<?xml version="1.0"?>
<!-- pfSense default system configuration -->
<pfsense>
	<version>9.8</version>
	<lastchange></lastchange>
	<theme>pfsense_ng</theme>
	<sysctl>
		<item>
			<descr><![CDATA[Enable mounting the FS read only with more checks.]]></descr>
			<tunable>vfs.forcesync</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Disable the pf ftp proxy handler.]]></descr>
			<tunable>debug.pfftpproxy</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Increase UFS read-ahead speeds to match current state of hard drives and NCQ. More information here: http://ivoras.sharanet.org/blog/tree/2010-11-19.ufs-read-ahead.html]]></descr>
			<tunable>vfs.read_max</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Set the ephemeral port range to be lower.]]></descr>
			<tunable>net.inet.ip.portrange.first</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Drop packets to closed TCP ports without returning a RST]]></descr>
			<tunable>net.inet.tcp.blackhole</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Do not send ICMP port unreachable messages for closed UDP ports]]></descr>
			<tunable>net.inet.udp.blackhole</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Randomize the ID field in IP packets (default is 0: sequential IP IDs)]]></descr>
			<tunable>net.inet.ip.random_id</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Drop SYN-FIN packets (breaks RFC1379, but nobody uses it anyway)]]></descr>
			<tunable>net.inet.tcp.drop_synfin</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Enable sending IPv4 redirects]]></descr>
			<tunable>net.inet.ip.redirect</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Enable sending IPv6 redirects]]></descr>
			<tunable>net.inet6.ip6.redirect</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Enable privacy settings for IPv6 (RFC 4941)]]></descr>
			<tunable>net.inet6.ip6.use_tempaddr</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Prefer privacy addresses and use them over the normal addresses]]></descr>
			<tunable>net.inet6.ip6.prefer_tempaddr</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Generate SYN cookies for outbound SYN-ACK packets]]></descr>
			<tunable>net.inet.tcp.syncookies</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Maximum incoming/outgoing TCP datagram size (receive)]]></descr>
			<tunable>net.inet.tcp.recvspace</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Maximum incoming/outgoing TCP datagram size (send)]]></descr>
			<tunable>net.inet.tcp.sendspace</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[IP Fastforwarding]]></descr>
			<tunable>net.inet.ip.fastforwarding</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Do not delay ACK to try and piggyback it onto a data packet]]></descr>
			<tunable>net.inet.tcp.delayed_ack</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Maximum outgoing UDP datagram size]]></descr>
			<tunable>net.inet.udp.maxdgram</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Handling of non-IP packets which are not passed to pfil (see if_bridge(4))]]></descr>
			<tunable>net.link.bridge.pfil_onlyip</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Set to 0 to disable filtering on the incoming and outgoing member interfaces.]]></descr>
			<tunable>net.link.bridge.pfil_member</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Set to 1 to enable filtering on the bridge interface]]></descr>
			<tunable>net.link.bridge.pfil_bridge</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Allow unprivileged access to tap(4) device nodes]]></descr>
			<tunable>net.link.tap.user_open</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Randomize PID's (see src/sys/kern/kern_fork.c: sysctl_kern_randompid())]]></descr>
			<tunable>kern.randompid</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Maximum size of the IP input queue]]></descr>
			<tunable>net.inet.ip.intr_queue_maxlen</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Disable CTRL+ALT+Delete reboot from keyboard.]]></descr>
			<tunable>hw.syscons.kbd_reboot</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Enable TCP Inflight mode]]></descr>
			<tunable>net.inet.tcp.inflight.enable</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Enable TCP extended debugging]]></descr>
			<tunable>net.inet.tcp.log_debug</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Set ICMP Limits]]></descr>
			<tunable>net.inet.icmp.icmplim</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[TCP Offload Engine]]></descr>
			<tunable>net.inet.tcp.tso</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[UDP Checksums]]></descr>
			<tunable>net.inet.udp.checksum</tunable>
			<value>default</value>
		</item>
		<item>
			<descr><![CDATA[Maximum socket buffer size]]></descr>
			<tunable>kern.ipc.maxsockbuf</tunable>
			<value>default</value>
		</item>
	</sysctl>
	<system>
		<optimization>normal</optimization>
		<hostname>univnautes</hostname>
		<domain>entrouvert.lan</domain>
		<dnsserver/>
		<dnsallowoverride/>
		<group>
			<name>all</name>
			<description><![CDATA[All Users]]></description>
			<scope>system</scope>
			<gid>1998</gid>
			<member>0</member>
		</group>
		<group>
			<name>admins</name>
			<description><![CDATA[System Administrators]]></description>
			<scope>system</scope>
			<gid>1999</gid>
			<member>0</member>
			<priv>page-all</priv>
		</group>
		<user>
			<name>admin</name>
			<descr><![CDATA[System Administrator]]></descr>
			<scope>system</scope>
			<groupname>admins</groupname>
			<password>$1$dSJImFph$GvZ7.1UbuWu.Yb8etC0re.</password>
			<uid>0</uid>
			<priv>user-shell-access</priv>
		</user>
		<nextuid>2000</nextuid>
		<nextgid>2000</nextgid>
		<timezone>Europe/Paris</timezone>
		<time-update-interval>60</time-update-interval>
		<timeservers>0.pfsense.pool.ntp.org</timeservers>
		<webgui>
			<protocol>https</protocol>
			<ssl-certref>53a4644d846a4</ssl-certref>
			<noautocomplete/>
			<port>8443</port>
		</webgui>
		<disablenatreflection>yes</disablenatreflection>
		<!-- <disableconsolemenu/> -->
		<!-- <disablefirmwarecheck/> -->
		<!-- <shellcmd></shellcmd> -->
		<!-- <earlyshellcmd></earlyshellcmd> -->
		<!-- <harddiskstandby></harddiskstandby> -->
		<disablesegmentationoffloading/>
		<disablelargereceiveoffloading/>
		<ipv6allow/>
		<powerd_ac_mode>hadp</powerd_ac_mode>
		<powerd_battery_mode>hadp</powerd_battery_mode>
		<bogons>
			<interval>monthly</interval>
		</bogons>
		<kill_states/>
	</system>
	<ca>
		<refid>53a4638d45954</refid>
		<descr><![CDATA[entrouvert.lan CA]]></descr>
		<crt>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVjRENDQTFpZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1JsSXgKRmpBVUJnTlZCQWdURFVsc1pTMWtaUzFHY21GdVkyVXhEakFNQmdOVkJBY1RCVkJoY21sek1STXdFUVlEVlFRSwpFd3BGYm5SeWIzVjJaWEowTVNJd0lBWUpLb1pJaHZjTkFRa0JGaE5wYm1adlFHVnVkSEp2ZFhabGNuUXVZMjl0Ck1SWXdGQVlEVlFRREV3MWxiblJ5YjNWMlpYSjBMV05oTUI0WERURTBNRFl5TURFMk16Z3pOMW9YRFRNME1EWXgKTlRFMk16Z3pOMW93Z1lZeEN6QUpCZ05WQkFZVEFrWlNNUll3RkFZRFZRUUlFdzFKYkdVdFpHVXRSbkpoYm1ObApNUTR3REFZRFZRUUhFd1ZRWVhKcGN6RVRNQkVHQTFVRUNoTUtSVzUwY205MWRtVnlkREVpTUNBR0NTcUdTSWIzCkRRRUpBUllUYVc1bWIwQmxiblJ5YjNWMlpYSjBMbU52YlRFV01CUUdBMVVFQXhNTlpXNTBjbTkxZG1WeWRDMWoKWVRDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBS0dOZG1iS0lBVUttOUJNbFdQbAorNTRoTDhoRnpGLy9xQVVsQTlzd0hiYzBoK0ErVTIyaGpNU3hzZmxtMWF4Mk56UjNWYWNhRit4L0liLzVsa09JCkJMZjRrWnA0UFBqNkRxdEYrSTE0NHhGaTFnVVBMMDlBSlg3Y3BBNHQ0VXFLSkljLzRaZUVVMFdSNmZRdk5nSTgKZ24rN2ZERjY5ZTdTSkJVRGV0bnVUZDFRMElCUFRKYzNkQ08rMk1pZkhjNHZ4bXBLY2JEQ1BIMFQvV0FWdWZmdQpVSnBsZGp1MkdTNXZyWlM4TDlNRVRmUTNmM0ZyZEROcDJ5eENHS3JETjRjMGhQTHdPSjU4STJrc2U5L3VTM1NrClgzaWVjcmVKNk9peXNzVHZtZXV2NGtMbEVGN2R5N1ZZVzAyMjYrSjJoVlZ3VVYwL012V2lZbjFuWmE0Rk52SzkKSjdjQ0F3RUFBYU9CNWpDQjR6QWRCZ05WSFE0RUZnUVUrbW1MdUh5b3g3bEJSTDc5NDQzMXRVTDlBVFF3Z2JNRwpBMVVkSXdTQnF6Q0JxSUFVK21tTHVIeW94N2xCUkw3OTQ0MzF0VUw5QVRTaGdZeWtnWWt3Z1lZeEN6QUpCZ05WCkJBWVRBa1pTTVJZd0ZBWURWUVFJRXcxSmJHVXRaR1V0Um5KaGJtTmxNUTR3REFZRFZRUUhFd1ZRWVhKcGN6RVQKTUJFR0ExVUVDaE1LUlc1MGNtOTFkbVZ5ZERFaU1DQUdDU3FHU0liM0RRRUpBUllUYVc1bWIwQmxiblJ5YjNWMgpaWEowTG1OdmJURVdNQlFHQTFVRUF4TU5aVzUwY205MWRtVnlkQzFqWVlJQkFEQU1CZ05WSFJNRUJUQURBUUgvCk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQjgyd2g0L0NhSVJHNW9XL2FEL2FEVTNBR3E4SDlHZG9qeSt3dW0KS1lUZGNmSlRsZjI3TjYrci9GMzM4NWVrbHlWQnFnb29zbk1OUU0zOVBGQ3BCV1ExbHQ1Nmx4T2xOcTdBOUk4eApLbnI5TTdSRHE4R0k4NUJPYXNuUU93cXdzdU9BM3QxWHhWaWpTQlFLMlBVNU1BVzNXdkdjR1lvN21CdU1JWnJSCnRXa3RqczJqblpKa1hNalNiQ3VTdHhrMndOaFYwNDRkTzNkMys1QlZSZ3JTRzNJR2MrS2RMWThHZmt5R3Q2dmkKdVBFSHJsejdrUkFEeC9qNkpEZmxyMTdoc05UcDZUellTdEFYVlluWEo2SXJYclUxbjljcUhWMmF1OUdsTDBDdgp3RUVVOHkyTGZhckN2ckk4b3RyUVJNdmRmR0dwUFpFYjIrcFRENGJHNU5JV2ZmMEEKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</crt>
		<prv>LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRQ2hqWFpteWlBRkNwdlEKVEpWajVmdWVJUy9JUmN4Zi82Z0ZKUVBiTUIyM05JZmdQbE50b1l6RXNiSDVadFdzZGpjMGQxV25HaGZzZnlHLworWlpEaUFTMytKR2FlRHo0K2c2clJmaU5lT01SWXRZRkR5OVBRQ1YrM0tRT0xlRktpaVNIUCtHWGhGTkZrZW4wCkx6WUNQSUovdTN3eGV2WHUwaVFWQTNyWjdrM2RVTkNBVDB5WE4zUWp2dGpJbngzT0w4WnFTbkd3d2p4OUUvMWcKRmJuMzdsQ2FaWFk3dGhrdWI2MlV2Qy9UQkUzME4zOXhhM1F6YWRzc1FoaXF3emVITklUeThEaWVmQ05wTEh2Zgo3a3QwcEY5NG5uSzNpZWpvc3JMRTc1bnJyK0pDNVJCZTNjdTFXRnROdHV2aWRvVlZjRkZkUHpMMW9tSjlaMld1CkJUYnl2U2UzQWdNQkFBRUNnZ0VCQUl4ZXpqSWlEaEJUVjI5Mkc1ZmhqTytwQmt1TjJqYlBmTDU3bXc0b2tLbFAKQzREY3BzRHJUZFRhVVRuVEVIWDVnWjRrMGxlUFpKb3BITG9oczE2YUlQOTVDNHFjVHQ1RzU5Z0p4QjJvbkNQUApMUWJZV3RNUmVZTHhVOXErSXJNUnRRdVBoZ1NSQlltOWJ2cXN5dERHb3QwNW1uK2p4MnpyU2s2MzUxYlVxUE5TCmswMTlDYzJQT1VvVUxYWGprTUtveEhlTWhpSnFCSmZjZG03RVh3bjhqNWtvZGEveGJWUGxyTFpRN25zSHlrYmYKdGVsc25TNm02ODNDa29hT3duUUZCRE1YaEpXYVhqSUlDcEUyd2xXOUxyWXZ2N0VzbkkyRFo0ek43R3RTbjhFeQpsRWFtMWtJSEpoNlRXakhXRnJrV3lZMTQ3eXVmcEcxYVo0MVplMXhLVTRFQ2dZRUEwUXBIUVJYdzdFSWtZSVJJCkVnaG5LclU3dGRhL3UwVURWdG5WU3JPR0VJdWxiOXczbHVVdG9la0liVUVQYTY5WDhPNGtrMm4vRVFyR1U0M1AKYUg4TWVYRnlqbmRUQTh1UXc1ZDNHTjhSRlFQNEFnTkJNbWVaWFdmMW9EeFZBSWxiNUZnblJQZXZlRlpwL3d5ZwpWZUNGczh6b1ltelUwOUgweHVpSGV4M2QveFVDZ1lFQXhkZzIrNCtNajJSaVZJdFVwSFBpVThhSVBBbEVidkMwCmxseU9NNEFoRVd2S3JQOXZhblFMQkNMVVVxb3JQVVJUS2NUd0diUjNpOUZ1cldndml0UlZRSTNQYWpoSTVrMnEKYUsvQWFCMjkyb1JXZjg0eUVLak4vK2kyWkN3V0kzT3VWZGtoa3BITE80NzFmWWtvWFA0RzMwbjY1eG1hb1dLVwphMkRiSWMyQ1hwc0NnWUVBZ2xlR1ZtNzM2bGpUbGRybGxWam4reGxHUWZ2RlVWK1cxWEMrTGZZQ2dnNlErVTYyCjJyL0wxRWtabUFZWk4ydjl5Wnl6OGJjRjgvcGo3M1ZjL2lzNSsvOWhEclFZYnlWZS9wWlRESThLZDdBaDFCOXoKWjVweFpteU1HMzJEQXZLaStaNTkzZU1TNWxYN2dheTl6TTVTaitvVWZFcWY2ZlBnVEtadzA3T3IySUVDZ1lCVApiTmZLZmY2RVhJMEdIM2FDbmdiNjBvV1I0MHFEQ1diczNIeHVCUUpzcVNwZWhwdUJwUXNjSkYrcHQrM2h1TlRrCmtSRzVsUnF2ejVFKzkrYk1RTHJ1TEo0Z3FUazhPOVcyclIyU0NiQ0wyeS9xVnBWUDV3NXVjYit2UDlQYUFTYXIKTnBMc2ppUEhxb0dqL05rVFZWNnFlelNjakhSaXh3S3NwcnZnWmhzcUx3S0JnRUNQSzJCR3FBU3ZvYnI3S3lGNgpUS0VGVmNaQ1BwS1Jadm1qdDRpKzhTMU0vbFQvSzB0ck1VYXE4VDA1UElQWFB5WkRrS1c1SFk2bmNURmRsaE1aCmI5cXRWWmhQdlhLYzI5UVRndWd6L2k5NkE4UFVCc3hvd3M4SXd5NjNTNWR1R1ZlUEloS0x0bUtZa1VYS1V4WkkKenFsWVJqeitSak51dHJkalRtcVpoZjZBCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K</prv>
		<serial>2</serial>
	</ca>
        <ca>
                <refid>53d1166cc8bae</refid>
                <descr><![CDATA[TERENA SSL CA]]></descr>
                <crt>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tDQpNSUlFbURDQ0E0Q2dBd0lCQWdJUVM4Z1VBeThIK21xazhOb3AzMkY1dWpBTkJna3Foa2lHOXcwQkFRVUZBRENCDQpsekVMTUFrR0ExVUVCaE1DVlZNeEN6QUpCZ05WQkFnVEFsVlVNUmN3RlFZRFZRUUhFdzVUWVd4MElFeGhhMlVnDQpRMmwwZVRFZU1Cd0dBMVVFQ2hNVlZHaGxJRlZUUlZKVVVsVlRWQ0JPWlhSM2IzSnJNU0V3SHdZRFZRUUxFeGhvDQpkSFJ3T2k4dmQzZDNMblZ6WlhKMGNuVnpkQzVqYjIweEh6QWRCZ05WQkFNVEZsVlVUaTFWVTBWU1JtbHljM1F0DQpTR0Z5WkhkaGNtVXdIaGNOTURrd05URTRNREF3TURBd1doY05NakF3TlRNd01UQTBPRE00V2pBMk1Rc3dDUVlEDQpWUVFHRXdKT1RERVBNQTBHQTFVRUNoTUdWRVZTUlU1Qk1SWXdGQVlEVlFRREV3MVVSVkpGVGtFZ1UxTk1JRU5CDQpNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXcrTkl4Qzljd2N1cG1mMGJvb05kDQppajJ0T3REaXBFTWZUUTcrTlNVd3BXa2J4T2psd1k5VWZ1RnFvcHBjWE40OS9BTE9scmhmajROYnpHQkFrUGprDQp0am9sbkY4VVVleXg1NitlVUtFeFZjY0N2YXhTaW44MWpvTDZoSzBWL3FKL2d4QTZWVk9VTEFFV2RKUlVZeWlqDQo4bHNwUFpTSWdDRGlGRmtoR2JTa21PRmc1dkxyb29DRFErQ3RhUE41R1l0b1ExRS9pcHRCaFF3MWpGMjE4YmJsDQpwOE9EdFdzamI5U2w2MURsbFBGS1grNG5TeFFTRlNSTURjOWlqYmNBSWEwNk1nOVlDMThlbTlIZm5ZNnBHVFZRDQpMMEdwclR2RzRFV3lVemwvSWI4aUdvZGNOSzVTYndkOW9ndE9ueXQ1cG4wVDNmVi9nM3d2V2wxM2VIaVJvQlMvDQpmUUlEQVFBQm80SUJQakNDQVRvd0h3WURWUjBqQkJnd0ZvQVVvWEpmSmhzb21FT1ZYUWMzMVlXV25VdlN3MFV3DQpIUVlEVlIwT0JCWUVGQXk5azJnTTg5NnJvMGxyS3pkWFIrcVE0N250TUE0R0ExVWREd0VCL3dRRUF3SUJCakFTDQpCZ05WSFJNQkFmOEVDREFHQVFIL0FnRUFNQmdHQTFVZElBUVJNQTh3RFFZTEt3WUJCQUd5TVFFQ0FoMHdSQVlEDQpWUjBmQkQwd096QTVvRGVnTllZemFIUjBjRG92TDJOeWJDNTFjMlZ5ZEhKMWMzUXVZMjl0TDFWVVRpMVZVMFZTDQpSbWx5YzNRdFNHRnlaSGRoY21VdVkzSnNNSFFHQ0NzR0FRVUZCd0VCQkdnd1pqQTlCZ2dyQmdFRkJRY3dBb1l4DQphSFIwY0RvdkwyTnlkQzUxYzJWeWRISjFjM1F1WTI5dEwxVlVUa0ZrWkZSeWRYTjBVMlZ5ZG1WeVgwTkJMbU55DQpkREFsQmdnckJnRUZCUWN3QVlZWmFIUjBjRG92TDI5amMzQXVkWE5sY25SeWRYTjBMbU52YlRBTkJna3Foa2lHDQo5dzBCQVFVRkFBT0NBUUVBVGlQdVNKejJoWXR4eEFwdWM1Tnl3RHFPZ0lyWnM4cXkxQUdjS00veVhBNGhSSk1MDQp0aG9oNDVnQmxBNW5TWUVldmowTlRtRGE3NkF4VHBYdjg5MTZXb0lnUTdhaFkwT3pVR2xEWWt0V1lyQTBpcmtUDQpRMW1UN0JSNWlQTklrK2lkeWZxSGNneHJWcURERlkxb3BZY2ZjUzNtV20wOGFYRkFCRlhjb0VPVUlFVTRlTmU5DQppdGc1eHQ4SnQxcWFxUU80S0JCNHpiOEJHMW9SUGpqMDJCczBlYzh6MGdIOXJKak5iVWNSa0V5N3VWdlljT2ZWDQpyN2JNeElibWRjQ2VLYllyRHlxbGFRSU40K21pdEYzQTg4NHNhb1U0ZG1IR1NZS3JVYk9DcHJsQm1DaVkrMnYrDQppaGIvTVg1VVI2ZzgzRU1tcVpzRnQ1N0FORU9STU5ReXd4RmE0UT09DQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tDQo=</crt>
        </ca>
        <cert>
                <refid>53d2d0c56713c</refid>
                <descr><![CDATA[univnautes.entrouvert.lan-saml]]></descr>
                <crt>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tDQpNSUlESXpDQ0FndWdBd0lCQWdJSkFOVUJvaWNrMXBEcE1BMEdDU3FHU0liM0RRRUJCUVVBTUJVeEV6QVJCZ05WDQpCQW9UQ2tWdWRISnZkWFpsY25Rd0hoY05NVEF4TWpFME1UVXpNekF5V2hjTk1URXdNVEV6TVRVek16QXlXakFWDQpNUk13RVFZRFZRUUtFd3BGYm5SeWIzVjJaWEowTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCDQpDZ0tDQVFFQXZ4RmtmUGRuZGxHZ1FQRFpnRkdYYnJOQWMvNzlQVUxaQnVOZFdGSEREOVA1aE5oWm45S3FtNENwDQowNlBlL0E2dStnNXdMbll2YlpRY0ZDZ2ZRQUV6emlKdGIzSjU1T09sQjdpTUVJL1QyQVgyV3pyVUg4UVQ4TkdoDQpBQk9OS1UyR2c0WGl5ZVhOaEg1Ujd6ZEhsVXdjV3EzWndOYnRiWTBUVmMrbjY2NUVicmZWLzU5eGloU3Fzb0ZyDQprbUJMSDBDb2VwVVh0QXpBN1dEWW44QXp1c0l1TXgzbjg4NDRwSndneGhUQjdHanVib3B0bHo5SHJpOEpSZFhpDQpWVDlPUzlXdDY5dWJjTm9NNnp1S0FTbXRtNDhVdUduaGo4djZYd3Ziaktackw5a0EreGY4emlhelpmdnZ3L1ZHDQpUbStJVkZZQjdkMXg0NTdqWTV6ampYSnZOeXNvb3dJREFRQUJvM1l3ZERBZEJnTlZIUTRFRmdRVWVGOGVQbnUwDQpmY0FLNTBpQlFEZ0FoSGtPdThrd1JRWURWUjBqQkQ0d1BJQVVlRjhlUG51MGZjQUs1MGlCUURnQWhIa091OG1oDQpHYVFYTUJVeEV6QVJCZ05WQkFvVENrVnVkSEp2ZFhabGNuU0NDUURWQWFJbkpOYVE2VEFNQmdOVkhSTUVCVEFEDQpBUUgvTUEwR0NTcUdTSWIzRFFFQkJRVUFBNElCQVFBeThsM0doVXRwUEh4MEZ4emJSSFZhYVVTZ013WUtHUGhFDQpJZEdocWVrS1VKSXg4ZXQ0eHBFTUZCbDVYUWpCTnEvbXA1dk8zU1BiMmgyUFZTa3M3eFduRzNjdkVrcUpTT2VvDQpmRUVoa3FuTTQ1YjJNSDFTNXV4cDRpOFVpbFBHNmttUWlYVTJyRVVCZFJrOXhuUldvczdlcFZpdlRTSXYxTmNwDQpsRzZsNDFTWHA2WWdJYjJUb1Qrck9LZElHSVF1R0RsemVSODhmRHhXRVUwdkV1alp2L3YxUEUxWU9WMHhLalRUDQpKdW1sQmM2SVZpS2hKZW8xd2lCQnJWUklJa0tLZXZIS1F6dGVLOHBXbTlDWVdjdWx4VDI2VFo0Vld6R2JvMDZqDQpvMnpidW1pcnJMTHFudDFnbUJEdkR2bE93Qy96QUF5TDRjaGJ6NjZlUUhUaUlZWlp2WWd5DQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t</crt>
                <prv>LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQ0KTUlJRXBBSUJBQUtDQVFFQXZ4RmtmUGRuZGxHZ1FQRFpnRkdYYnJOQWMvNzlQVUxaQnVOZFdGSEREOVA1aE5oWg0KbjlLcW00Q3AwNlBlL0E2dStnNXdMbll2YlpRY0ZDZ2ZRQUV6emlKdGIzSjU1T09sQjdpTUVJL1QyQVgyV3pyVQ0KSDhRVDhOR2hBQk9OS1UyR2c0WGl5ZVhOaEg1Ujd6ZEhsVXdjV3EzWndOYnRiWTBUVmMrbjY2NUVicmZWLzU5eA0KaWhTcXNvRnJrbUJMSDBDb2VwVVh0QXpBN1dEWW44QXp1c0l1TXgzbjg4NDRwSndneGhUQjdHanVib3B0bHo5SA0Kcmk4SlJkWGlWVDlPUzlXdDY5dWJjTm9NNnp1S0FTbXRtNDhVdUduaGo4djZYd3Ziaktackw5a0EreGY4emlheg0KWmZ2dncvVkdUbStJVkZZQjdkMXg0NTdqWTV6ampYSnZOeXNvb3dJREFRQUJBb0lCQVFDajh0MmlLWHlhMTBIRw0KVjZTYWFlaWg4YWZ0b0xCVjM4VndGcXFqUFUwK2lLcURwazJKU1hCaGpJNnM3dUZJc2FUTkpwUjJHYTFxdm5zMQ0KaEpRRURNUVNMaEp2WGZCZ1NrSHlsUldDcEplbnRyNEUzRDdtbnc1cFJzZDYxRXY5VSt1SGNkdi9XSFA0SzVoTQ0KeHNkaXdYTlhEL1JZZDFRMSs2YktyQ3V2bk5KVm1XZTAvUlYrcjNUOE5pNXhkTVZGYlJXdC9WRW9FNjIwWFg2Yw0KYTlUUVBpQTVpL0xSVnlpZStqczdZditoVmpHT2xBcnR1THM2RUNRc2l2ZlBycUtMT0JSV2NvZktkY2YrNE4yZQ0KM2NpZVVxd3pDMTVDMzF2Y01saUQ5SGF4OWMxaXVUdDlRM1h6bzIwZk9TYXpBblE1WUJFRXh5VHRyRkJ3YmZRdQ0Ka3U2aHA4MXBBb0dCQU42YmM2aUp0azVpcFlwc2FZNFpsYnFkampHOUtFWEI2RzFNRXhQVTdTSFhPaE9GMGNESA0KL3BnTXN2OWhGMm15ODYzTW93c09qM09yeVZoZFFod0E2UnJWMjYzTFJoK0pVOE55SFY3MUJ3QUlmSTBCdVZmag0KNnIyNEt1ZHd0VWN2TXI5cEpJckp5TUFNYXc1WnlOb1g3WXFGcFM2ZmNpc1NKWWRTQlNveHpyelZBb0dCQU51Ng0KeFZlTXFHYXZBL0VIU09RUDNpcERaM21uV2JrRFVEeHBOaGdKRzhRNmxaaXdLd0xvU2NlSjh6MFBOWTNWZXRHQQ0KUmJxdHFCR2ZSMm1jeEh5emVxVkJwTG5YWkM0dnMvVnk3bHJ6VGlIRFJaazJTRzVFa0hNU0tGQTUzak42Uy9uSg0KSldwWVpDOGxHOHc0T0hhVWZESEZXYnB0eGRHWUNnWTQvL3NqZWl1WEFvR0JBTnVodXJKOTlSNVBuQThBT2dFVw0KNHpEMWhMYzBiNGlyOGZ2c2hDSWNBajlTVUIyMCthZmdheVJ2MnllM0R0ZWQxV2tVTDRXWVB4Y2NWaExXS0lUaQ0KclJ0cUIwM284bTNwRzNrSm5VcjBMSXp1MHB4NUovbzhpSDNaT0pPVEUzaUJhK3VJL0tIbXh5Z2MySCtYUEdGYQ0KSEdlQXh1SkNOTzJrQU4wTG9zYm56NWRsQW9HQVZzQ245NGdHV1B4U2p4QTBQQzd6cFRZVm5aZHdPamJQci9wTw0KTERFMGNFWTlHQnE5OEpqcndFZDc3S2libVZNbStaNHVhYVQwalhpWWhsOHB5SjVJRndVUzEzanVDYm8xei91Lw0KbGRNb0R2WjgvUi9NZXhUQS8xMjA0dS9tQmVjTUppTy9qUHczR2RJSjVwaHYyb21IZTFNU3VTTnNEZk44U2JhcA0KZ21zZ2FpTUNnWUIvbnJUazg5RnA3MDUwVktDTm5JdDFtSEFjTzljQndEVjhxcko1TzNySVZtcmcxVDZ2bjBhWQ0Kd1JpVmNOYWNhUCtCaXZrck1qcjRCbHNVTTZ5SDRNT0JzTmhMVVJpaUNMK3RMSlY3VTBEV2xDc2UvZG9XaWo0VQ0KVEtYNnRwNm9JKzdNSUpFNnlTWjBjQnFPaXlkQWtCZVBaaHU1N2o2VG9Ca1RhMGRiSGpuMVdBPT0NCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0t</prv>
        </cert>
        <cert>
                <refid>53d115fac567b</refid>
                <descr><![CDATA[metadata-renater]]></descr>
                <crt>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tDQpNSUlDWlRDQ0FjNmdBd0lCQWdJRVNjbitxVEFOQmdrcWhraUc5dzBCQVFVRkFEQjNNUXN3Q1FZRFZRUUdFd0pHDQpVakVRTUE0R0ExVUVDaE1IVWtWT1FWUkZVakZXTUZRR0ExVUVBeE5OUTJWeWRHbG1hV05oZENCa1pTQnphV2R1DQpZWFIxY21VZ1pHVnpJRzFsZEdFZ1pHOXVibVZsY3lCa1pTQnNZU0JtWldSbGNtRjBhVzl1SUVWa2RXTmhkR2x2DQpiaTFTWldOb1pYSmphR1V3SGhjTk1Ea3dNekkxTURrMU1UTTNXaGNOTVRrd016SXpNRGsxTVRNM1dqQjNNUXN3DQpDUVlEVlFRR0V3SkdVakVRTUE0R0ExVUVDaE1IVWtWT1FWUkZVakZXTUZRR0ExVUVBeE5OUTJWeWRHbG1hV05oDQpkQ0JrWlNCemFXZHVZWFIxY21VZ1pHVnpJRzFsZEdFZ1pHOXVibVZsY3lCa1pTQnNZU0JtWldSbGNtRjBhVzl1DQpJRVZrZFdOaGRHbHZiaTFTWldOb1pYSmphR1V3Z1o4d0RRWUpLb1pJaHZjTkFRRUJCUUFEZ1kwQU1JR0pBb0dCDQpBSkJYY0xJZ3Vva0dpeXRZU09yZ21VNmZOKzFEWEs0ZWFxdXZGR01hc3d1aGNSUEQ0dFh0U3M4Q0d4UFA4L1ZGDQpNcGNyeTA0bGZQQTNtcHdEaXM0N2hzdm1McUdKVm1mU3V2a0RzUHgrSTMyNWg0V3FHekVWOGtmdHRrSlNpOEQwDQpRTEtrOXdzZUErQkh6b0JwVTZlNXVXbUdxZldKZ2JabGNVdVlLQ0lFMm5ML0FnTUJBQUV3RFFZSktvWklodmNODQpBUUVGQlFBRGdZRUFUMHJVUzVHVHRxVzlhMHBBdjBQamllU1M2YlczS0czTXRuMGpDMWRtYXY2WDlmYmhobUZMDQoxWFNDOVduQ1UyVUQzOTg2RVdXWUtoTjJJTkhnaEhFL2ZRR3ZlVndkY1ZTU3Q2MDFPcEFzVUYxOHR4MHZIcWtmDQpTaGNqN210ZXE1OUd2NGhPRThVMVVyZC9wU1JhSU8zRzQyWDYvTC9BbFhlRGtpY2ZHWkhocTdRPQ0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ0K</crt>
                <prv>ZW1wdHk=</prv>
        </cert>
        <cert>
                <refid>53d11784a0379</refid>
                <descr><![CDATA[metadata-edugain]]></descr>
                <crt>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tDQpNSUlDMURDQ0Fid0NDUURERFp5R3RuNks4VEFOQmdrcWhraUc5dzBCQVFVRkFEQXNNUTR3REFZRFZRUUtFd1ZIDQpSVUZPVkRFYU1CZ0dBMVVFQXhNUlpXUjFSMEZKVGlCVGFXZHVaWElnUTBFd0hoY05NVFF3TnpBeU1UUXpORFE1DQpXaGNOTVRrd056QXhNVFF6TkRRNVdqQXNNUTR3REFZRFZRUUtFd1ZIUlVGT1ZERWFNQmdHQTFVRUF4TVJaV1IxDQpSMEZKVGlCVGFXZHVaWElnUTBFd2dnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUUNSDQpmbDF6aGthRnZlSnZKdFMwM2JSSU8zazc3cTJzNW0rYzZzUTgzajcxcklhZCt2R0NPMjlTNEpIQlhISS9VNTd5DQpOYk5MZ29LemwwTUk0V1FyczRLVC95K0xQTUZCOU0wbE5yQUxRZC9vcDZQTmM3Q1dLTU4xeVY4Vi9MNzQvdmFwDQpSbGI5MGdQVkpBQkhtb0FmUW1qeU1YTFczOEtMd3pLMXFFcEtVSXhQQmZRTUJhd21oMGdDMlQ1bmRabmRjTVBwDQpnc01YeUcyQVo0UUdTT3Q0dGdwc3BqVFNSWSsrWCtnaTlXVXVXenNFSEhkRmhDUjlVWVE2KzFnbE1WaGVKalZtDQpvRDBiOVYvS1EwQkYvMXpyeTJqZldsY2hGZUlMbFdiV2dpV3NJQkE0QlBOSHFGVzQycUdnVXI5REkzRnpSTEhYDQpxRjJOMmY1OTJ0emNUZURaMTFlakFnTUJBQUV3RFFZSktvWklodmNOQVFFRkJRQURnZ0VCQUNxMEVSMTdtb1FCDQovMzlTc3Ric1dkcEdRTUlzckhaK0VSRjdqWWRqbkUvNjN4QmZNSVZGUW8yRzFQVzBjWjFja3BMSVFNeUt5VEF2DQo5UkFWeHYzV1ZuUTlJR2g3MTVqUC9RSEg3eWNUTTdvRTVYZHBOek5NUkRNZXZydFRhMVQvR1g2RzYrY2M3M0pHDQpWb0o5SlFOWGJMdjVic3B5Rzlra0l1OVZRcVVxbHJVV1RqekJCeXNBWWo0a1IxZ29yclVtSTdsMkdCcnJjR2VqDQpRNTdWWGRVeGFDS3pRaXRhMGFTU3piSFErMkJ4Y3ZZVjFyNFFXbTZKdjhIVG4zYzRCMWQ2UWJhU0VnR0hTQ2twDQpDeHdPcTgyZ3QxT00vaE96N3d6a0lRb2hhWUVvM2tvTmxHc2F0NUhjMjRWZmZjb3NSbU5GWW1HVStkQ253SERPDQpZdXhDRndMSEFjZz0NCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0NCg==</crt>
                <prv>ZW1wdHk=</prv>
        </cert>
	<cert>
		<refid>53a4644d846a4</refid>
		<descr><![CDATA[wildcard.entrouvert.lan CERT]]></descr>
		<caref>53a4638d45954</caref>
		<crt>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZhekNDQkZPZ0F3SUJBZ0lCQWpBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1JsSXgKRmpBVUJnTlZCQWdURFVsc1pTMWtaUzFHY21GdVkyVXhEakFNQmdOVkJBY1RCVkJoY21sek1STXdFUVlEVlFRSwpFd3BGYm5SeWIzVjJaWEowTVNJd0lBWUpLb1pJaHZjTkFRa0JGaE5wYm1adlFHVnVkSEp2ZFhabGNuUXVZMjl0Ck1SWXdGQVlEVlFRREV3MWxiblJ5YjNWMlpYSjBMV05oTUI0WERURTBNRFl5TURFMk5ERTFNRm9YRFRNME1EWXgKTlRFMk5ERTFNRm93Z2dFWE1Rc3dDUVlEVlFRR0V3SkdVakVXTUJRR0ExVUVDQk1OU1d4bExXUmxMVVp5WVc1agpaVEVPTUF3R0ExVUVCeE1GVUdGeWFYTXhFekFSQmdOVkJBb1RDa1Z1ZEhKdmRYWmxjblF4SWpBZ0Jna3Foa2lHCjl3MEJDUUVXRTJsdVptOUFaVzUwY205MWRtVnlkQzVqYjIweEdUQVhCZ05WQkFNVUVDb3VaVzUwY205MWRtVnkKZEM1c1lXNHhnWXN3Z1lnR0ExVWRFUk9CZ0VsUU9qRXdMalF5TGpBdU1TeEVUbE02ZFc1cGRtNWhkWFJsY3k1bApiblJ5YjNWMlpYSjBMbXhoYml4RVRsTTZjM0F1ZFc1cGRtNWhkWFJsY3k1bGJuUnliM1YyWlhKMExteGhiaXhFClRsTTZhV1J3TG5WdWFYWnVZWFYwWlhNdVpXNTBjbTkxZG1WeWRDNXNZVzRzUkU1VE9tVnVkSEp2ZFhabGNuUXUKYkdGdU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBeTErTk1WbWJHcXpLbmtXcgo1ciswdUh2S0JvTzh3Mzh5WnVpSVpyYWlKSDJNUFRqSGorUXJoNjF1UFRPZ2dBVTMrU05UVE1YR3FtYTlwMHFVClBJcTBxL2lha0ZlaEtuZTA0ZEExNWUvYVdua3hiY1NBSld5a2pZOE9DK2JaSTduamVwZkg5bDVUNk8wczRaNEMKRVFMTlBXN085d1VENVQzaFdPSTJ2SE9WNXhQVWlZMmhUY3JVcW9YRFU5NXV0Mi9SaFFNWUplcXhobWxqQzNkWQoyN2VPTTgvWkZiNEZMaERYQWlseTl2TGVUcUJkS016OVc0azlvbjRTYkR0U1Q5ZXloZkg5eDZkbWtEeE9la3dZClBLa01DN3NaUVRFTGlybGtsWW42R3pVbTBPNFlkZUIrQWw0OUxVcXFkV2Z5Z2Q3ZmxvU2dLNTNzenRyNHlZNGQKSEtvVlpRSURBUUFCbzRJQlRqQ0NBVW93Q1FZRFZSMFRCQUl3QURBUkJnbGdoa2dCaHZoQ0FRRUVCQU1DQmtBdwpNd1lKWUlaSUFZYjRRZ0VOQkNZV0pFOXdaVzVUVTB3Z1IyVnVaWEpoZEdWa0lGTmxjblpsY2lCRFpYSjBhV1pwClkyRjBaVEFkQmdOVkhRNEVGZ1FVYUFsUjJ0OGhwUE9HRUdJZE0xMTl3b1c5c2pvd2diTUdBMVVkSXdTQnF6Q0IKcUlBVSttbUx1SHlveDdsQlJMNzk0NDMxdFVMOUFUU2hnWXlrZ1lrd2dZWXhDekFKQmdOVkJBWVRBa1pTTVJZdwpGQVlEVlFRSUV3MUpiR1V0WkdVdFJuSmhibU5sTVE0d0RBWURWUVFIRXdWUVlYSnBjekVUTUJFR0ExVUVDaE1LClJXNTBjbTkxZG1WeWRERWlNQ0FHQ1NxR1NJYjNEUUVKQVJZVGFXNW1iMEJsYm5SeWIzVjJaWEowTG1OdmJURVcKTUJRR0ExVUVBeE1OWlc1MGNtOTFkbVZ5ZEMxallZSUJBREFUQmdOVkhTVUVEREFLQmdnckJnRUZCUWNEQVRBTApCZ05WSFE4RUJBTUNCYUF3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUphRW5ISEIwUzlpUi9ETWxPM3plMnBMClhnaE1Pbml1V2hRR1orbEQ5b1lVMDBMN1orOFJoS3J4bytqbk1Ob2FXZGc5cFlNcXEza1laOU04b2dzQmpPeUcKUUg3U3BZdkR2eStLVjBVN2hmZjNxQ2w2cmI4Z2tkcnRYNng3YnIyeHdxZU14SnI1SVJXMlN6K2NuNmljMUN2RApWQUtqWmx1L0k4UkR6WCtlVGtxUVNnYUUwY2xQUm10WEtpZTR2QkVsd1JpcXJxb0hJaXBuSFdlenZLSnhzS3BnCkVIRU1ZNkhzcFZkWUdPMUxKYXF6VTNhQ1pNYVhQWjl0enp2OFFOV3ZORGFxanJraENVZXQrU2o3NnFzSDZqdGsKamMxRFZZRE8vUDQ1VzJwbFJMTFd3bXRQTUV6TjA3cmNmbkVhTzJTQlphZ0dsM21YTGhzM0pPSEo5ZVlucjZRPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==</crt>
		<prv>LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRRExYNDB4V1pzYXJNcWUKUmF2bXY3UzRlOG9HZzd6RGZ6Sm02SWhtdHFJa2ZZdzlPTWVQNUN1SHJXNDlNNkNBQlRmNUkxTk14Y2FxWnIybgpTcFE4aXJTcitKcVFWNkVxZDdUaDBEWGw3OXBhZVRGdHhJQWxiS1NOanc0TDV0a2p1ZU42bDhmMlhsUG83U3poCm5nSVJBczA5YnM3M0JRUGxQZUZZNGphOGM1WG5FOVNKamFGTnl0U3FoY05UM202M2I5R0ZBeGdsNnJHR2FXTUwKZDFqYnQ0NHp6OWtWdmdVdUVOY0NLWEwyOHQ1T29GMG96UDFiaVQyaWZoSnNPMUpQMTdLRjhmM0hwMmFRUEU1NgpUQmc4cVF3THV4bEJNUXVLdVdTVmlmb2JOU2JRN2hoMTRINENYajB0U3FwMVovS0IzdCtXaEtBcm5lek8ydmpKCmpoMGNxaFZsQWdNQkFBRUNnZ0VCQUo4bjcvOG0rTk12Vm9IMlZFa0l6ZzF5RXZCMk9FdG1SN054VnczSzc2bE8KOTJrUi9sc0ZYV3VZdGlUL09pUDE4WS92clVqdm5rSE1sYTlPRmlRckNLbHNyTWs1U3M5SlR5MUpIR1VPQi91MQp6SkR5cnJhYkIwd2hJQVVBYS80aGczeDFPKy82Y2dCZlhEaFV4NWs0Y0JZYm1heUhLRDFHNkF2L1BJYk9qZ2wvCmZpZE9Ob2lHeFZ1NHNXbitaQzdxMllBUFpmQk92TE9iVjZGWE41ZmNEMXBlTkpOVnlWN215RGh4TFVETUMzSlIKTVlKTThWY3M5bzBreERBQ0ZLbllPeHdteGRCam1iM3o5Lzk3ZytZWXI5dTMveUlhNjVlRldJMXkvYUVMWSs5cgoveUsvYm0zRTZ3K3Z0SjBpRkt1RVNYbXpzZTVTZHc0L3FGKy9EeVhobmlFQ2dZRUE2T0xqN0QwOUwxZkEwMU85Ck8wKzdYREtrTG54emxLc25HQWhCUVFzVlo1SmlRWWpmYnRJTVo2NEg4T0tmaVpzcEc3eFkwMmV3a29HK0w2R0EKYWhQdmhLdm1KMlBvZDlzdGEycjRQeXgrUUJaQ2ZTNi9tYVYrRXZRQytCZ1RnZGFrYXhUK3p2U3ViMHJneDNSOQpSdUY2d3ppZVNKNUJVTXZXbWh0Y05jbmpUcjhDZ1lFQTM0N05WanZrYlYzMXRUK0FjanNHeTNCdlFURm9nMFRNCkhyU05ZTnFqVUJaUnc5M01iMXp2V3dIbnZTc0FBMG9HSEdQTDMvcWtwalN5M0pRbkR0UDdLV1hCdHd3MWp0TUUKb29ONGFIMFR1Z0g0YW0xRzJZRlJtYWM0U2FzOHhkMzZEN0liOEJOaFZiOTF1WklTMzA5SklkanhROXNnU1VVNgp6WnplRjlyd1NOc0NnWUFrU0FTK0x5UXpGZmJDZFk5TGlEWm1QTFY3VUlRcEt5amlBNWMyN09VZXg1MXJIRW5DCjJCSjZySkFzSlFJNXkrUnhuN3d1NHo2TTlJMk9taGlKYmlXb2c2ZE5oN0VWeXgyZVdJSG9SYVE5azdvMENtNXIKSDI4dXdMa2RzWktJYmNvYnJKK3Qya3k2cGUyeTVTRUhRK1YrT0huZ1VsZFdvUXNENHpOUVplMTF2UUtCZ0FVYgpSUE40VU1KeXgvOEk0VTA2cmZBTnRHemZ6UXhha1BNT21zQWdubVJnN2lNME9NdythalZBK09Nb1RVckY4UmZLCjY4aEUrR2ZYZ2xKcGkrN1p4cjN1Vmh0eFN2UGxQQkRlUWV6WkZvOUVKa0dBRjRNMllmL0pndzZqdTdLbFhHWHAKWXB2OFJWZnBGSzVWZU5yaSs3K3JMZStuM0xmdnZlVWVkVEJFVHdMTEFvR0FaZWtxbWtBQWhqbmI2RHg2Y2ZjSApsMTZwMVRDUG5rVGVuZnFjVTZrMENEVnd3R1c4OHpURW9BQnp4MDUxN2RyWnh2SUlIOWRNWmYxQTUrYWpKV3hSCjhldThrTHcxRG9PekJlRVQ4WnM5dDYzNnpQeGZRV2FRK2xqZFdIOHA0dW1xWDlMTUhXNVNHcmRBWnEwU3REbWwKT1BGNmtlb2RxT2hPalJHZjdUTlRXNE09Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K</prv>
		<type>server</type>
	</cert>
	<interfaces>
		<wan>
			<enable/>
			<if>vr1</if>
			<mtu></mtu>
			<ipaddr>dhcp</ipaddr>
			<ipaddrv6></ipaddrv6>
			<!-- *or* ipv4-address *or* 'pppoe' *or* 'pptp' *or* 'bigpond' -->
			<subnet></subnet>
			<gateway></gateway>
			<blockpriv/>
			<blockbogons/>
			<dhcphostname></dhcphostname>
			<media></media>
			<mediaopt></mediaopt>
			<dhcp6-duid></dhcp6-duid>
			<dhcp6-ia-pd-len>0</dhcp6-ia-pd-len>
			<!--
			<wireless>
				*see below (opt[n])*
			</wireless>
			-->
		</wan>
		<lan>
			<enable/>
			<if>vr0</if>
			<ipaddr>10.42.0.1</ipaddr>
			<subnet>16</subnet>
			<ipaddrv6></ipaddrv6>
			<subnetv6></subnetv6>
			<media></media>
			<mediaopt></mediaopt>
			<track6-interface>wan</track6-interface>
			<track6-prefix-id>0</track6-prefix-id>
			<!--
			<wireless>
				*see below (opt[n])*
			</wireless>
			-->
		</lan>
		<!--
		<opt[n]>
			<enable/>
			<descr></descr>
			<if></if>
			<ipaddr></ipaddr>
			<subnet></subnet>
			<media></media>
			<mediaopt></mediaopt>
			<bridge>lan|wan|opt[n]</bridge>
			<wireless>
				<mode>hostap *or* bss *or* ibss</mode>
				<ssid></ssid>
				<channel></channel>
				<wep>
					<enable/>
					<key>
						<txkey/>
						<value></value>
					</key>
				</wep>
			</wireless>
		</opt[n]>
		-->
	</interfaces>
	<!--
	<vlans>
		<vlan>
			<tag></tag>
			<if></if>
			<descr></descr>
		</vlan>
	</vlans>
	-->
	<staticroutes>
		<!--
		<route>
			<interface>lan|opt[n]|pptp</interface>
			<network>xxx.xxx.xxx.xxx/xx</network>
			<gateway>xxx.xxx.xxx.xxx</gateway>
			<descr></descr>
		</route>
		-->
	</staticroutes>
	<dhcpd>
		<lan>
			<enable/>
			<range>
				<from>10.42.1.1</from>
				<to>10.42.254.254</to>
			</range>
			<defaultleasetime>600</defaultleasetime>
			<maxleasetime>1800</maxleasetime>
			<domain>entrouvert.lan</domain>
			<!--
			<winsserver>xxx.xxx.xxx.xxx</winsserver>
			<gateway>xxx.xxx.xxx.xxx</gateway>
			<dnsserver></dnsserver>
			<ntpserver>xxx.xxx.xxx.xxx</ntpserver>
			<next-server></next-server>
			<filename></filename>
			-->
		</lan>
		<!--
		<opt[n]>
			...
		</opt[n]>
		-->
		<!--
		<staticmap>
			<mac>xx:xx:xx:xx:xx:xx</mac>
			<ipaddr>xxx.xxx.xxx.xxx</ipaddr>
			<descr></descr>
		</staticmap>
		-->
	</dhcpd>
	<pptpd>
		<mode><!-- off *or* server *or* redir --></mode>
		<redir/>
		<localip/>
		<remoteip/>
		<!-- <accounting/> -->
		<!--
		<user>
			<name></name>
			<password></password>
		</user>
		-->
	</pptpd>
	<dnsmasq>
		<enable/>
		<hosts>
			<host>univnautes</host>
			<domain>entrouvert.lan</domain>
			<ip>10.42.0.1</ip>
			<descr><![CDATA[captive portal]]></descr>
		</hosts>
	</dnsmasq>
	<snmpd>
		<enable/>
		<syslocation>univnautes hotspot</syslocation>
		<syscontact/>
		<rocommunity>edustop</rocommunity>
		<modules>
			<mibii/>
			<netgraph/>
			<pf/>
			<hostres/>
			<ucd/>
			<regex/>
		</modules>
		<pollport>161</pollport>
		<trapserver/>
		<trapserverport/>
		<trapstring/>
		<bindip/>
	</snmpd>
	<diag>
		<ipv6nat>
			<!-- <enable/> -->
			<ipaddr/>
		</ipv6nat>
	</diag>
	<bridge>
		<!-- <filteringbridge/> -->
	</bridge>
	<syslog>
		<!--
		<reverse/>
		<enable/>
		<remoteserver>xxx.xxx.xxx.xxx</remoteserver>
		<filter/>
		<dhcp/>
		<system/>
		<nologdefaultblock/>
		-->
	</syslog>
	<captiveportal>
		<univnautes>
			<enable/>
			<zone>univnautes</zone>
			<auth_method>saml</auth_method>
			<descr/>
			<localauth_priv/>
			<zoneid>8000</zoneid>
			<interface>lan</interface>
			<maxproc/>
			<timeout>180</timeout>
			<idletimeout>30</idletimeout>
			<freelogins_count/>
			<freelogins_resettimeout/>
			<reauthenticateacct/>
			<httpslogin/>
			<httpsname>univnautes.entrouvert.lan</httpsname>
			<certref>53a4644d846a4</certref>
			<preauthurl/>
			<bwdefaultdn/>
			<bwdefaultup/>
			<noconcurrentlogins/>
			<radius_protocol/>
			<redirurl/>
			<radiusip/>
			<radiusip2/>
			<radiusip3/>
			<radiusip4/>
			<radiusport/>
			<radiusport2/>
			<radiusport3/>
			<radiusport4/>
			<radiusacctport/>
			<radiuskey/>
			<radiuskey2/>
			<radiuskey3/>
			<radiuskey4/>
			<radiusvendor>default</radiusvendor>
			<radiussrcip_attribute>wan</radiussrcip_attribute>
			<radmac_format>default</radmac_format>
			<radiusnasid/>
			<page/>
		</univnautes>
	</captiveportal>
	<univnautes>
		<federations>
			<federation>
				<enable/>
				<codename>renater_test</codename>
                                <refid>fed_53d1161955a26</refid>
                                <descr><![CDATA[Renater TEST Federation]]></descr>
                                <url>https://federation.renater.fr/test/renater-test-metadata.xml</url>
                                <certref>53d115fac567b</certref>
                        </federation>
                        <federation>
				<codename>renater</codename>
                                <refid>fed_53d116d1a836d</refid>
                                <descr><![CDATA[Renater Federation]]></descr>
                                <url>https://federation.renater.fr/renater/renater-metadata.xml</url>
                                <certref>53d115fac567b</certref>
                        </federation>
			<federation>
				<codename>edugain</codename>
                                <refid>fed_53d11720e49c8</refid>
                                <descr><![CDATA[GEANT eduGAIN]]></descr>
                                <url>http://mds.edugain.org/feed-sha256.xml</url>
                                <certref>53d11784a0379</certref>
			</federation>
			<federation>
                                <refid>fed_5450f27f906ec</refid>
                                <codename>local</codename>
                                <descr><![CDATA[example of local federation]]></descr>
                                <url/>
                                <metadata>[encoded data, 4996 characters]</metadata>
                                <certref>__none__</certref>
                        </federation>
		</federations>
		<sp>
			<certref>53d2d0c56713c</certref>
			<defaultidps>aHR0cHM6Ly90ZXN0LmZlZGVyYXRpb24ucmVuYXRlci5mci9pZHAvc2hpYmJvbGV0aA==</defaultidps>
			<geolocations>aHR0cHM6Ly9zdGF0aWMuZGlzY29qdWljZS5vcmcvZmVlZHMvcmVuYXRlcg0KI2h0dHBzOi8vc3RhdGljLmRpc2NvanVpY2Uub3JnL2ZlZWRzL2VkdWdhaW4=</geolocations>
			<geoinitialbounds>[[41.1,-5.53],[51.5,9.91]]</geoinitialbounds>
			<tilesurl/>
			<redirect_url>next_url</redirect_url>
			<redirect_delay>5</redirect_delay>
		</sp>
                <whitelists>
                        <whitelist>
                                <refid>whitelist_53d12b4ba06c2</refid>
                                <codename>eduspot</codename>
                                <descr><![CDATA[Whitelist eduspot]]></descr>
                                <url>https://www.cru.fr/eduspot/whitelist-eduspot.txt</url>
                                <caref>__none__</caref>
                        </whitelist>
		</whitelists>
                <blacklists>
			<!-- empty blacklists, just commented examples -->
			<macaddresses>IyBPbmUgTUFDIHBlciBsaW5lLiBFeGFtcGxlOg0KIyAxMjozMjo0NDo1NTo0NDozMyAjIGNvbW1lbnRz</macaddresses>
			<nameid>IyBPbmUgTmFtZUlEfGVudGl0eWlkIHBlciBsaW5lLiBTdGFydCB3aXRoIH4gZm9yIGEgcmVnZXgNCiMgRXhhbXBsZToNCiMgbmFtZUlEOl84NTZkNDBhZjViNHxodHRwczovL3Rlc3QuZmVkZXJhdGlvbi5yZW5hdGVyLmZyL2lkcC9zaGliYm9sZXRoDQojIEV4YW1wbGUgZm9yIGFsbCB1c2VycyBvZiBhbiBpZGVudGl0eSBwcm92aWRlcjoNCiMgfm5hbWVJRDouKnxodHRwczovL3Rlc3QuZmVkZXJhdGlvbi5yZW5hdGVyLmZyL2lkcC9zaGliYm9sZXRoDQo=</nameid>
                </blacklists>
	</univnautes>
	<nat>
		<ipsecpassthru>
			<enable/>
		</ipsecpassthru>
		<!--
		<rule>
			<interface></interface>
			<external-address></external-address>
			<protocol></protocol>
			<external-port></external-port>
			<target></target>
			<local-port></local-port>
			<descr></descr>
		</rule>
		-->
		<!--
		<onetoone>
			<interface></interface>
			<external>xxx.xxx.xxx.xxx</external>
			<internal>xxx.xxx.xxx.xxx</internal>
			<subnet></subnet>
			<descr></descr>
		</onetoone>
		-->
		<!--
		<advancedoutbound>
			<enable/>
			<rule>
				<interface></interface>
				<source>
					<network>xxx.xxx.xxx.xxx/xx</network>
				</source>
				<destination>
					<not/>
					<any/>
					*or*
					<network>xxx.xxx.xxx.xxx/xx</network>
				</destination>
				<target>xxx.xxx.xxx.xxx</target>
				<descr></descr>
			</rule>
		</advancedoutbound>
		-->
		<!--
		<servernat>
			<ipaddr></ipaddr>
			<descr></descr>
		</servernat>
		-->
	</nat>
	<filter>
		<!-- <tcpidletimeout></tcpidletimeout> -->
		<!--
		<rule>
			<type>pass</type>
			<ipprotocol>inet</ipprotocol>
			<descr><![CDATA[Default allow LAN to any rule]]></descr>
			<interface>lan</interface>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<any/>
			</destination>
		</rule>
		<rule>
			<type>pass</type>
			<ipprotocol>inet6</ipprotocol>
			<descr><![CDATA[Default allow LAN IPv6 to any rule]]></descr>
			<interface>lan</interface>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<any/>
			</destination>
		</rule>
		-->
		<!-- rule syntax:
		<rule>
			<disabled/>
			<id>[0-9]*</id>
			<type>pass|block|reject</type>
			<ipprotocol>inet|inet6</ipprotocol>
			<descr>...</descr>
			<interface>lan|opt[n]|wan|pptp</interface>
			<protocol>tcp|udp|tcp/udp|...</protocol>
			<icmptype></icmptype>
			<source>
				<not/>

				<address>xxx.xxx.xxx.xxx(/xx) or alias</address>
				*or*
				<network>lan|opt[n]|pptp</network>
				*or*
				<any/>

				<port>a[-b]</port>
			</source>
			<destination>
				*same as for source*
			</destination>
			<frags/>
			<log/>
		</rule>
		-->
		<!-- default univnautes rules -->
		<rule>
			<id/>
			<type>pass</type>
			<interface>wan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp</protocol>
			<source>
				<network>wan</network>
			</source>
			<destination>
				<network>wanip</network>
				<port>22</port>
			</destination>
			<descr><![CDATA[SSH (from WAN)]]></descr>
			<disabled/>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>wan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp</protocol>
			<source>
				<any/>
			</source>
			<destination>
				<network>wanip</network>
				<port>LocalIDP</port>
			</destination>
			<descr><![CDATA[Local IdP access]]></descr>
			<disabled/>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>wan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp</protocol>
			<source>
				<network>wan</network>
			</source>
			<destination>
				<network>wanip</network>
				<port>WebAdmin</port>
			</destination>
			<descr><![CDATA[web admin (from WAN)]]></descr>
		</rule>
                <rule>
                        <id/>
                        <type>pass</type>
                        <interface>wan</interface>
                        <tag/>
                        <tagged/>
                        <max/>
                        <max-src-nodes/>
                        <max-src-conn/>
                        <max-src-states/>
                        <statetimeout/>
                        <statetype>keep state</statetype>
                        <os></os>
                        <protocol>udp</protocol>
                        <source>
                                <network>wan</network>
                        </source>
                        <destination>
                                <network>wanip</network>
                                <port>161</port>
                        </destination>
                        <descr><![CDATA[SNMP (from WAN)]]></descr>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<network>lanip</network>
				<port>WebAdmin</port>
			</destination>
			<descr><![CDATA[web admin (from LAN)]]></descr>
		</rule>
                <rule>
                        <id/>
                        <type>pass</type>
                        <interface>lan</interface>
                        <tag/>
                        <tagged/>
                        <max/>
                        <max-src-nodes/>
                        <max-src-conn/>
                        <max-src-states/>
                        <statetimeout/>
                        <statetype>keep state</statetype>
                        <os></os>
                        <protocol>udp</protocol>
                        <source>
                                <network>lan</network>
                        </source>
                        <destination>
                                <network>lanip</network>
                                <port>161</port>
                        </destination>
                        <descr><![CDATA[SNMP (from LAN)]]></descr>
                </rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>icmp</protocol>
			<icmptype>echoreq</icmptype>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<any/>
			</destination>
			<descr><![CDATA[ping]]></descr>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp/udp</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<any/>
				<port>53</port>
			</destination>
			<disabled/>
			<descr><![CDATA[ask any DNS server]]></descr>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp/udp</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<network>lanip</network>
				<port>53</port>
			</destination>
			<descr><![CDATA[ask CP DNS server]]></descr>
		</rule>
		<rule>
			<id/>
			<type>reject</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<network>lanip</network>
				<port>80</port>
			</destination>
			<descr><![CDATA[reject HTTP on CP]]></descr>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<any/>
				<port>80</port>
			</destination>
			<descr><![CDATA[HTTP]]></descr>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<any/>
				<port>443</port>
			</destination>
			<descr><![CDATA[HTTPS]]></descr>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<network>lanip</network>
				<port>LocalIDP</port>
			</destination>
			<descr><![CDATA[Local IdP access]]></descr>
			<disabled/>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<any/>
				<port>993</port>
			</destination>
			<descr><![CDATA[IMAPS]]></descr>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<any/>
				<port>995</port>
			</destination>
			<descr><![CDATA[POP3/S]]></descr>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<any/>
				<port>SMTPS</port>
			</destination>
			<descr><![CDATA[SMTP Submission]]></descr>
		</rule>
		<rule>
			<id/>
			<type>reject</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<network>lanip</network>
				<port>22</port>
			</destination>
			<descr><![CDATA[reject SSH on CP]]></descr>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<any/>
				<port>22</port>
			</destination>
			<descr><![CDATA[SSH]]></descr>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<any/>
				<port>119</port>
			</destination>
			<disabled/>
			<descr><![CDATA[NNTP]]></descr>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<any/>
				<port>143</port>
			</destination>
			<disabled/>
			<descr><![CDATA[IMAP]]></descr>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<any/>
				<port>110</port>
			</destination>
			<disabled/>
			<descr><![CDATA[POP3]]></descr>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>tcp/udp</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<any/>
				<port>1194</port>
			</destination>
			<descr><![CDATA[OpenVPN]]></descr>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>esp</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<any/>
			</destination>
			<descr><![CDATA[ESP (ipsec)]]></descr>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>ah</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<any/>
			</destination>
			<descr><![CDATA[AH (ipsec)]]></descr>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>udp</protocol>
			<source>
				<network>lan</network>
				<port>500</port>
			</source>
			<destination>
				<any/>
				<port>500</port>
			</destination>
			<descr><![CDATA[ISAKMP (ipsec)]]></descr>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>udp</protocol>
			<source>
				<network>lan</network>
				<port>4500</port>
			</source>
			<destination>
				<any/>
				<port>4500</port>
			</destination>
			<descr><![CDATA[NAT-T (ipsec)]]></descr>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>udp</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<any/>
				<port>10000</port>
			</destination>
			<descr><![CDATA[IPSec Cisco (ipsec)]]></descr>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>udp</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<network>lanip</network>
				<port>123</port>
			</destination>
			<descr><![CDATA[NTP on CP]]></descr>
		</rule>
		<rule>
			<id/>
			<type>pass</type>
			<interface>lan</interface>
			<tag/>
			<tagged/>
			<max/>
			<max-src-nodes/>
			<max-src-conn/>
			<max-src-states/>
			<statetimeout/>
			<statetype>keep state</statetype>
			<os/>
			<protocol>udp</protocol>
			<source>
				<network>lan</network>
			</source>
			<destination>
				<any/>
				<port>123</port>
			</destination>
			<disabled/>
			<descr><![CDATA[NTP]]></descr>
		</rule>
                <rule>
                        <id/>
                        <type>pass</type>
                        <interface>lan</interface>
                        <tag/>
                        <tagged/>
                        <max/>
                        <max-src-nodes/>
                        <max-src-conn/>
                        <max-src-states/>
                        <statetimeout/>
                        <statetype>keep state</statetype>
                        <os/>
                        <protocol>tcp</protocol>
                        <source>
                                <network>lan</network>
                        </source>
                        <destination>
                                <any/>
                                <port>XMPP</port>
                        </destination>
                        <descr><![CDATA[XMPP (jabber)]]></descr>
                </rule>
	</filter>
	<shaper>
		<!-- <enable/> -->
		<!-- <schedulertype>hfsc</schedulertype> -->
		<!-- rule syntax:
		<rule>
			<disabled/>
			<descr></descr>

			<targetpipe>number (zero based)</targetpipe>
			*or*
			<targetqueue>number (zero based)</targetqueue>

			<interface>lan|wan|opt[n]|pptp</interface>
			<protocol>tcp|udp</protocol>
			<direction>in|out</direction>
			<source>
				<not/>

				<address>xxx.xxx.xxx.xxx(/xx)</address>
				*or*
				<network>lan|opt[n]|pptp</network>
				*or*
				<any/>

				<port>a[-b]</port>
			</source>
			<destination>
				*same as for source*
			</destination>

			<iplen>from[-to]</iplen>
			<iptos>(!)lowdelay,throughput,reliability,mincost,congestion</iptos>
			<tcpflags>(!)fin,syn,rst,psh,ack,urg</tcpflags>
		</rule>
		<pipe>
			<descr></descr>
			<bandwidth></bandwidth>
			<delay></delay>
			<mask>source|destination</mask>
		</pipe>
		<queue>
			<descr></descr>
			<targetpipe>number (zero based)</targetpipe>
			<weight></weight>
			<mask>source|destination</mask>
		</queue>
		-->
	</shaper>
	<ipsec>
		<!-- <enable/> -->
		<!-- syntax:
		<tunnel>
			<disabled/>
			<auto/>
			<descr></descr>
			<interface>lan|wan|opt[n]</interface>
			<local-subnet>
				<address>xxx.xxx.xxx.xxx(/xx)</address>
				*or*
				<network>lan|opt[n]</network>
			</local-subnet>
			<remote-subnet>xxx.xxx.xxx.xxx/xx</remote-subnet>
			<remote-gateway></remote-gateway>
			<p1>
				<mode></mode>
				<myident>
					<myaddress/>
					*or*
					<address>xxx.xxx.xxx.xxx</address>
					*or*
					<fqdn>the.fq.dn</fqdn>
				</myident>
				<encryption-algorithm></encryption-algorithm>
				<hash-algorithm></hash-algorithm>
				<dhgroup></dhgroup>
				<lifetime></lifetime>
				<pre-shared-key></pre-shared-key>
			</p1>
			<p2>
				<protocol></protocol>
				<encryption-algorithm-option></encryption-algorithm-option>
				<hash-algorithm-option></hash-algorithm-option>
				<pfsgroup></pfsgroup>
				<lifetime></lifetime>
			</p2>
		</tunnel>
		<mobileclients>
			<enable/>
			<p1>
				<mode></mode>
				<myident>
					<myaddress/>
					*or*
					<address>xxx.xxx.xxx.xxx</address>
					*or*
					<fqdn>the.fq.dn</fqdn>
				</myident>
				<encryption-algorithm></encryption-algorithm>
				<hash-algorithm></hash-algorithm>
				<dhgroup></dhgroup>
				<lifetime></lifetime>
			</p1>
			<p2>
				<protocol></protocol>
				<encryption-algorithm-option></encryption-algorithm-option>
				<hash-algorithm-option></hash-algorithm-option>
				<pfsgroup></pfsgroup>
				<lifetime></lifetime>
			</p2>
		</mobileclients>
		<mobilekey>
			<ident></ident>
			<pre-shared-key></pre-shared-key>
		</mobilekey>
		-->
	</ipsec>
	<aliases>
                <alias>
                        <name>SMTPS</name>
                        <address>465 587</address>
                        <descr><![CDATA[SMTP with crypt+auth]]></descr>
                        <type>port</type>
                        <detail><![CDATA[SMTP/S||SMTP Submission]]></detail>
                </alias>
                <alias>
                        <name>XMPP</name>
                        <address>5222 5223</address>
                        <descr><![CDATA[XMPP/Jabber IM]]></descr>
                        <type>port</type>
                        <detail><![CDATA[Client-to-Server||Client-to-Server (old)]]></detail>
                </alias>
                <alias>
                        <name>WebAdmin</name>
			<address>8443</address>
                        <descr><![CDATA[pfSense web admin access]]></descr>
                        <type>port</type>
                        <detail><![CDATA[HTTPS access to pfSense admin web]]></detail>
                </alias>
                <alias>
                        <name>LocalIDP</name>
			<address>4443</address>
                        <descr><![CDATA[Local Identity Provider (UnivNautes)]]></descr>
                        <type>port</type>
                        <detail><![CDATA[HTTPS access to local IdP]]></detail>
                </alias>
        </aliases>
	<proxyarp>
		<!--
		<proxyarpnet>
			<network>xxx.xxx.xxx.xxx/xx</network>
			*or*
			<range>
				<from>xxx.xxx.xxx.xxx</from>
				<to>xxx.xxx.xxx.xxx</to>
			</range>
		</proxyarpnet>
		-->
	</proxyarp>
	<cron>
		<item>
			<minute>1,31</minute>
			<hour>0-5</hour>
			<mday>*</mday>
			<month>*</month>
			<wday>*</wday>
			<who>root</who>
			<command>/usr/bin/nice -n20 adjkerntz -a</command>
		</item>
		<item>
			<minute>1</minute>
			<hour>3</hour>
			<mday>1</mday>
			<month>*</month>
			<wday>*</wday>
			<who>root</who>
			<command>/usr/bin/nice -n20 /etc/rc.update_bogons.sh</command>
		</item>
		<item>
			<minute>*/60</minute>
			<hour>*</hour>
			<mday>*</mday>
			<month>*</month>
			<wday>*</wday>
			<who>root</who>
			<command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 sshlockout</command>
		</item>
		<item>
			<minute>1</minute>
			<hour>1</hour>
			<mday>*</mday>
			<month>*</month>
			<wday>*</wday>
			<who>root</who>
			<command>/usr/bin/nice -n20 /etc/rc.dyndns.update</command>
		</item>
		<item>
			<minute>*/60</minute>
			<hour>*</hour>
			<mday>*</mday>
			<month>*</month>
			<wday>*</wday>
			<who>root</who>
			<command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot</command>
		</item>
		<item>
			<minute>30</minute>
			<hour>12</hour>
			<mday>*</mday>
			<month>*</month>
			<wday>*</wday>
			<who>root</who>
			<command>/usr/bin/nice -n20 /etc/rc.update_urltables</command>
		</item>
	</cron>
	<wol>
		<!--
		<wolentry>
			<interface>lan|opt[n]</interface>
			<mac>xx:xx:xx:xx:xx:xx</mac>
			<descr></descr>
		</wolentry>
		-->
	</wol>
	<rrd>
		<enable/>
	</rrd>
	<load_balancer>
		<monitor_type>
			<name>ICMP</name>
			<type>icmp</type>
			<descr><![CDATA[ICMP]]></descr>
			<options/>
		</monitor_type>
		<monitor_type>
			<name>TCP</name>
			<type>tcp</type>
			<descr><![CDATA[Generic TCP]]></descr>
			<options/>
		</monitor_type>
		<monitor_type>
			<name>HTTP</name>
			<type>http</type>
			<descr><![CDATA[Generic HTTP]]></descr>
			<options>
				<path>/</path>
				<host/>
				<code>200</code>
			</options>
		</monitor_type>
		<monitor_type>
			<name>HTTPS</name>
			<type>https</type>
			<descr><![CDATA[Generic HTTPS]]></descr>
			<options>
				<path>/</path>
				<host/>
				<code>200</code>
			</options>
		</monitor_type>
		<monitor_type>
			<name>SMTP</name>
			<type>send</type>
			<descr><![CDATA[Generic SMTP]]></descr>
			<options>
				<send></send>
				<expect>220 *</expect>
			</options>
		</monitor_type>
	</load_balancer>
	<widgets>
		<sequence>system_information-container:col1:show,captive_portal_status-container:col1:close,carp_status-container:col1:close,cpu_graphs-container:col1:close,gateways-container:col1:close,gmirror_status-container:col1:close,installed_packages-container:col1:close,interface_statistics-container:col1:close,interfaces-container:col2:show,ipsec-container:col2:close,load_balancer_status-container:col2:close,log-container:col2:close,picture-container:col2:close,rss-container:col2:close,services_status-container:col2:close,traffic_graphs-container:col2:close</sequence>
	</widgets>
</pfsense>
