config bcp38
	option enabled 0
	option interface 'eth1'
	option detect_upstream 1
	list match '127.0.0.0/8'
	list match '192.0.2.0/24'    # RFC 5737
	list match '198.51.100.0/24' # RFC 5737
	list match '203.0.113.0/24'  # RFC 5737
	list match '192.168.0.0/16'  # RFC 1918
	list match '10.0.0.0/8'      # RFC 1918
	list match '172.16.0.0/12'   # RFC 1918
	list match '169.254.0.0/16'  # RFC 3927

# 	list nomatch '172.26.0.0/21' # Example of something not to match
#	There is a dhcp trigger to do this for the netmask of a 
#	double natted connection needed

#       You can only specify IPv4 addresses here - for IPv6, only source
#       specific default routes will be installed, which achieves the same
#       without needing any firewall routes.

#	I will argue that this level of indirection doesn't scale
# 	very well - see how to block china as an example
#	http://www.okean.com/china.txt