Je moet ook helemaal niet zelf in de json willen knippen en plakken.
Je configuratie maak je via CLI van de USG waar na je de usg zelf de json laat maken.
1. Connect to the USG via SSH, and issue the following commands:
configure
set service nat rule 1 type destination
set service nat rule 1 inbound-interface eth0
set service nat rule 1 protocol tcp_udp
set service nat rule 1 destination port 53
set service nat rule 1 inside-address address 10.0.0.1
set service nat rule 1 inside-address port 53
commit;save;exit
2. Next is displaying the config. The following command displays the entire config in a JSON format:
The config can also be exported if preferred. The following example exports the output to the config.txt:
mca-ctrl -t dump-cfg > config.txt
3. Find the appropriate section with the custom changes in the config output, for our example above it would be the following:
JSON:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
| "nat": {
"rule": {
"1": {
"destination": {
"port": "53"
},
"inbound-interface": "eth0",
"inside-address": {
"address": "10.0.0.1",
"port": "53"
},
"protocol": "tcp_udp",
"type": "destination"
}, |
4. Above is the custom rule, but it's missing all the closing brackets (

at the end to make it correct. If you look at the config output from the start, there is a certain format that is required for the file to be read correctly. Each node in a section must be separated by a comma (,), and it section must begin with an opening bracket ({) and finish with a closing one (

. Follow the existing format carefully. If the above rule is the only change in the config.gateway.json, you would edit it to look like so:
JSON:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
| {
"service": {
"nat": {
"rule": {
"1": {
"destination": {
"port": "53"
},
"inbound-interface": "eth0",
"inside-address": {
"address": "10.0.0.1",
"port": "53"
},
"protocol": "tcp_udp",
"type": "destination"
}
}
}
}
} |
5. If there are multiple sections to add, say Firewall, Service, VPN, the closing bracket for that section would be followed by a comma (},), before starting the next section. You can see these formatting details in the example below.
The DNAT rule # ranges are from 1-4999, and the Source/Masquerade rule numbers are from 5000-9999. If you wanted to add a port forward (DNAT) in the config.gateway.json for WAN2 in a multiWAN (load-balance) setup, this is what the config.gateway.json would look like with only this particular NAT rule:
JSON:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
| {
"service": {
"nat": {
"rule": {
"4500": {
"description": "port_forward_WAN2",
"destination": {
"address": "100.64.100.100",
"port": "22"
},
"inbound-interface": "eth3",
"inside-address": {
"address": "192.168.1.100"
},
"protocol": "tcp",
"type": "destination"
}
}
}
}
} |
And if we were to add a VPN with hostnames to the file, the config.gateway.json would look like the one below. Notice the opening and closing brackets, as well as the bracket with comma before starting with the "vpn" section:
JSON:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
| {
"service": {
"nat": {
"rule": {
"4500": {
"description": "port_forward_WAN2",
"destination": {
"address": "100.64.100.100",
"port": "22"
},
"inbound-interface": "eth3",
"inside-address": {
"address": "192.168.1.100"
},
"protocol": "tcp",
"type": "destination"
}
}
}
},
"vpn": {
"ipsec": {
"site-to-site": {
"peer": {
"yyyy.ignorelist.com": {
"authentication": {
"id": "xxxx.ignorelist.com"
},
"local-address": "xxxx.ignorelist.com"
}
}
}
}
}
} |
Testing & Verification
Back to Top
It's recommended to validate the code once finished creating the config.gateway.json. There are a number of free options out there, jsonlint.com is used by the Ubiquiti support team quite often.
After adding the config.gateway.json to the UniFi Network site of your choosing, you can test it by running a "force provision" to the USG in UniFi Devices > select the USG > Config > Manage Device > Force provision. This will take a while to provision (30 seconds to 3 minutes), and if it stays in provisioning longer than that, there may be a formatting error in the config.gateway.json, and you are experiencing the provisioning loop that was mentioned earlier. You can check server.log in the application and search for commit error. You can usually find what went wrong with the provisioning of the newly customized configuration in the log files. Find information about that here.