<address>Recorder_Net</address>

</destination>

<descr/>

</rule>

<rule>

<id/>

<type>pass</type>

<interface>DataCenter</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<protocol>tcp</protocol>

<source>

<address>DataCenter_net</address>

</source>

<destination>

<address>Recorder_Net</address>

<port>DC_2_REC_TCP</port>

</destination>

<descr/>

</rule>

<rule>

<id/>

<type>block</type>

<interface>DataCenter</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<source>

<address>DataCenter_net</address>

</source>

<destination>

<address>Recorder_Net</address>

</destination>

<log/>

<descr/>

</rule>

<rule>

<id/>

<type>pass</type>

<interface>Desktops</interface>

<tag/>

<tagged/>

<max/>

<max-src-nodes/>

<max-src-conn/>

<max-src-states/>

<statetimeout/>

<statetype>keep state</statetype>

<os/>

<protocol>icmp</protocol>

<source>

<address>Desktop_Net</address>

</source>

<destination>

<any/>