<?xml version="1.0"?>
<pfsense>
	<version>3.0</version>
	<lastchange/>
	<theme>metallic</theme>
	<system>
		<optimization>normal</optimization>
		<hostname>sipwall</hostname>
		<domain>myitdepartment.net</domain>
		<username>admin</username>
		<password>$1$xnpjASOi$9AlT77cCz1CTtxZPx4wdb0</password>
		<timezone>Etc/GMT-5</timezone>
		<time-update-interval/>
		<timeservers>10.255.252.98</timeservers>
		<webgui>
			<protocol>https</protocol>
			<port>10443</port>
			<certificate/>
			<private-key/>
		</webgui>
		<disablenatreflection>yes</disablenatreflection>
		<ssh>
			<authorizedkeys/>
			<port>42005</port>
		</ssh>
		<enablesshd>yes</enablesshd>
		<maximumstates/>
		<shapertype/>
		<dnsserver>208.254.204.17</dnsserver>
		<dnsserver>198.6.1.5</dnsserver>
		<dnsallowoverride/>
	</system>
	<interfaces>
		<lan>
			<if>em1</if>
			<ipaddr>10.255.252.70</ipaddr>
			<subnet>22</subnet>
			<media/>
			<mediaopt/>
			<bandwidth>100</bandwidth>
			<bandwidthtype>Mb</bandwidthtype>
		</lan>
		<wan>
			<if>em0</if>
			<mtu/>
			<media/>
			<mediaopt/>
			<bandwidth>100</bandwidth>
			<bandwidthtype>Mb</bandwidthtype>
			<spoofmac/>
			<disableftpproxy/>
			<ipaddr>208.254.204.33</ipaddr>
			<subnet>25</subnet>
			<gateway>208.254.204.1</gateway>
		</wan>
	</interfaces>
	<staticroutes/>
	<pppoe>
		<username/>
		<password/>
		<provider/>
	</pppoe>
	<pptp>
		<username/>
		<password/>
		<local/>
		<subnet/>
		<remote/>
		<timeout/>
	</pptp>
	<bigpond>
		<username/>
		<password/>
		<authserver/>
		<authdomain/>
		<minheartbeatinterval/>
	</bigpond>
	<dyndns>
		<type>dyndns</type>
		<username/>
		<password/>
		<host/>
		<mx/>
	</dyndns>
	<dhcpd>
		<lan>
			<range>
				<from>10.255.252.10</from>
				<to>10.255.252.245</to>
			</range>
		</lan>
	</dhcpd>
	<pptpd>
		<mode/>
		<redir/>
		<localip/>
		<remoteip/>
	</pptpd>
	<ovpn/>
	<dnsmasq>
		<enable/>
	</dnsmasq>
	<snmpd>
		<syslocation/>
		<syscontact/>
		<rocommunity>public</rocommunity>
	</snmpd>
	<diag>
		<ipv6nat/>
	</diag>
	<bridge/>
	<syslog/>
	<nat>
		<ipsecpassthru/>
		<advancedoutbound>
			<rule>
				<source>
					<network>10.255.252.0/22</network>
				</source>
				<sourceport/>
				<descr>Auto created rule for LAN</descr>
				<target/>
				<interface>wan</interface>
				<staticnatport/>
				<destination>
					<any/>
				</destination>
				<natport/>
				<dstport/>
			</rule>
			<enable/>
		</advancedoutbound>
		<rule>
			<protocol>udp</protocol>
			<external-port>5060</external-port>
			<target>10.255.252.71</target>
			<local-port>5060</local-port>
			<interface>wan</interface>
			<descr>sipx signalling</descr>
		</rule>
		<rule>
			<protocol>tcp</protocol>
			<external-port>5060</external-port>
			<target>10.255.252.71</target>
			<local-port>5060</local-port>
			<interface>wan</interface>
			<descr>sipx signalling</descr>
		</rule>
		<rule>
			<protocol>udp</protocol>
			<external-port>5080</external-port>
			<target>10.255.252.71</target>
			<local-port>5080</local-port>
			<interface>wan</interface>
			<descr>itsp signalling receive from bw.com</descr>
		</rule>
		<rule>
			<protocol>udp</protocol>
			<external-port>30000-31000</external-port>
			<target>10.255.252.71</target>
			<local-port>30000</local-port>
			<interface>wan</interface>
			<descr>sipx media</descr>
		</rule>
		<rule>
			<protocol>tcp</protocol>
			<external-port>80</external-port>
			<target>10.255.252.71</target>
			<local-port>80</local-port>
			<interface>wan</interface>
			<descr>http to sipx</descr>
		</rule>
		<rule>
			<protocol>tcp</protocol>
			<external-port>8443</external-port>
			<target>10.255.252.71</target>
			<local-port>8443</local-port>
			<interface>wan</interface>
			<descr>https redirect to sipx</descr>
		</rule>
		<rule>
			<protocol>tcp</protocol>
			<external-port>10443</external-port>
			<target>10.255.252.70</target>
			<local-port>10443</local-port>
			<interface>wan</interface>
			<descr>voicefw redirect for remote mgmt</descr>
		</rule>
		<rule>
			<protocol>tcp</protocol>
			<external-port>42005</external-port>
			<target>10.255.252.70</target>
			<local-port>42005</local-port>
			<interface>wan</interface>
			<descr>ssh to the pfsense box</descr>
		</rule>
		<rule>
			<protocol>tcp</protocol>
			<external-port>12000</external-port>
			<target>10.255.252.71</target>
			<local-port>12000</local-port>
			<interface>wan</interface>
			<descr>https redirect to sipx</descr>
		</rule>
	</nat>
	<filter>
		<rule>
			<type>pass</type>
			<interface>wan</interface>
			<max-src-nodes/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>udp</protocol>
			<source>
				<any/>
			</source>
			<destination>
				<address>10.255.252.71</address>
				<port>5060</port>
			</destination>
			<descr>NAT sipx user signalling over UDP</descr>
		</rule>
		<rule>
			<type>pass</type>
			<interface>wan</interface>
			<max-src-nodes/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp</protocol>
			<source>
				<any/>
			</source>
			<destination>
				<address>10.255.252.71</address>
				<port>5060</port>
			</destination>
			<descr>NAT sipx user signalling over TCP</descr>
		</rule>
		<rule>
			<type>pass</type>
			<interface>wan</interface>
			<max-src-nodes/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>udp</protocol>
			<source>
				<any/>
			</source>
			<destination>
				<address>10.255.252.71</address>
				<port>5080</port>
			</destination>
			<descr>NAT ITSP signalling to sipx over UDP</descr>
		</rule>
		<rule>
			<type>pass</type>
			<interface>wan</interface>
			<max-src-nodes/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>udp</protocol>
			<source>
				<any/>
			</source>
			<destination>
				<address>10.255.252.71</address>
				<port>30000-31000</port>
			</destination>
			<descr>NAT sipx media</descr>
		</rule>
		<rule>
			<type>pass</type>
			<interface>wan</interface>
			<max-src-nodes/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp</protocol>
			<source>
				<any/>
			</source>
			<destination>
				<address>10.255.252.71</address>
				<port>80</port>
			</destination>
			<descr>NAT http to sipx</descr>
		</rule>
		<rule>
			<type>pass</type>
			<interface>wan</interface>
			<max-src-nodes/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp</protocol>
			<source>
				<any/>
			</source>
			<destination>
				<address>10.255.252.71</address>
				<port>8443</port>
			</destination>
			<descr>NAT https redirect to sipx</descr>
		</rule>
		<rule>
			<type>pass</type>
			<interface>wan</interface>
			<max-src-nodes/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp</protocol>
			<source>
				<any/>
			</source>
			<destination>
				<address>10.255.252.70</address>
				<port>10443</port>
			</destination>
			<descr>NAT voicefw redirect for remote mgmt</descr>
		</rule>
		<rule>
			<interface>wan</interface>
			<protocol>tcp</protocol>
			<source>
				<any/>
			</source>
			<destination>
				<address>10.255.252.70</address>
				<port>42005</port>
			</destination>
			<descr>NAT </descr>
		</rule>
		<rule>
			<interface>wan</interface>
			<protocol>tcp</protocol>
			<source>
				<any/>
			</source>
			<destination>
				<address>10.255.252.71</address>
				<port>12000</port>
			</destination>
			<descr>NAT https redirect to sipx</descr>
		</rule>
		<rule>
			<type>pass</type>
			<interface>lan</interface>
			<max-src-nodes/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<any/>
			</destination>
			<descr>Default LAN -&gt; any</descr>
		</rule>
	</filter>
	<ipsec>
		<preferredoldsa/>
	</ipsec>
	<aliases/>
	<proxyarp/>
	<cron>
		<item>
			<minute>0</minute>
			<hour>*</hour>
			<mday>*</mday>
			<month>*</month>
			<wday>*</wday>
			<who>root</who>
			<command>/usr/bin/nice -n20 newsyslog</command>
		</item>
		<item>
			<minute>1,31</minute>
			<hour>0-5</hour>
			<mday>*</mday>
			<month>*</month>
			<wday>*</wday>
			<who>root</who>
			<command>/usr/bin/nice -n20 adjkerntz -a</command>
		</item>
		<item>
			<minute>1</minute>
			<hour>3</hour>
			<mday>1</mday>
			<month>*</month>
			<wday>*</wday>
			<who>root</who>
			<command>/usr/bin/nice -n20 /etc/rc.update_bogons.sh</command>
		</item>
		<item>
			<minute>*/60</minute>
			<hour>*</hour>
			<mday>*</mday>
			<month>*</month>
			<wday>*</wday>
			<who>root</who>
			<command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 sshlockout</command>
		</item>
		<item>
			<minute>1</minute>
			<hour>1</hour>
			<mday>*</mday>
			<month>*</month>
			<wday>*</wday>
			<who>root</who>
			<command>/usr/bin/nice -n20 /etc/rc.dyndns.update</command>
		</item>
		<item>
			<minute>*/60</minute>
			<hour>*</hour>
			<mday>*</mday>
			<month>*</month>
			<wday>*</wday>
			<who>root</who>
			<command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot</command>
		</item>
		<item>
			<minute>*/60</minute>
			<hour>*</hour>
			<mday>*</mday>
			<month>*</month>
			<wday>*</wday>
			<who>root</who>
			<command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -t 3600 snort2c</command>
		</item>
		<item>
			<minute>*/5</minute>
			<hour>*</hour>
			<mday>*</mday>
			<month>*</month>
			<wday>*</wday>
			<who>root</who>
			<command>/usr/local/bin/checkreload.sh</command>
		</item>
		<item>
			<minute>*/5</minute>
			<hour>*</hour>
			<mday>*</mday>
			<month>*</month>
			<wday>*</wday>
			<who>root</who>
			<command>/etc/ping_hosts.sh</command>
		</item>
		<item>
			<minute>*/140</minute>
			<hour>*</hour>
			<mday>*</mday>
			<month>*</month>
			<wday>*</wday>
			<who>root</who>
			<command>/usr/local/sbin/reset_slbd.sh</command>
		</item>
	</cron>
	<wol/>
	<installedpackages>
		<menu>
			<name>NMap</name>
			<tooltiptext>NMap is a utility for network exploration or security auditing. It supports ping scanning (determine which hosts are up), many port scanning techniques (determine what services the hosts are offering), version detection (determine what application/service is runing on a port), and TCP/IP fingerprinting (remote host OS or device identification). It also offers flexible target and port specification, decoy/stealth scanning, SunRPC scanning, and more. Most Unix and Windows platforms are supported in both GUI and command line modes. Several popular handheld devices are also supported, including the Sharp Zaurus and the iPAQ.</tooltiptext>
			<section>Diagnostics</section>
			<configfile>nmap.xml</configfile>
		</menu>
		<menu>
			<name>Proxy server</name>
			<tooltiptext>Modify the proxy server's settings</tooltiptext>
			<section>Services</section>
			<url>/pkg_edit.php?xml=squid.xml&amp;id=0</url>
		</menu>
		<package>
			<name>nmap</name>
			<maintainer>billm@pfsense.org</maintainer>
			<descr>NMap is a utility for network exploration or security auditing. It supports ping scanning (determine which hosts are up), many port scanning techniques (determine what services the hosts are offering), version detection (determine what application/service is runing on a port), and TCP/IP fingerprinting (remote host OS or device identification). It also offers flexible target and port specification, decoy/stealth scanning, SunRPC scanning, and more. Most Unix and Windows platforms are supported in both GUI and command line modes. Several popular handheld devices are also supported, including the Sharp Zaurus and the iPAQ.</descr>
			<category>Security</category>
			<depends_on_package_base_url>http://files.pfsense.org/packages/7/All/</depends_on_package_base_url>
			<depends_on_package>nmap-4.76.tbz</depends_on_package>
			<config_file>http://www.pfsense.com/packages/config/nmap/nmap.xml</config_file>
			<version>4.76</version>
			<status>Stable</status>
			<pkginfolink>http://doc.pfsense.org/index.php/Nmap_package</pkginfolink>
			<required_version>1.2.1</required_version>
			<configurationfile>nmap.xml</configurationfile>
		</package>
		<package>
			<name>Open-VM-Tools</name>
			<descr>VMware Tools</descr>
			<website>http://open-vm-tools.sourceforge.net/</website>
			<category>Services</category>
			<version>167859</version>
			<status>Stable</status>
			<pkginfolink>http://doc.pfsense.org/index.php/Open_VM_Tools_package</pkginfolink>
			<required_version>1.2.1</required_version>
			<config_file>http://www.pfsense.org/packages/config/open-vm-tools/open-vm-tools.xml</config_file>
			<configurationfile>open-vm-tools.xml</configurationfile>
			<depends_on_package_base_url>http://files.pfsense.org/packages/7/All/</depends_on_package_base_url>
			<depends_on_package>open-vm-tools-nox11-167859_1.tbz</depends_on_package>
			<depends_on_package>libtool-2.2.6a.tbz</depends_on_package>
			<depends_on_package>libiconv-1.13.1.tbz</depends_on_package>
			<depends_on_package>libdnet-1.11_3.tbz</depends_on_package>
			<depends_on_package>icu-3.8.1_2.tbz</depends_on_package>
			<depends_on_package>gmake-3.81_3.tbz</depends_on_package>
			<depends_on_package>gettext-0.17_1.tbz</depends_on_package>
			<depends_on_package>glib-2.20.4.tbz</depends_on_package>
		</package>
		<package>
			<name>squid</name>
			<descr>High performance web proxy cache.</descr>
			<website>http://www.squid-cache.org/</website>
			<category>Network</category>
			<version>2.7.8</version>
			<status>Stable</status>
			<required_version>1.2.1</required_version>
			<maintainer>fernando@netfilter.com.br seth.mos@xs4all.nl mfuchs77@googlemail.com</maintainer>
			<depends_on_package_base_url>http://files.pfsense.org/packages/7/All/</depends_on_package_base_url>
			<depends_on_package>squid-2.7.7.tbz</depends_on_package>
			<depends_on_package>squid_radius_auth-1.10.tbz</depends_on_package>
			<depends_on_package>openldap-client-2.4.10.tbz</depends_on_package>
			<config_file>http://www.pfsense.org/packages/config/squid/squid.xml</config_file>
			<configurationfile>squid.xml</configurationfile>
		</package>
		<service>
			<name>squid</name>
			<rcfile>squid.sh</rcfile>
			<executable>squid</executable>
			<description>Proxy server Service</description>
		</service>
		<squid>
			<config>
				<active_interface>lan</active_interface>
				<allow_interface>on</allow_interface>
				<transparent_proxy>on</transparent_proxy>
				<private_subnet_proxy_off/>
				<defined_ip_proxy_off/>
				<log_enabled/>
				<log_dir>/var/squid/log</log_dir>
				<log_rotate/>
				<proxy_port>3128</proxy_port>
				<icp_port/>
				<visible_hostname>firewall.myitdepartment.net</visible_hostname>
				<admin_email>myit_help@helpdesk.myitdepartment.net</admin_email>
				<error_language>English</error_language>
				<disable_xforward/>
				<disable_via/>
				<uri_whitespace>strip</uri_whitespace>
				<dns_nameservers/>
				<disable_squidversion/>
				<custom_options/>
			</config>
		</squid>
		<squidnac>
			<config>
				<allowed_subnets>MTAuMjU1LjI1Mi4wLzIy</allowed_subnets>
				<unrestricted_hosts/>
				<banned_hosts/>
				<whitelist/>
				<blacklist>bXlzcGFjZS5jb20NCnR3aXR0ZXIuY29t</blacklist>
				<ext_cachemanager/>
			</config>
		</squidnac>
	</installedpackages>
	<revision>
		<description>/wizard.php made unknown change</description>
		<time>1257557173</time>
	</revision>
	<rrd>
		<enable/>
	</rrd>
	<ezshaper>
		<step2>
			<download>1500</download>
			<upload>1500</upload>
			<inside_int>lan</inside_int>
			<outside_int>wan</outside_int>
		</step2>
		<step3>
			<provider>sipXecs</provider>
			<address>10.255.252.71</address>
			<bandwidth>1024</bandwidth>
			<enable>on</enable>
		</step3>
		<step4>
			<address/>
			<bandwidthup/>
			<bandwidthdown/>
		</step4>
		<step5>
			<bandwidthup/>
			<bandwidthdown/>
		</step5>
		<step7>
			<msrdp/>
			<vnc/>
			<appleremotedesktop/>
			<pcanywhere/>
			<irc/>
			<jabber/>
			<icq/>
			<aolinstantmessenger/>
			<msnmessenger/>
			<teamspeak/>
			<pptp/>
			<ipsec/>
			<streamingmp3/>
			<rtsp/>
			<http/>
			<smtp/>
			<pop3/>
			<imap/>
			<lotusnotes/>
			<dns/>
			<icmp/>
			<smb/>
			<snmp/>
			<mysqlserver/>
			<nntp/>
			<cvsup/>
		</step7>
	</ezshaper>
	<shaper>
		<schedulertype>hfsc</schedulertype>
		<queue>
			<name>qwanRoot</name>
			<associatedrule>0</associatedrule>
			<priority>0</priority>
			<parentqueue>on</parentqueue>
			<bandwidth>1500</bandwidth>
			<bandwidthtype>Kb</bandwidthtype>
		</queue>
		<queue>
			<name>qlanRoot</name>
			<associatedrule>0</associatedrule>
			<priority>0</priority>
			<parentqueue>on</parentqueue>
			<bandwidth>1500</bandwidth>
			<bandwidthtype>Kb</bandwidthtype>
		</queue>
		<queue>
			<name>qwandef</name>
			<attachtoqueue>qwanRoot</attachtoqueue>
			<associatedrule>0</associatedrule>
			<defaultqueue>true</defaultqueue>
			<priority>1</priority>
			<realtime>on</realtime>
			<realtime3>1%</realtime3>
			<bandwidth>1</bandwidth>
			<bandwidthtype>%</bandwidthtype>
			<qlimit>500</qlimit>
		</queue>
		<queue>
			<name>qlandef</name>
			<priority>1</priority>
			<attachtoqueue>qlanRoot</attachtoqueue>
			<associatedrule>0</associatedrule>
			<defaultqueue>true</defaultqueue>
			<realtime>on</realtime>
			<realtime3>1%</realtime3>
			<bandwidth>1</bandwidth>
			<bandwidthtype>%</bandwidthtype>
			<qlimit>500</qlimit>
		</queue>
		<queue>
			<name>qwanacks</name>
			<ack/>
			<attachtoqueue>qwanRoot</attachtoqueue>
			<associatedrule>0</associatedrule>
			<priority>7</priority>
			<realtime>on</realtime>
			<realtime3>10%</realtime3>
			<bandwidth>25</bandwidth>
			<bandwidthtype>%</bandwidthtype>
		</queue>
		<queue>
			<name>qlanacks</name>
			<ack/>
			<attachtoqueue>qlanRoot</attachtoqueue>
			<associatedrule>0</associatedrule>
			<priority>7</priority>
			<realtime>on</realtime>
			<realtime3>10%</realtime3>
			<bandwidth>25</bandwidth>
			<bandwidthtype>%</bandwidthtype>
		</queue>
		<queue>
			<name>qVOIPUp</name>
			<attachtoqueue>qwanRoot</attachtoqueue>
			<associatedrule>0</associatedrule>
			<priority>7</priority>
			<realtime>on</realtime>
			<realtime3>1024Kb</realtime3>
			<bandwidth>25</bandwidth>
			<bandwidthtype>%</bandwidthtype>
		</queue>
		<queue>
			<name>qVOIPDown</name>
			<attachtoqueue>qlanRoot</attachtoqueue>
			<associatedrule>0</associatedrule>
			<priority>7</priority>
			<realtime>on</realtime>
			<realtime3>1024Kb</realtime3>
			<bandwidth>25</bandwidth>
			<bandwidthtype>%</bandwidthtype>
		</queue>
		<rule>
			<descr>VOIP Adapter</descr>
			<inqueue>qVOIPUp</inqueue>
			<outqueue>qVOIPDown</outqueue>
			<in-interface>wan</in-interface>
			<out-interface>lan</out-interface>
			<source>
				<any/>
			</source>
			<destination>
				<address>10.255.252.71</address>
			</destination>
		</rule>
		<rule>
			<descr>VOIP Adapter</descr>
			<inqueue>qVOIPDown</inqueue>
			<outqueue>qVOIPUp</outqueue>
			<in-interface>lan</in-interface>
			<out-interface>wan</out-interface>
			<source>
				<address>10.255.252.71</address>
			</source>
			<destination>
				<any/>
			</destination>
		</rule>
		<enable/>
	</shaper>
</pfsense>
