! $$$ Version: 2.0
! $$$ Agent: default
system
    set dev.usb.force_usb2 0
    set net.ipv4.ip_forward 1
    set net.ipv4.neigh.default.gc_thresh1 256
    set net.ipv4.neigh.default.gc_thresh2 1024
    set net.ipv4.neigh.default.gc_thresh3 2048
    set net.ipv4.tcp_fin_timeout 30
    set net.ipv4.tcp_keepalive_time 120
    set net.ipv6.conf.all.forwarding 1
    set net.ipv6.neigh.default.gc_thresh1 256
    set net.ipv6.neigh.default.gc_thresh2 1024
    set net.ipv6.neigh.default.gc_thresh3 2048
    set net.netfilter.nf_conntrack_tcp_timeout_established 1200
    set vm.overcommit_memory 0
    set vm.swappiness 60
    set vm.vfs_cache_pressure 1000
    button WLAN on click do LedToggle
    no button WLAN on double-click
    no button WLAN on hold
    no button FN on click
    clock timezone Europe/Moscow
    domainname WORKGROUP
    hostname Keenetic
    caption default
    description "Keenetic NX31 (KN-3811)"
    zram
    ndss dump-report disable
!
isolate-private
user admin
    password md5 fddee56b1136f9f5e51788e25e6aacf4
    password nt 259745cb123a52aa2e693aaacca2db52
    tag cli
    tag http
    tag opt
!
dyndns profile _WEBADMIN
!
interface GigabitEthernet0
    up
!
interface GigabitEthernet0/0
    rename 1
    switchport mode access
    switchport mode trunk
    switchport access vlan 1
    switchport trunk vlan 3
    up
!
interface GigabitEthernet0/1
    rename 2
    switchport mode access
    switchport mode trunk
    switchport access vlan 1
    switchport trunk vlan 3
    up
!
interface GigabitEthernet0/2
    rename 3
    switchport mode access
    switchport mode trunk
    switchport access vlan 1
    switchport trunk vlan 3
    up
!
interface GigabitEthernet0/3
    rename 4
    switchport mode access
    switchport access vlan 1
    down
!
interface GigabitEthernet0/Vlan1
    description "Home VLAN"
    ip dhcp client dns-routes
    up
!
interface GigabitEthernet0/Vlan3
    description "Guest VLAN"
    ip dhcp client dns-routes
    up
!
interface GigabitEthernet1
    rename ISP
    description "Broadband connection"
    mac address factory wan
    security-level public
    ip address dhcp
    ip dhcp client dns-routes
    ip global 700
    igmp upstream
    ipv6 address auto
    ipv6 prefix auto
    ipv6 name-servers auto
    led wan
    up
!
interface GigabitEthernet1/0
    rename 0
    up
!
interface WifiMaster0
    country-code RU
    compatibility BGN+AX
    channel width 40-below
    tx-burst
    rekey-interval 86400
    beamforming explicit
    vht
    downlink-mumimo
    uplink-mumimo
    downlink-ofdma
    uplink-ofdma
    spatial-reuse
    up
!
interface WifiMaster0/AccessPoint0
    rename AccessPoint
    description "Wi-Fi access point"
    mac access-list type none
    authentication wpa-psk ns3 7sLV9venXcRoWSVo3wXIR8sr
    encryption enable
    encryption wpa2
    ip dhcp client dns-routes
    ssid Keenetic
    wmm
    up
!
interface WifiMaster0/AccessPoint1
    rename GuestWiFi
    description "Guest access point"
    mac access-list type none
    encryption no enable
    ip dhcp client dns-routes
    ssid Guest
    wmm
    rrm
    ft mdid XX
    ft enable
    down
!
interface WifiMaster0/AccessPoint2
    mac access-list type none
    security-level private
    encryption no enable
    ip dhcp client dns-routes
    down
!
interface WifiMaster0/AccessPoint3
    mac access-list type none
    security-level private
    encryption no enable
    ip dhcp client dns-routes
    down
!
interface WifiMaster0/AccessPoint4
    mac access-list type none
    security-level private
    encryption no enable
    ip dhcp client dns-routes
    down
!
interface WifiMaster0/AccessPoint5
    mac access-list type none
    security-level private
    encryption no enable
    ip dhcp client dns-routes
    down
!
interface WifiMaster0/AccessPoint6
    mac access-list type none
    security-level private
    encryption no enable
    ip dhcp client dns-routes
    down
!
interface WifiMaster0/WifiStation0
    security-level public
    encryption no enable
    ip dhcp client dns-routes
    standby enable
    standby timeout 600
    down
!
interface WifiMaster1
    country-code RU
    compatibility AN+AC+AX
    channel 36
    channel width 160
    tx-burst
    rekey-interval 86400
    beamforming explicit
    downlink-mumimo
    uplink-mumimo
    downlink-ofdma
    uplink-ofdma
    spatial-reuse
    up
!
interface WifiMaster1/AccessPoint0
    rename AccessPoint_5G
    description "5GHz Wi-Fi access point"
    mac access-list type none
    authentication wpa-psk ns3 7sLV9venXcRoWSVo3wXIR8sr
    encryption enable
    encryption wpa2
    ip dhcp client dns-routes
    ssid Keenetic
    wmm
    follow AccessPoint
    up
!
interface WifiMaster1/AccessPoint1
    rename GuestWiFi_5G
    description "5GHz Guest access point"
    mac access-list type none
    encryption no enable
    ip dhcp client dns-routes
    ssid Guest
    rrm
    ft mdid XX
    ft enable
    follow GuestWiFi
    down
!
interface WifiMaster1/AccessPoint2
    mac access-list type none
    security-level private
    encryption no enable
    ip dhcp client dns-routes
    down
!
interface WifiMaster1/AccessPoint3
    mac access-list type none
    security-level private
    encryption no enable
    ip dhcp client dns-routes
    down
!
interface WifiMaster1/AccessPoint4
    mac access-list type none
    security-level private
    encryption no enable
    ip dhcp client dns-routes
    down
!
interface WifiMaster1/AccessPoint5
    mac access-list type none
    security-level private
    encryption no enable
    ip dhcp client dns-routes
    down
!
interface WifiMaster1/AccessPoint6
    mac access-list type none
    security-level private
    encryption no enable
    ip dhcp client dns-routes
    down
!
interface WifiMaster1/WifiStation0
    security-level public
    encryption no enable
    ip dhcp client dns-routes
    standby enable
    standby timeout 600
    down
!
interface Bridge0
    rename Home
    description "Home network"
    include GigabitEthernet0/Vlan1
    include AccessPoint
    include AccessPoint_5G
    mac address factory lan
    mac access-list type none
    security-level private
    ip address 192.168.1.1 255.255.255.0
    ip dhcp client dns-routes
    igmp downstream
    band-steering
    band-steering preference 5
    up
!
interface Bridge1
    rename Guest
    description "Guest network"
    traffic-shape rate 5120
    include GigabitEthernet0/Vlan3
    include GuestWiFi
    include GuestWiFi_5G
    mac access-list type none
    peer-isolation
    security-level protected
    ip address 10.1.30.1 255.255.255.0
    ip dhcp client dns-routes
    iapp key ns3 VceJZNGx6tbFuTnrLcX3q3wqn9hPFYmlG8RgAS4WVQSzOFmy
    down
!
ip dhcp pool _WEBADMIN
    range 192.168.1.33 192.168.1.152
    lease 25200
    bind Home
    enable
!
ip dhcp pool _WEBADMIN_GUEST_AP
    range 10.1.30.33 10.1.30.152
    bind Guest
    enable
!
ip http security-level private
ip http lockout-policy 5 15 3
ip http ssl enable
ip conntrack max-entries 32768
ip nat Home
ip nat Guest
ip nat vpn
ip telnet
    security-level private
    lockout-policy 5 15 3
!
ip ssh
    security-level private
    lockout-policy 5 15 3
!
ip hotspot
    policy Home permit
!
ipv6 subnet Default
    bind Home
    mode slaac
    prefix length 64
    number 0
!
ipv6 local-prefix default
ppe software
ppe hardware
upnp lan Home
ntce
    qos category calling priority 1
    qos category gaming priority 2
    qos category streaming priority 3
    qos category work priority 4
    qos category surfing priority 5
    qos category other priority 6
    qos category filetransfering priority 7
!
crypto engine software
vpn-server
    interface Home
    pool-range 172.16.1.33 200
    multi-login
    lockout-policy 5 15 3
    lcp echo 30 3
!
service dhcp
service dns-proxy
service igmp-proxy
service http
service telnet
service ssh
service ntp
service upnp
service no internet-checker
dns-proxy
    rebind-protect auto
!
mdns
    reflector disable
!
components
    auto-update disable
    auto-update channel stable
!
!
