# Deny by default
deny from any

# Allow dn42 networks
allow from group dn42 prefix $dn42_v4_networks prefixlen 18 - 28
allow from group dn42 prefix { $allowed_rfc1918_networks $allowed_global_v4_networks } prefixlen 18 - 28
        

# Filter Crest's network (allow subnet for vm from ichdasich)
deny  from group dn42                         prefix { $crest_main_network }
allow from group dn42 source-as $ichdasich_as prefix $crest_delegated_network

# Allow Freifunk networks.
allow from any prefix $allowed_freifunk_networks prefixlen 12 - 28
        
# Implement dn42 transit-as routing policy
# for an ADSL2+ link (16mbit/s down, 1mbit/s up) :-(.
match to group dn42 set prepend-self 2