# RTX830 Rev.15.02.31 (Fri Jul  5 10:40:25 2024)
# MAC Address : ac:44:f2:62:53:ee, ac:44:f2:62:53:ef
# Memory 256Mbytes, 2LAN
# main:  RTX830 ver=00 serial=M5B066419 MAC-Address=ac:44:f2:62:53:ee MAC-Address=ac:44:f2:62:53:ef
# Reporting Date: Aug 13 10:22:24 2025
login password *
administrator password *
login user admin *
user attribute connection=serial,telnet gui-page=dashboard,lan-map,config login-timer=1800
user attribute admin connection=serial,telnet,remote,ssh,sftp,http gui-page=dashboard,lan-map,config login-timer=1800
console character ja.utf8
system packet-buffer small max-buffer=5000
system packet-buffer middle max-buffer=7500
ip routing process fast
ip route default gateway tunnel 1
ip route 10.20.30.0/24 gateway tunnel 10
ipv6 routing process fast
ipv6 prefix 1 ra-prefix@lan2::/64
ip lan1 address 192.168.1.254/24
ip lan1 proxyarp on
ipv6 lan1 address ra-prefix@lan2::9d6b:XXXX:0/64
ipv6 lan1 prefix change log on
ipv6 lan1 rtadv send 1 o_flag=on
ipv6 lan1 dhcp service server
switch control use lan1 on terminal=on
description lan2 Asahi-NET
lan linkup send-wait-time lan2 5
ip lan2 intrusion detection in on
ip lan2 intrusion detection in ip on reject=off
ip lan2 intrusion detection in ip-option on reject=off
ip lan2 intrusion detection in default off
ipv6 lan2 secure filter in 101000 101002 101003 101100 101101 101102 102001 102002
ipv6 lan2 secure filter out 101099 dynamic 101080 101081 101082 101083 101084 101085 101098 101099
ipv6 lan2 dhcp service client ir=on
ngn type lan2 ntt

# iOS 用の L2TP 設定
pp select anonymous
 pp bind tunnel16-tunnel17
 pp auth request chap-pap
 pp auth username vpn1 pass1234
 pp auth username vpn2 pass1234
 ppp ipcp ipaddress on
 ppp ipcp msext on
 ip pp remote address pool 192.168.1.21-192.168.1.30
 ip pp mtu 1258
 pp enable anonymous

# 4 over 6 IP接続
tunnel select 1
 tunnel encapsulation ipip
 tunnel endpoint remote address 2001:c28:1:300::1008
 ip tunnel mtu 1460
 ip tunnel secure filter in 1101 1503 １521 1522 1523 1997
 ip tunnel secure filter out 1002 1003 1004 1005 1006 1007 1008 9999 dynamic 3001 3002 3003 3004 3098 3099
 ip tunnel nat descriptor 20000
 ip tunnel intrusion detection in on
 ip tunnel intrusion detection in ip on reject=off
 ip tunnel intrusion detection in ip-option on reject=off
 ip tunnel intrusion detection in default off
 tunnel enable 1

# IKEv2 VPN
tunnel select 10
 tunnel template 11
 description tunnel "IKEv2 tunnel"
 tunnel encapsulation ipsec
 ipsec tunnel 10
  ipsec sa policy 10 10 esp
  ipsec ike version 10 2
  ipsec ike keepalive log 10 off
  ipsec ike keepalive use 10 on rfc4306 10 3

  # 固定IP を自端末側に設定
  ipsec ike local name 10 157.107.XXX.XXX ipv4-addr
  ipsec ike pre-shared-key 10 text ike-vpn-1234
  ipsec ike remote name 10 vpn fqdn
  ipsec ike mode-cfg address 10 1
 l2tp tunnel disconnect time off
 l2tp keepalive use on 10 3
 l2tp keepalive log off
 l2tp syslog off
 ip tunnel tcp mss limit auto
 tunnel enable 10

# iOS 用 L2TP 設定(暗号化)
tunnel select 16
 tunnel template 17
 tunnel encapsulation l2tp
 ipsec tunnel 16
  ipsec sa policy 16 16 esp aes256-cbc sha256-hmac
  ipsec ike keepalive use 16 off
  ipsec ike nat-traversal 16 on
  ipsec ike pre-shared-key 16 text vpn1234
  ipsec ike remote address 16 any
 l2tp tunnel disconnect time off
 l2tp keepalive use on 10 3
 l2tp syslog off
 ip tunnel tcp mss limit auto
 tunnel enable 16

ip filter 1001 reject 192.168.1.0/24 * * *
ip filter 1002 reject * 192.168.1.0/24 * * *
ip filter 1003 reject * * udp,tcp 135 *
ip filter 1004 reject * * udp,tcp * 135
ip filter 1005 reject * * udp,tcp netbios_ns-netbios_ssn *
ip filter 1006 reject * * udp,tcp * netbios_ns-netbios_ssn
ip filter 1007 reject * * udp,tcp 445 *
ip filter 1008 reject * * udp,tcp * 445
ip filter 1101 pass * * icmp * *
ip filter 1503 pass * 192.168.1.244 tcp * https
ip filter 1521 pass * 192.168.1.254 * * 500
ip filter 1522 pass * 192.168.1.254 esp
ip filter 1523 pass * 192.168.1.254 udp * 4500
ip filter 1600 pass 157.107.76.213 192.168.1.0/24 tcp 5001 *
ip filter 1997 reject * *
ip filter 1998 pass * * tcp * *
ip filter 1999 pass * * udp * *
ip filter 9999 pass * * * * *
ip filter 500000 restrict * * * * *
ip filter dynamic 3001 * * ftp
ip filter dynamic 3002 * * www
ip filter dynamic 3003 * * https
ip filter dynamic 3004 * * sip
ip filter dynamic 3098 * * tcp
ip filter dynamic 3099 * * udp
nat descriptor type 20000 masquerade hairpin=on

# 固定IP
nat descriptor address outer 20000 157.107.xxx.xxx

# IKEv2 も nat の内側にあることを伝える
nat descriptor address inner 20000 192.168.1.1-192.168.1.254 10.20.30.1-10.20.30.10

nat descriptor sip 20000 on
nat descriptor masquerade incoming 20000 reject 
nat descriptor masquerade static 20000 1005 192.168.1.244 tcp https
nat descriptor masquerade static 20000 2001 192.168.1.254 esp
nat descriptor masquerade static 20000 2002 192.168.1.254 udp 500
nat descriptor masquerade static 20000 2003 192.168.1.254 udp 4500
ipsec auto refresh on
ipsec ike remote name 11 vpn1 fqdn

# IKEv2 でつかう IP アドレス
ipsec ike mode-cfg address pool 1 10.20.30.1-10.20.30.10/32

ipsec transport 1 16 udp 1701
ipsec transport 2 17 udp 1701
ipv6 filter 101000 pass * * icmp6 * *
ipv6 filter 101002 pass * * udp * 546
ipv6 filter 101003 pass * * 4
ipv6 filter 101099 pass * * * * *
ipv6 filter 101100 pass * * tcp * www
ipv6 filter 101101 pass * * tcp * 5001
ipv6 filter 101102 pass * * tcp * 5006
ipv6 filter 102001 pass * * * 500
ipv6 filter 102002 pass * * esp
ipv6 filter 102003 pass * * udp * 4500
ipv6 filter dynamic 101080 * * ftp
ipv6 filter dynamic 101081 * * domain
ipv6 filter dynamic 101082 * * www
ipv6 filter dynamic 101083 * * smtp
ipv6 filter dynamic 101084 * * pop3
ipv6 filter dynamic 101085 * * submission
ipv6 filter dynamic 101098 * * tcp
ipv6 filter dynamic 101099 * * udp
syslog host 192.168.1.244
syslog notice on
telnetd host lan1
dhcp service server
dhcp server rfc2131 compliant except remain-silent
dhcp scope 1 192.168.1.100-192.168.1.249/24
dhcp scope option 1 dns=192.168.1.245,192.168.1.254,9.9.9.9


# lan1 と IKEv2 から dns にアクセスを許可する
dns host lan1 10.20.30.1-10.20.30.10
dns service fallback on
dns cache max entry 1024
dns server dhcp lan2 edns=on
dns private address spoof on
schedule at 1 startup * lua emfs:/v6plus_map_e.lua

schedule at 2 */* 05:43:21 * ntpdate ntp.nict.jp syslog
l2tp service on
external-memory boot permit off
statistics traffic on
statistics nat on
alias cc="clear log"
alias jj="show log|grep -i reje"
alias rr="show log reverse"
alias sa="show ipsec sa"
embedded file v6plus_map_e.lua <<EOF
UPD_SV = "https://v6update.asahi-net.or.jp/prefix"
USERNAME = "P74587912"
PASSWORD = "DKIQWFFC"
WAN_IF = "LAN1"

LOG_PTN = "Add%s+IPv6%s+prefix.+%(Lifetime%:%s+%d+%)%s+via%s+" .. WAN_IF .. "%s+by"
LOG_LEVEL = "info"
LOG_PFX = "[v6plus]"
FAIL_MSG = "Failed to notify IPv6 address to the update server. (remaining retry: %d time(s))"

function logger(msg)
rt.syslog(LOG_LEVEL, string.format("%s %s", LOG_PFX, msg))
end

local rtn, count, log, result
local req_t = {}
local res_t
req_t.url = string.format("%s?user=%s&pass=%s", UPD_SV, USERNAME, PASSWORD)
req_t.method = "GET"
while true do
rtn = rt.syslogwatch(LOG_PTN)
if rtn then
count = 3
while true do
res_t = rt.httprequest(req_t)
if res_t.rtn1 then
logger("Notified IPv6 address to the update server.")
if res_t.code == 200 then
result = "Succeeded"
else
result = "Failed"
end
log = string.format("%s to update IPv6 address. (code=%d, body=%s)", result, res_t.code, res_t.body)
logger(log)
break
end
count = count - 1
if count > 0 then
logger(string.format(FAIL_MSG, count))
rt.sleep(10)
else
logger("Failed to notify IPv6 address to the update server.")
break
end
end
end
end
EOF