firewall {
    all-ping enable
    broadcast-ping disable
    group {
        address-group High_Address_Range_Group_DHCP {
            address 192.168.2.230-192.168.2.254
            description "25 DHCP addresses on 2.230-2.254"
        }
        address-group LAN_Interfaces_for_NAT {
            address 192.168.1.0/24
            address 192.168.2.0/24
            address 192.168.3.0/24
            address 172.31.0.0/16
            description "all 4 LAN interfaces"
        }
        address-group Low_Address_Range_DHCP {
            address 192.168.2.1-192.168.2.9
            description "9 DHCP addresses on 2.1-2.9"
        }
    }
    ipv6-name LANv6 {
        default-action accept
    }
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    name WAN_IN {
        default-action drop
        description "WAN to internal"
        rule 10 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
    }
    name WAN_LOCAL {
        default-action drop
        description "WAN to router"
        rule 10 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
    }
    name WAN_OUT {
        default-action accept
        rule 1 {
            action accept
            description "Drop access to Note 8 Phone (Testing)"
            log disable
            protocol all
            source {
                mac-address 8c:45:00:04:03:54
            }
        }
        rule 3 {
            action drop
            description "Drop Access to Mollies Macbook Pro"
            log disable
            protocol all
            source {
                mac-address 00:23:12:55:00:99
            }
        }
        rule 4 {
            action accept
            description "Drop Access to Mollies iPad Mini"
            log disable
            protocol all
            source {
                mac-address 54:99:63:24:10:10
            }
        }
        rule 6 {
            action drop
            description "Drop Access to Mollies iPhone 12 2023"
            log disable
            protocol all
            source {
                mac-address f6:b5:d8:df:b7:20
            }
        }
        rule 7 {
            action drop
            description "Drop Access to Mollies Chromebook Intel"
            log disable
            protocol all
            source {
                mac-address 00:bb:60:d0:29:b5
            }
        }
        rule 8 {
            action drop
            description "Drop DHCP non-assigned 1-9"
            disable
            log disable
            protocol all
            source {
                group {
                    address-group Low_Address_Range_DHCP
                }
            }
        }
        rule 10 {
            action drop
            description "Drop DHCP non-assigned 230-254"
            disable
            log disable
            protocol all
            source {
                group {
                    address-group High_Address_Range_Group_DHCP
                }
            }
        }
    }
    options {
        mss-clamp {
            mss 1412
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
}
interfaces {
    ethernet eth0 {
        duplex auto
        speed auto
        vif 10 {
            description "Internet (PPPoE)"
            pppoe 0 {
                default-route auto
                firewall {
                    in {
                        name WAN_IN
                    }
                    local {
                        name WAN_LOCAL
                    }
                    out {
                        name WAN_OUT
                    }
                }
                mtu 1492
                name-server auto
                password <redacted>
                user-id user@spark.co.nz
            }
        }
    }
    ethernet eth1 {
        address 192.168.1.25/24
        address fd00:1234:5678:1::1/64
        description "eth1 - Home LAN"
        duplex auto
        ipv6 {
            dup-addr-detect-transmits 1
            router-advert {
                cur-hop-limit 64
                link-mtu 0
                managed-flag false
                max-interval 600
                other-config-flag false
                prefix fd00:1234:5678:1::/64 {
                    autonomous-flag true
                    on-link-flag true
                    valid-lifetime 2592000
                }
                reachable-time 0
                retrans-timer 0
                send-advert true
            }
        }
        speed auto
    }
    ethernet eth2 {
        description "eth2 - Home Wireless"
        duplex auto
        speed auto
    }
    ethernet eth3 {
        address 192.168.3.25/24
        address fd00:1234:5678:3::1/64
        description "eth3 - Home Automation"
        duplex auto
        ipv6 {
            dup-addr-detect-transmits 1
            router-advert {
                cur-hop-limit 64
                link-mtu 0
                managed-flag false
                max-interval 600
                other-config-flag false
                prefix fd00:1234:5678:3::/64 {
                    autonomous-flag true
                    on-link-flag true
                    valid-lifetime 2592000
                }
                reachable-time 0
                retrans-timer 0
                send-advert true
            }
        }
        speed auto
    }
    ethernet eth4 {
        address 172.31.4.25/16
        address fd00:1234:5678:4::1/64
        description "eth4 - (Home Automation)"
        duplex auto
        ipv6 {
            dup-addr-detect-transmits 1
            router-advert {
                cur-hop-limit 64
                link-mtu 0
                managed-flag false
                max-interval 600
                other-config-flag false
                prefix fd00:1234:5678:4::/64 {
                    autonomous-flag true
                    on-link-flag true
                    valid-lifetime 2592000
                }
                reachable-time 0
                retrans-timer 0
                send-advert true
            }
        }
        poe {
            output off
        }
        speed auto
    }
    loopback lo {
    }
    switch switch0 {
        address 192.168.2.25/24
        description Local
        mtu 1500
        switch-port {
            interface eth2 {
            }
            vlan-aware disable
        }
    }
}
port-forward {
    auto-firewall enable
    hairpin-nat enable
    lan-interface eth1
    lan-interface switch0
    lan-interface eth2
    lan-interface eth3
    lan-interface eth4
    rule 1 {
        description "plex - ostrich"
        forward-to {
            address 192.168.1.210
            port 32400
        }
        original-port 32406
        protocol tcp_udp
    }
    rule 2 {
        description "transmission - giraffe"
        forward-to {
            address 192.168.1.210
            port 51413
        }
        original-port 51413
        protocol tcp_udp
    }
    rule 3 {
        description ipsec-vpn
        forward-to {
            address 192.168.3.200
        }
        original-port 500
        protocol udp
    }
    rule 4 {
        description ipsec-vpn
        forward-to {
            address 192.168.3.200
        }
        original-port 4500
        protocol udp
    }
    rule 5 {
        description "x2go - ferret"
        forward-to {
            address 192.168.1.84
            port 22
        }
        original-port 26
        protocol tcp_udp
    }
    rule 6 {
        description "tor - ferret"
        forward-to {
            address 192.168.1.84
            port 1298
        }
        original-port 1298
        protocol tcp_udp
    }
    rule 7 {
        description "deluge - ferret"
        forward-to {
            address 192.168.1.84
            port 6882
        }
        original-port 6882
        protocol tcp_udp
    }
    rule 8 {
        description openvpn
        forward-to {
            address 192.168.3.200
        }
        original-port 1194
        protocol udp
    }
    rule 9 {
        description openvpn-2
        forward-to {
            address 192.168.3.200
        }
        original-port 9443
        protocol tcp_udp
    }
    rule 10 {
        description openvpn-www
        forward-to {
            address 192.168.3.200
            port 943
        }
        original-port 943
        protocol tcp
    }
    rule 11 {
        description "transmission - nas1"
        forward-to {
            address 192.168.1.237
            port 51500
        }
        original-port 51500
        protocol tcp_udp
    }
    rule 12 {
        description "traefik - panda"
        forward-to {
            address 192.168.3.200
            port 443
        }
        original-port 443
        protocol tcp
    }
    rule 13 {
        description "traefik - panda"
        forward-to {
            address 192.168.3.200
            port 80
        }
        original-port 80
        protocol tcp
    }
    rule 14 {
        description "transmission - goat"
        forward-to {
            address 192.168.2.44
            port 51418
        }
        original-port 51418
        protocol tcp_udp
    }
    rule 15 {
        description "transmission - donkey"
        forward-to {
            address 192.168.2.24
            port 41419
        }
        original-port 41419
        protocol tcp_udp
    }
    rule 16 {
        description wireguard
        forward-to {
            address 192.168.3.200
            port 51820
        }
        original-port 51820
        protocol udp
    }
    rule 17 {
        description rustdesk-5
        forward-to {
            address 192.168.3.200
            port 21115
        }
        original-port 21115
        protocol tcp_udp
    }
    rule 18 {
        description rustdesk-6
        forward-to {
            address 192.168.3.200
            port 21116
        }
        original-port 21116
        protocol tcp_udp
    }
    rule 19 {
        description rustdesk-7
        forward-to {
            address 192.168.3.200
            port 21117
        }
        original-port 21117
        protocol tcp_udp
    }
    rule 20 {
        description rustdesk-8
        forward-to {
            address 192.168.3.200
            port 21118
        }
        original-port 21118
        protocol tcp_udp
    }
    rule 21 {
        description rustdesk-9
        forward-to {
            address 192.168.3.200
            port 21119
        }
        original-port 21119
        protocol tcp_udp
    }
    wan-interface pppoe0
}
service {
    dhcp-server {
        disabled false
        hostfile-update enable
        shared-network-name Home_Automation_eth3 {
            authoritative disable
            subnet 192.168.3.0/24 {
                default-router 192.168.3.25
                dns-server 192.168.3.25
                lease 86400
                start 192.168.3.51 {
                    stop 192.168.3.99
                }
                static-mapping panda {
                    ip-address 192.168.3.200
                    mac-address c0:3f:d5:6d:90:80
                }
            }
        }
        shared-network-name LAN1 {
            authoritative enable
            subnet 192.168.1.0/24 {
                default-router 192.168.1.25
                dns-server 192.168.3.200
                dns-server 192.168.1.25
                lease 86400
                start 192.168.1.38 {
                    stop 192.168.1.99
                }
                static-mapping AVTech-Camera {
                    ip-address 192.168.1.131
                    mac-address 00:0e:53:26:8f:51
                }
                static-mapping Alarm_Mega {
                    ip-address 192.168.1.230
                    mac-address de:ad:be:ef:fe:ed
                }
                static-mapping CCTV-DVR1 {
                    ip-address 192.168.1.225
                    mac-address 00:12:41:08:cd:e8
                }
                static-mapping Cam1-Garage {
                    ip-address 192.168.1.112
                    mac-address 00:12:41:24:8d:8d
                }
                static-mapping Cam2-Frontdoor {
                    ip-address 192.168.1.113
                    mac-address 00:12:31:5e:75:53
                }
                static-mapping Cam3-GarageSide {
                    ip-address 192.168.1.115
                    mac-address 00:12:41:24:8d:99
                }
                static-mapping Cam4-Driveway {
                    ip-address 192.168.1.116
                    mac-address 00:12:31:42:15:90
                }
                static-mapping Cam5-Trailer {
                    ip-address 192.168.1.117
                    mac-address 00:12:41:24:8d:bb
                }
                static-mapping Cam6-Drive_Lower {
                    ip-address 192.168.1.119
                    mac-address 00:12:41:24:8D:8F
                }
                static-mapping Cam7-Drive_Upper {
                    ip-address 192.168.1.118
                    mac-address 00:12:16:bc:a0:48
                }
                static-mapping Cam8-Patio {
                    ip-address 192.168.1.114
                    mac-address 00:12:41:24:99:AB
                }
                static-mapping HDHomerun-12304BC9 {
                    ip-address 192.168.1.221
                    mac-address 00:18:dd:23:04:bc
                }
                static-mapping MainTV-Chromecast-Ultra {
                    ip-address 192.168.1.223
                    mac-address 44:09:b8:61:bf:ca
                }
                static-mapping Panasonic_Viera_COM-MID1 {
                    ip-address 192.168.1.224
                    mac-address 04:20:9a:4d:4a:6b
                }
                static-mapping Pi-Photobooth {
                    ip-address 192.168.1.205
                    mac-address b8:27:eb:3f:10:f5
                }
                static-mapping RaspiPlex2 {
                    ip-address 192.168.1.204
                    mac-address b8:27:eb:12:f4:fe
                }
                static-mapping Sony_TV_Lounge {
                    ip-address 192.168.1.226
                    mac-address 88:c9:e8:03:53:85
                }
                static-mapping Tuya_bulb_1--ESP_B9DA3A {
                    ip-address 192.168.1.51
                    mac-address 50:02:91:b9:da:3a
                }
                static-mapping Tuya_kogan_smartplug1 {
                    ip-address 192.168.1.52
                    mac-address d4:a6:51:2a:a8:f5
                }
                static-mapping ferret {
                    ip-address 192.168.1.222
                    mac-address b8:ca:3a:7e:3f:5f
                }
                static-mapping guineapig {
                    ip-address 192.168.1.220
                    mac-address 24:be:05:17:a4:d7
                }
                static-mapping homeassistant {
                    ip-address 192.168.1.42
                    mac-address 44:8a:5b:b6:41:58
                }
                static-mapping odroidxu4 {
                    ip-address 192.168.1.237
                    mac-address 00:1e:06:32:b7:81
                }
                static-mapping ostrich {
                    ip-address 192.168.1.210
                    mac-address 70:85:c2:72:b8:56
                }
                static-mapping viewrd-opizerologger {
                    ip-address 192.168.1.208
                    mac-address 3e:bd:5c:0e:1c:d8
                }
            }
        }
        shared-network-name LAN2 {
            authoritative enable
            subnet 192.168.2.0/24 {
                default-router 192.168.2.25
                dns-server 192.168.3.200
                dns-server 192.168.2.25
                lease 86400
                start 192.168.2.231 {
                    stop 192.168.2.249
                }
                static-mapping ChromeCast-FoxholeBedroom {
                    ip-address 192.168.2.216
                    mac-address 6c:ad:f8:85:83:1b
                }
                static-mapping ChromeCast-OfficeTV {
                    ip-address 192.168.2.213
                    mac-address f4:f5:e8:5e:ac:78
                }
                static-mapping ChromeClock-LenovoBedroom {
                    ip-address 192.168.2.214
                    mac-address 84:b8:b8:20:7f:fb
                }
                static-mapping ChromeTic-FoxholeSpeaker {
                    ip-address 192.168.2.207
                    mac-address 6c:5a:b5:54:f0:9c
                }
                static-mapping ChromeTic-LoungeSpeaker {
                    ip-address 192.168.2.210
                    mac-address 6c:5a:b5:54:e4:3c
                }
                static-mapping ChromeTic-Mollie {
                    ip-address 192.168.2.215
                    mac-address 6c:5a:b5:54:f7:05
                }
                static-mapping ChromeTic-Mollie2-White {
                    ip-address 192.168.2.211
                    mac-address 6c:5a:b5:55:43:3d
                }
                static-mapping Chromecast-Ultra {
                    ip-address 192.168.2.212
                    mac-address 00:f6:20:70:0b:d6
                }
                static-mapping ESP_3b1a59 {
                    ip-address 192.168.2.200
                    mac-address c8:c9:a3:3b:1a:59
                }
                static-mapping Foxhole-Bedroom-Androidbox {
                    ip-address 192.168.2.51
                    mac-address e0:76:d0:56:7c:aa
                }
                static-mapping Foxhole-TV-JVC {
                    ip-address 192.168.2.52
                    mac-address d4:3a:2e:9c:c3:aa
                }
                static-mapping Galaxy-A72 {
                    ip-address 192.168.2.32
                    mac-address 52:c6:ae:32:75:a4
                }
                static-mapping Howard-MiPhone {
                    ip-address 192.168.2.45
                    mac-address fa:80:35:67:60:1a
                }
                static-mapping Howard-iPad {
                    ip-address 192.168.2.41
                    mac-address a8:5b:78:b1:f1:d9
                }
                static-mapping Howards-iPad-Air2023 {
                    ip-address 192.168.2.43
                    mac-address b0:e5:ef:a2:f0:58
                }
                static-mapping Howard-Dell17inch-Chromebook {
                    ip-address 192.168.2.46
                    mac-address 2C:6E:85:C5:34:C9
                }
                static-mapping Kims-AppleWatch4 {
                    ip-address 192.168.2.37
                    mac-address 62:d0:8b:94:d5:21
                }
                static-mapping Kims-Applewatch3 {
                    ip-address 192.168.2.40
                    mac-address be:bb:ba:6e:c3:21
                }
                static-mapping Kims-BuzzybeiPhone15 {
                    ip-address 192.168.2.38
                    mac-address 78:a7:c7:98:3b:23
                }
                static-mapping Kims-iPad {
                    ip-address 192.168.2.36
                    mac-address fa:71:97:8a:ee:48
                }
                static-mapping Kims-iPad-2 {
                    ip-address 192.168.2.39
                    mac-address 88:cb:87:ba:cd:52
                }
                static-mapping Mollies-Air {
                    ip-address 192.168.2.33
                    mac-address 60:3e:5f:0c:f8:f8
                }
                static-mapping MolliesiPadMini {
                    ip-address 192.168.2.30
                    mac-address 54:99:63:24:10:10
                }
                static-mapping Mollies-iphone12-2023 {
                    ip-address 192.168.2.34
                    mac-address 9a:d8:d8:28:e8:2f
                }
                static-mapping Natalies-iPhone {
                    ip-address 192.168.2.47
                    mac-address 90:a2:5b:eb:64:9c
                }
                static-mapping Natalies_Macbook_2025 {
                    ip-address 192.168.2.27
                    mac-address 8e:41:e8:ae:94:98
                }
                static-mapping Natalies_iPhone_2025 {
                    ip-address 192.168.2.23
                    mac-address 76:c5:f8:36:ca:b0
                }
                static-mapping Nintendo-Wii {
                    ip-address 192.168.2.48
                    mac-address 58:bd:a3:83:61:3b
                }
                static-mapping Oven-GEMODULE5413 {
                    ip-address 192.168.2.49
                    mac-address d8:28:c9:c8:6e:4c
                }
                static-mapping Ring-Front_Door-80c0c1 {
                    ip-address 192.168.2.50
                    mac-address 34:3e:a4:80:c0:c1
                }
                static-mapping amazon-echodot-masterbed-33QG {
                    ip-address 192.168.2.218
                    mac-address 1c:4d:66:f4:67:3e
                }
                static-mapping amazon-echodot-office-341E {
                    ip-address 192.168.2.217
                    mac-address 40:a2:db:b3:31:8a
                }
                static-mapping amazon-echoshow-mollie-68af115a435f4c7c {
                    ip-address 192.168.2.223
                    mac-address 44:3d:54:ba:2b:c2
                }
                static-mapping amazon-echoshow_kitchen-dcc473ae2 {
                    ip-address 192.168.2.219
                    mac-address 48:b4:23:b0:02:22
                }
                static-mapping android-460d2c8f8783d9d3-HP-Tablet {
                    ip-address 192.168.2.18
                    mac-address 88:33:14:bd:15:9f
                }
                static-mapping beaver {
                    ip-address 192.168.2.26
                    mac-address bc:85:56:36:88:19
                }
                static-mapping brother-mfcj5720dw {
                    ip-address 192.168.2.20
                    mac-address 2c:33:7a:31:e8:76
                }
                static-mapping capybara {
                    ip-address 192.168.2.22
                    mac-address 50:81:40:2D:84:02
                }
                static-mapping cctv-quad1 {
                    ip-address 192.168.2.53
                    mac-address b8:27:eb:26:de:ad
                }
                static-mapping cctv-quad2 {
                    ip-address 192.168.2.54
                    mac-address b8:27:eb:f4:48:92
                }
                static-mapping deco-E4R-8 {
                    ip-address 192.168.2.196
                    mac-address e8:48:b8:33:b2:14
                }
                static-mapping deco-E4R-9 {
                    ip-address 192.168.2.197
                    mac-address e8:48:b8:33:b2:7c
                }
                static-mapping deco-M4R-11 {
                    ip-address 192.168.2.195
                    mac-address e4:c3:2a:2f:29:e4
                }
                static-mapping deco-M5-1 {
                    ip-address 192.168.2.201
                    mac-address b0:4e:26:7c:71:39
                }
                static-mapping deco-M5-2 {
                    ip-address 192.168.2.202
                    mac-address b0:4e:26:7c:6c:84
                }
                static-mapping deco-M5-3 {
                    ip-address 192.168.2.203
                    mac-address b0:4e:26:49:b3:4e
                }
                static-mapping deco-M5-4 {
                    ip-address 192.168.2.204
                    mac-address b0:4e:26:7c:7e:ef
                }
                static-mapping deco-M5-5 {
                    ip-address 192.168.2.206
                    mac-address b0:4e:26:7c:74:5e
                }
                static-mapping deco-M5-6 {
                    ip-address 192.168.2.205
                    mac-address b0:4e:26:7c:78:8c
                }
                static-mapping deco-X20-7 {
                    ip-address 192.168.2.199
                    mac-address 10:27:f5:80:15:d0
                }
                static-mapping deco-X20-10 {
                    ip-address 192.168.2.198
                    mac-address 10:27:f5:80:13:18
                }
                static-mapping deco-X20-13 {
                    ip-address 192.168.2.194
                    mac-address e4:c3:2a:c7:fe:08
                }
                static-mapping deco-X20-x {
                    ip-address 192.168.2.208
                    mac-address e8:48:b8:22:1a:9c
                }
                static-mapping deco-X20-y {
                    ip-address 192.168.2.209
                    mac-address e8:48:b8:22:29:b0
                }
                static-mapping donkey {
                    ip-address 192.168.2.24
                    mac-address 50:3E:AA:16:7C:F0
                }
                static-mapping esp-attobat {
                    ip-address 192.168.2.176
                    mac-address a4:e5:7c:bc:6b:0c
                }
                static-mapping esp-entbtproxy {
                    ip-address 192.168.2.165
                    mac-address 0c:b8:15:f5:2a:cc
                }
                static-mapping esp-entmulti {
                    ip-address 192.168.2.169
                    mac-address e4:65:b8:77:76:ec
                }
                static-mapping esp-leafbat {
                    ip-address 192.168.2.168
                    mac-address a4:e5:7c:bc:93:0b
                }
                static-mapping esp-mainovenmonitor {
                    ip-address 192.168.2.177
                    mac-address 5c:cf:7f:bd:7b:36
                }
                static-mapping esp-midesklamp1s {
                    ip-address 192.168.2.166
                    mac-address d4:f0:ea:7a:ec:93
                }
                static-mapping esp-netcupfan2 {
                    ip-address 192.168.2.173
                    mac-address 58:bf:25:da:e9:d9
                }
                static-mapping esp-occupancyoffice {
                    ip-address 192.168.2.179
                    mac-address 0c:b8:15:c0:e7:00
                }
                static-mapping esp-occupancystair {
                    ip-address 192.168.2.178
                    mac-address 0c:b8:15:c1:f1:0c
                }
                static-mapping esp-weatherstation {
                    ip-address 192.168.2.171
                    mac-address 40:f5:20:28:2b:3e
                }
                static-mapping espresense-garage {
                    ip-address 192.168.2.161
                    mac-address 0c:b8:15:f7:44:10
                }
                static-mapping esp-bt-fridge-temps {
                    ip-address 192.168.2.174
                    mac-address 24:6f:28:b9:a6:10
                }
                static-mapping esp-nfcaccess1-33ad74 {
                    ip-address 192.168.2.175
                    mac-address 5c:cf:7f:33:ad:74
                }
                static-mapping howard-2025lap-wifi-IT459996 {
                    ip-address 192.168.2.57
                    mac-address 4c:0f:3e:8f:36:35
                }
                static-mapping howard-2025lap-wired-IT459996 {
                    ip-address 192.168.2.58
                    mac-address b4:e9:b8:9f:ca:30
                }
                static-mapping howard-OnePlus-12 {
                    ip-address 192.168.2.42
                    mac-address ac:c0:48:66:21:a7
                }
                static-mapping howard-gwatch5pro-SM-R925F {
                    ip-address 192.168.2.44
                    mac-address d2:3e:3c:19:34:28
                }
                static-mapping k1c-ingenic-EFF9 {
                    ip-address 192.168.2.31
                    mac-address fc:ee:28:05:ef:f9
                }
                static-mapping kim-dhl-laptop2 {
                    ip-address 192.168.2.159
                    mac-address e8:bf:b8:2c:61:36
                }
                static-mapping kim-iPhone-13dhl {
                    ip-address 192.168.2.56
                    mac-address 3c:3b:77:cb:98:27
                }
                static-mapping loungedisplay-ethernet {
                    ip-address 192.168.2.29
                    mac-address 00:01:80:78:b2:73
                }
                static-mapping loungedisplay-wireless {
                    ip-address 192.168.2.28
                    mac-address 00:25:d3:76:58:d3
                }
                static-mapping obk-ks811t-006D-garageentry {
                    ip-address 192.168.2.193
                    mac-address 50:8a:06:81:de:6d
                }
                static-mapping obk-ks811t-B1C4-mainbath1 {
                    ip-address 192.168.2.192
                    mac-address cc:8c:bf:2d:b1:c4
                }
                static-mapping openmqtt-1-esp32-AAC2CC {
                    ip-address 192.168.2.185
                    mac-address 0c:8b:95:aa:c2:cc
                }
                static-mapping panasonic-heat-pump-bedroom3 {
                    ip-address 192.168.2.226
                    mac-address e8:c7:cf:59:bc:cc
                }
                static-mapping panasonic-heat-pump-lounge {
                    ip-address 192.168.2.225
                    mac-address e8:c7:cf:63:f4:ce
                }
                static-mapping panasonic-heat-pump-masterbedroom {
                    ip-address 192.168.2.227
                    mac-address e8:c7:cf:54:df:70
                }
                static-mapping sonoff-ifan02-bed2-7042 {
                    ip-address 192.168.2.114
                    mac-address 60:01:94:ac:db:82
                }
                static-mapping sony-playstation4 {
                    ip-address 192.168.2.19
                    mac-address 0c:fe:45:4e:3c:28
                }
                static-mapping squeezelite-8a390 {
                    ip-address 192.168.2.221
                    mac-address 24:0a:c4:8a:03:90
                }
                static-mapping tasmota-athbulb-2152-1 {
                    ip-address 192.168.2.121
                    mac-address 80:64:6f:9e:28:68
                }
                static-mapping tasmota-lc4chan-7725-loungedisplay {
                    ip-address 192.168.2.148
                    mac-address d8:bf:c0:fc:3e:2d
                }
                static-mapping tasmo-H801-4469-outsideent_lights {
                    ip-address 192.168.2.125
                    mac-address 60:01:94:6f:91:75
                }
                static-mapping tasmo-H801-loungeled1-6180-6180 {
                    ip-address 192.168.2.70
                    mac-address 60:01:94:6f:98:24
                }
                static-mapping tasmo-arlecrgb-3522-bulb-3-2522 {
                    ip-address 192.168.2.60
                    mac-address ec:fa:bc:72:c9:da
                }
                static-mapping tasmo-arlec-1923-bulb-2-1923 {
                    ip-address 192.168.2.117
                    mac-address f4:cf:a2:55:c7:83
                }
                static-mapping tasmo-arlec-6600-bulb-1-6600 {
                    ip-address 192.168.2.97
                    mac-address f4:cf:a2:5d:19:c8
                }
                static-mapping tasmo-hw622-5799-netcupboardfan {
                    ip-address 192.168.2.64
                    mac-address 50:02:91:5f:d6:a7
                }
                static-mapping tasmo-ifan02-3793-bedrm1-1 {
                    ip-address 192.168.2.101
                    mac-address 84:0D:8E:47:AE:D1
                }
                static-mapping tasmo-ifan03-2541-foxholekitchen {
                    ip-address 192.168.2.105
                    mac-address dc:4f:22:b0:49:ed
                }
                static-mapping tasmo-kkettle-3773-portable-377 {
                    ip-address 192.168.2.112
                    mac-address e8:68:e7:60:6e:bd
                }
                static-mapping tasmo-ks811d-1043-hallway-2 {
                    ip-address 192.168.2.81
                    mac-address 2c:f4:32:06:e4:13
                }
                static-mapping tasmo-ks811d-1242-entrance-1242 {
                    ip-address 192.168.2.118
                    mac-address 40:f5:20:e0:44:da
                }
                static-mapping tasmo-ks811d-1701-stairs-2 {
                    ip-address 192.168.2.86
                    mac-address 48:3f:da:16:86:a8
                }
                static-mapping tasmo-ks811d-2552-lounge-2-2552 {
                    ip-address 192.168.2.138
                    mac-address 8c:aa:b5:e0:29:f8
                }
                static-mapping tasmo-ks811d-3777-bedrm2-1-3777 {
                    ip-address 192.168.2.77
                    mac-address dc:4f:22:72:0e:c1
                }
                static-mapping tasmo-ks811d-4381-stairs-1 {
                    ip-address 192.168.2.82
                    mac-address 48:3f:da:16:51:20
                }
                static-mapping tasmo-ks811d-5613-lounge-4 {
                    ip-address 192.168.2.67
                    mac-address 8c:aa:b5:df:f5:ed
                }
                static-mapping tasmo-ks811d-7244-bdrm3-1-7244 {
                    ip-address 192.168.2.84
                    mac-address cc:50:e3:ee:5c:4c
                }
                static-mapping tasmo-ks811d-7449-mainbath-2 {
                    ip-address 192.168.2.151
                    mac-address 8c:aa:b5:e0:7d:19
                }
                static-mapping tasmo-ks811d-7749-hallway-3-774 {
                    ip-address 192.168.2.85
                    mac-address cc:50:e3:ee:5e:45
                }
                static-mapping tasmo-ks811s-2940-hallway-1-294 {
                    ip-address 192.168.2.80
                    mac-address 50:02:91:43:0b:7c
                }
                static-mapping tasmo-ks811s-3075-lounge-1-3075 {
                    ip-address 192.168.2.98
                    mac-address ec:fa:bc:5c:4c:03
                }
                static-mapping tasmo-ks811s-3136-downstbed2-1- {
                    ip-address 192.168.2.75
                    mac-address 50:02:91:43:0c:40
                }
                static-mapping tasmo-ks811s-3211-lounge-2 {
                    ip-address 192.168.2.107
                    mac-address ec:fa:bc:5c:4c:8b
                }
                static-mapping tasmo-ks811s-3491-downstloun-1 {
                    ip-address 192.168.2.73
                    mac-address 50:02:91:43:0d:a3
                }
                static-mapping tasmo-ks811t-0702-lounge-3-0702 {
                    ip-address 192.168.2.116
                    mac-address 24:62:ab:05:a2:be
                }
                static-mapping tasmo-ks811t-0707-lounge-2 {
                    ip-address 192.168.2.83
                    mac-address 24:62:ab:05:a2:c3
                }
                static-mapping tasmo-ks811t-0804-bedrm2-2 {
                    ip-address 192.168.2.141
                    mac-address 24:62:ab:05:a3:24
                }
                static-mapping tasmo-ks811t-3647-bedrm1-1 {
                    ip-address 192.168.2.78
                    mac-address 84:F3:EB:EC:6E:3F
                }
                static-mapping tasmo-ks811t-3680-bedrm1-2-3680 {
                    ip-address 192.168.2.95
                    mac-address 84:f3:eb:ec:6e:60
                }
                static-mapping tasmo-ks811t-4658-lounge-5 {
                    ip-address 192.168.2.66
                    mac-address 84:cc:a8:8c:52:32
                }
                static-mapping tasmo-mhled-4905-loungecupboard {
                    ip-address 192.168.2.109
                    mac-address c4:4f:33:d2:53:29
                }
                static-mapping tasmo-mhled-5012-breakfastbar {
                    ip-address 192.168.2.89
                    mac-address 24:62:ab:6e:d3:94
                }
                static-mapping tasmo-mhled-5436-bookshelves {
                    ip-address 192.168.2.102
                    mac-address 24:62:ab:6e:d5:3c
                }
                static-mapping tasmo-nspnl-2044-lounge-1-2044 {
                    ip-address 192.168.2.149
                    mac-address 24:d7:eb:0d:e7:fc
                }
                static-mapping tasmo-ptled-1540-bed3leds {
                    ip-address 192.168.2.126
                    mac-address ac:0b:fb:d3:86:04
                }
                static-mapping tasmo-ptled-7673-leds {
                    ip-address 192.168.2.127
                    mac-address ac:0b:fb:d3:1d:f9
                }
                static-mapping tasmo-s4chan-7594-garage-1-7594 {
                    ip-address 192.168.2.92
                    mac-address 60:01:94:88:dd:aa
                }
                static-mapping tasmo-sbasic-5264-garageextlight-1 {
                    ip-address 192.168.2.87
                    mac-address 2c:3a:e8:0f:54:90
                }
                static-mapping tasmo-sbas-0407-garagelight-040 {
                    ip-address 192.168.2.111
                    mac-address 5c:cf:7f:3b:c1:97
                }
                static-mapping tasmo-sbas-3598-officegpo-2-359 {
                    ip-address 192.168.2.63
                    mac-address 2c:3a:e8:0f:4e:0e
                }
                static-mapping tasmo-sbas-5072-cupboard1-5072 {
                    ip-address 192.168.2.94
                    mac-address 5c:cf:7f:bb:13:d0
                }
                static-mapping tasmo-sbas-7363-officemultiusb- {
                    ip-address 192.168.2.99
                    mac-address 5c:cf:7f:3b:bc:c3
                }
                static-mapping tasmo-sdev-0501-laundryenv {
                    ip-address 192.168.2.124
                    mac-address 5c:cf:7f:92:41:f5
                }
                static-mapping tasmo-sdev-0778-switch-2-0778 {
                    ip-address 192.168.2.91
                    mac-address 5c:cf:7f:92:43:0a
                }
                static-mapping tasmo-sdev-8126-gasheater {
                    ip-address 192.168.2.103
                    mac-address 5c:cf:7f:92:3f:be
                }
                static-mapping tasmo-sdual-4231-underhouselights {
                    ip-address 192.168.2.122
                    mac-address 60:01:94:84:70:87
                }
                static-mapping tasmo-slusb-0768-1 {
                    ip-address 192.168.2.72
                    mac-address 2c:f4:32:e5:23:00
                }
                static-mapping tasmo-sonrf-0022 {
                    ip-address 192.168.2.115
                    mac-address 60:01:94:8b:60:16
                }
                static-mapping tasmo-spow-1957-laundrywash-195 {
                    ip-address 192.168.2.69
                    mac-address 5c:cf:7f:b4:a7:a5
                }
                static-mapping tasmo-spow-5526-laundrydry {
                    ip-address 192.168.2.88
                    mac-address 5c:cf:7f:92:35:96
                }
                static-mapping tasmo-spow-5747-poolpump-5747 {
                    ip-address 192.168.2.93
                    mac-address 5c:cf:7f:a0:36:73
                }
                static-mapping tasmo-wemosd1-7280-powermon-1-7 {
                    ip-address 192.168.2.96
                    mac-address 2c:f4:32:4b:bc:70
                }
                static-mapping tasmo-wemoskogan-5020-powermon- {
                    ip-address 192.168.2.119
                    mac-address 2c:f4:32:4b:33:9c
                }
                static-mapping tasmo-ytfir-a25e21-office-1-771 {
                    ip-address 192.168.2.113
                    mac-address e0:98:06:a2:5e:21
                }
                static-mapping tasmo-zigb-6440-1 {
                    ip-address 192.168.2.104
                    mac-address 84:cc:a8:9c:99:28
                }
                static-mapping tuya-kogan-smartplug-1-A8F5 {
                    ip-address 192.168.2.157
                    mac-address d4:a6:51:2a:a8:f5
                }
                static-mapping tuya-kogan-smartplug-2-C39A {
                    ip-address 192.168.2.158
                    mac-address d4:a6:51:2a:c3:9a
                }
                static-mapping wled-1-loungedisplay {
                    ip-address 192.168.2.180
                    mac-address 5c:cf:7f:06:53:6d
                }
            }
        }
        shared-network-name temp_LAN4 {
            authoritative disable
            subnet 172.31.0.0/16 {
                default-router 172.31.4.25
                dns-server 172.31.4.25
                lease 86400
                start 172.31.25.1 {
                    stop 172.31.25.254
                }
                static-mapping homeassistant {
                    ip-address 172.31.6.42
                    mac-address 44:8a:5b:b6:41:58
                }
                static-mapping openhasp_lounge1 {
                    ip-address 172.31.8.2
                    mac-address 98:a3:16:e7:ea:fc
                }
            }
        }
        static-arp disable
        use-dnsmasq enable
    }
    dns {
        forwarding {
            cache-size 150
            listen-on eth1
            listen-on pppoe0
            listen-on switch0
            listen-on eth3
        }
    }
    gui {
        http-port 80
        https-port 443
        older-ciphers enable
    }
    mdns {
        repeater {
            interface eth1
            interface switch0
            interface eth3
            interface eth4
            interface eth2
        }
    }
    nat {
        rule 5010 {
            description "masquerade for WAN"
            log disable
            outbound-interface pppoe0
            protocol all
            source {
                group {
                    address-group LAN_Interfaces_for_NAT
                }
            }
            type masquerade
        }
    }
    snmp {
        community <PRIVATE_COMMUNITY> {
            authorization ro
            client 172.31.6.42
        }
        listen-address 192.168.1.25 {
            port 161
        }
    }
    ssh {
        port 22
        protocol-version v2
    }
    unms {
        disable
    }
}
system {
    analytics-handler {
        send-analytics-report false
    }
    crash-handler {
        send-crash-report false
    }
    domain-name foxhome
    host-name ubnt
    ipv6 {
    }
    login {
        user automated_rules {
            authentication {
                encrypted-password <redacted>
                plaintext-password ""
                public-keys edgerouterfirewall {
                    key AAAAB3NzaC1yc2EAAAADAQABAAABgQDCtS6cCLDEXkVTYkh0ihU3YZ5pGh5ehgr2OJjC7Vwf3cA+ppWqVYVvVnV0UguLEqOLFGBKbgQ9izrz29aDVhFfGfoL3n/6zf5YbMOwbh2K8xgK3lZYhTOcW0wO/nBsI2bU2UNgNbl2wVQ90M0bc629mRgp3FDX0sekDYmOBsXw84uEkk38+eyGuI38oBMEZiVOgF4OAnd1KG5eWgH20ygEIqSYHAeCR24xLKUWJj+wds2JOFasAc1bAGEN3rG2dau94z8g0X1a728pVyrPcfl6hcSuAUfgbX2vfa4tAoe4KBEIRroW8SIFhPqtFO6XG2bX/vjHOQfzTfpSz9P1OjMvEBlt2OEYHJiKBldGgIipJO7tX+LolmYbdOOHWY9kxQv6ecTvZ8Jli7hxzxqwCdwn37XHP+ND09HGMP9GuxRCwpIXCMgOGi+9R/bjB7HQ340QNq4gawxjsPt/8ho0MIUbmv5m2nMZE0EQSpkefjtAscs8Od6pnl5g3xqplAsdSuM=
                    type ssh-rsa
                }
                public-keys linux {
                    key AAAAB3NzaC1yc2EAAAADAQABAAABgQDCtS6cCLDEXkVTYkh0ihU3YZ5pGh5ehgr2OJjC7Vwf3cA+ppWqVYVvVnV0UguLEqOLFGBKbgQ9izrz29aDVhFfGfoL3n/6zf5YbMOwbh2K8xgK3lZYhTOcW0wO/nBsI2bU2UNgNbl2wVQ90M0bc629mRgp3FDX0sekDYmOBsXw84uEkk38+eyGuI38oBMEZiVOgF4OAnd1KG5eWgH20ygEIqSYHAeCR24xLKUWJj+wds2JOFasAc1bAGEN3rG2dau94z8g0X1a728pVyrPcfl6hcSuAUfgbX2vfa4tAoe4KBEIRroW8SIFhPqtFO6XG2bX/vjHOQfzTfpSz9P1OjMvEBlt2OEYHJiKBldGgIipJO7tX+LolmYbdOOHWY9kxQv6ecTvZ8Jli7hxzxqwCdwn37XHP+ND09HGMP9GuxRCwpIXCMgOGi+9R/bjB7HQ340QNq4gawxjsPt/8ho0MIUbmv5m2nMZE0EQSpkefjtAscs8Od6pnl5g3xqplAsdSuM==edgerouterfirewall
                    type ssh-rsa
                }
            }
            full-name automated_rules
            level admin
        }
        user homeassistant {
            authentication {
                encrypted-password <redacted>
                plaintext-password ""
            }
            full-name zorruno
            level operator
        }
        user zorruno {
            authentication {
                encrypted-password <redacted>
                plaintext-password ""
                public-keys donkey {
                    key AAAAB3NzaC1yc2EAAAADAQABAAABgQDusoL6L/UtdQLswOlF/RQMjx1FGnM6lbjYVfnM9vWGHPg5m0Adx0SQQOIL4oAIj1UwJOvkzXl9UxvyW4rGjJGpkWeypGRcwJeoO3RcnjSHBNKz2IwMaMyRzqQL9GqMa9FvAzQVzk6ndDkBgQoNfn3oeid1PxSCbt6qDfVGqOWlTHUbRrgMlulwq3nkjHWFtu45i0VcySZYSl3byWuc/xpx6SWz0otVuXEzD+pc2PSO67kLNGPxE/Jq4FS8YWQszyw1yWg/rw9QNS+ft8cc0KkxjXjUTjuYMpdcMyLLrq+dgzcB8vUTcYMZx1L5gtBLDqEOK6wPLQgjauPdUPxw7xgQwrB2BXY3U+z+AzQHMu/EFoLtZiYOhyMaWS4xwiERzGbw0M6fb9YXjLo2nK3HlXNuwqka0fptHv3HFNoTMqzRJ5arukaEdqDZIsTI/myan7p8Sq9sqnu3MqFmoCkOjTaNBofDXwRsR1FAJwAzCmVq4ucSUQqYt87Ybjn/LHLvDU0==
                    type ssh-rsa
                }
                public-keys howard@donkey {
                    key AAAAB3NzaC1yc2EAAAADAQABAAABgQCiGMm9Tsm108FmXFM86NQwVKJgEg3U+QPTzde0UXj11rCnDkVHM4JmfgZ6qGbQbeYF0IZ7/Rx3lncS7v6VQ1Mg75uEmSy9U8TfYDKnYb97RhK8rD8oFCJjekF1q9zLP2oWI9zlVNkwO8YTZy/5KvJxgzI9THx60RlNieMgUzAma7FtUsuYniPlUfle92I9s4BFHIp/9kDhTBxVUUofU01+JPWceAdVyzaEp651z5Vxzpce8iLkoXyw86tWb6jCDHo4K9nDsIqYzMTqSJXcM00Ak5ZU7ZTpI/6xs1P5K0nvz8Oi1QRHYEhZivEdpAgPHR2ldPi2Nkh7f2+1mi5iT8ytunrpk24Qj4ePQqzNkl8NNue5dlsLLyBpiIpa4DNyT3x2XV5mQtruSixZn/bTX0LidviYBJulKfZm2/Wd0Z1xfpmB+Iid3vXuv4j8YdhCLiDj7jmU0O3qD+1SiAOHeL/7KvxLCn00JhsSOYbOBR33sVWlRIPUji3a1qUOEr7VxdM=
                    type ssh-rsa
                }
            }
            full-name zorruno
            level admin
        }
    }
    name-server 127.0.0.1
    name-server 8.8.8.8
    ntp {
        server 0.ubnt.pool.ntp.org {
        }
        server 1.ubnt.pool.ntp.org {
        }
        server 2.ubnt.pool.ntp.org {
        }
        server 3.ubnt.pool.ntp.org {
        }
    }
    offload {
        hwnat enable
        ipsec enable
    }
    package {
        repository blacklist {
            components main
            description "Britannic blacklist debian stretch repository"
            distribution stretch
            password ""
            url https://raw.githubusercontent.com/britannic/debian-repo/master/blacklist/public/
            username ""
        }
    }
    static-host-mapping {
        host-name homeassistant.local {
            alias homeassistant
            inet 192.168.1.42
        }
        host-name panda.foxhome3 {
            alias panda
            inet 192.168.3.200
        }
    }
    syslog {
        global {
            facility all {
                level notice
            }
            facility protocols {
                level debug
            }
        }
    }
    task-scheduler {
        task update_blacklists {
            executable {
                arguments 10800
                path /config/scripts/update-dnsmasq-cronjob.sh
            }
            interval 1d
        }
    }
    time-zone Pacific/Auckland
    traffic-analysis {
        dpi enable
        export enable
    }
}


/* Warning: Do not remove the following line. */
/* === vyatta-config-version: "config-management@1:conntrack@1:cron@1:dhcp-relay@1:dhcp-server@4:firewall@5:ipsec@5:nat@3:qos@1:quagga@2:suspend@1:system@5:ubnt-l2tp@1:ubnt-pptp@1:ubnt-udapi-server@1:ubnt-unms@2:ubnt-util@1:vrrp@1:vyatta-netflow@1:webgui@1:webproxy@1:zone-policy@1" === */
/* Release version: v3.0.1.5862409.250924.1407 */
