routers update
This commit is contained in:
parent
ab6ac75391
commit
4cc2fbe6c4
11 changed files with 429 additions and 33 deletions
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 21:18:17 by RouterOS 7.21.4
|
||||
# 2026-05-11 09:53:59 by RouterOS 7.21.4
|
||||
# software id = K4QG-8NQV
|
||||
#
|
||||
# model = RB5009UG+S+
|
||||
|
|
@ -539,6 +539,8 @@ add address=10.250.1.70%ether2-climax area=ospf-area-1 disabled=no \
|
|||
poll-interval=10s
|
||||
/snmp
|
||||
set contact=graham@vntx.net enabled=yes location="33.208204, -96.462530"
|
||||
/system clock
|
||||
set time-zone-name=America/Chicago
|
||||
/system identity
|
||||
set name=494
|
||||
/system logging
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-10 14:48:48 by RouterOS 7.21.4
|
||||
# 2026-05-11 09:53:59 by RouterOS 7.21.4
|
||||
# software id = FUVS-HCM5
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 16:18:38 by RouterOS 7.21.4
|
||||
# 2026-05-11 09:53:59 by RouterOS 7.21.4
|
||||
# software id = UETF-WF31
|
||||
#
|
||||
# model = CCR2004-16G-2S+
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 16:20:09 by RouterOS 7.21.4
|
||||
# 2026-05-11 09:53:59 by RouterOS 7.21.4
|
||||
# software id = XS5B-41QR
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 16:21:31 by RouterOS 7.21.4
|
||||
# 2026-05-11 09:53:59 by RouterOS 7.21.4
|
||||
# software id = HVP9-3G0K
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
|
|||
412
mikrotik-tool/edge-upgrade.md
Normal file
412
mikrotik-tool/edge-upgrade.md
Normal file
|
|
@ -0,0 +1,412 @@
|
|||
# edge → RouterOS 7 upgrade runbook
|
||||
|
||||
Edge is a CCR2004-1G-12S+2XS currently on 6.49.18 (the only ROS6 box left in
|
||||
the fleet). The auto-converter handles `/ip firewall`, `/ip address`,
|
||||
`/ip route`, `/interface`, `/snmp`, `/system`, and most NAT correctly. The
|
||||
following areas need manual pre-staging because the ROS7 converter either
|
||||
silently drops them or rewrites them into dead code:
|
||||
|
||||
- `/routing filter` → `/routing filter rule` (BGP/OSPF filter chains)
|
||||
- `/routing bgp instance` + `/routing bgp peer` → `/routing bgp instance` +
|
||||
`/routing bgp template` + `/routing bgp connection`
|
||||
- `/routing ospf instance` + `/routing ospf interface` + `/routing ospf nbma-neighbor`
|
||||
→ `/routing ospf instance` + `/routing ospf area` +
|
||||
`/routing ospf interface-template` + `/routing ospf static-neighbor`
|
||||
- `/routing bfd interface` → `/routing bfd configuration`
|
||||
- `/mpls ldp` set → `/mpls ldp` add + `/mpls ldp interface`
|
||||
- `/routing rip` (delete entirely)
|
||||
|
||||
Reference for ROS7 conventions: `core.rsc`, `climax.rsc`.
|
||||
|
||||
---
|
||||
|
||||
## 0. Pre-flight (before touching the router)
|
||||
|
||||
```bash
|
||||
# from your workstation
|
||||
cd /Users/graham/dev/network/mikrotik-tool
|
||||
./mikrotik-tool export # snapshot fresh /export
|
||||
cp edge.rsc edge.rsc.pre-ros7-$(date +%F) # keep the ROS6 baseline
|
||||
```
|
||||
|
||||
Verify console/out-of-band access (Spectrum link on `sfp-sfpplus12` is the
|
||||
WAN — if BGP doesn't come back, you lose remote access via that path; iBGP
|
||||
to core via preseem is the management fallback).
|
||||
|
||||
Confirm OSPF auth shared key from one of the peers (climax or core) so the
|
||||
new `/routing ospf interface-template` can be configured with matching auth.
|
||||
Edge's ROS6 export doesn't include the secret.
|
||||
|
||||
---
|
||||
|
||||
## 1. Stage One: in-place fixes on ROS6 (optional cleanups)
|
||||
|
||||
These are pure ROS6 commands you can run now to reduce churn during the
|
||||
upgrade.
|
||||
|
||||
```rsc
|
||||
# Normalize mpls-mtu to fleet standard 1508 (currently 1530)
|
||||
/mpls interface
|
||||
set [find interface=sfp-sfpplus8-server-switch] mpls-mtu=1508
|
||||
set [find default=yes] mpls-mtu=1508
|
||||
|
||||
# Add IPv4 anchor for BGP origination
|
||||
# In ROS6, /routing bgp network injects 204.110.188.0/22 directly.
|
||||
# In ROS7, we need the prefix to exist in the routing table for it to be
|
||||
# advertised. Adding the anchor now is harmless on ROS6.
|
||||
/ip route
|
||||
add dst-address=204.110.188.0/22 type=blackhole distance=200 \
|
||||
comment="anchor for BGP origination to TWC (ROS7 needs RIB entry)"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 2. Upgrade to RouterOS 7
|
||||
|
||||
```rsc
|
||||
# On the router (Winbox/SSH):
|
||||
/system package update
|
||||
set channel=long-term
|
||||
check-for-updates
|
||||
# verify it offers 7.21.4 (the fleet standard, see CLAUDE.md fleet topology)
|
||||
install
|
||||
# router reboots
|
||||
```
|
||||
|
||||
After reboot, verify version and that interfaces came back:
|
||||
|
||||
```rsc
|
||||
/system resource print
|
||||
/interface print
|
||||
/ip address print
|
||||
```
|
||||
|
||||
OSPF/BGP **will be broken at this point** — the auto-converter has run but
|
||||
filter chains, BGP connections, and OSPF templates are either missing or
|
||||
wrong. Static routes still work, so the Spectrum default + the static
|
||||
backbones to climax keep the box reachable.
|
||||
|
||||
---
|
||||
|
||||
## 3. Clear the auto-converted garbage
|
||||
|
||||
```rsc
|
||||
# BGP - remove auto-converted artifacts
|
||||
/routing bgp connection
|
||||
remove [find]
|
||||
/routing bgp template
|
||||
remove [find name!=default]
|
||||
|
||||
# OSPF - remove auto-converted artifacts
|
||||
/routing ospf interface-template
|
||||
remove [find]
|
||||
/routing ospf static-neighbor
|
||||
remove [find]
|
||||
/routing ospf area
|
||||
remove [find name!=backbone]
|
||||
/routing ospf instance
|
||||
remove [find name!=default-v2]
|
||||
|
||||
# Filter chains - remove anything auto-converted
|
||||
/routing filter rule
|
||||
remove [find]
|
||||
|
||||
# LDP - remove auto-converted artifacts
|
||||
/mpls ldp interface
|
||||
remove [find]
|
||||
/mpls ldp
|
||||
remove [find]
|
||||
|
||||
# BFD - remove auto-converted artifacts
|
||||
/routing bfd configuration
|
||||
remove [find]
|
||||
|
||||
# RIP - delete it, never coming back
|
||||
/routing rip
|
||||
# (RIP package is not installed by default on ROS7, may already be gone)
|
||||
|
||||
# Old BGP network announcements (replaced by RIB anchor + filter chain)
|
||||
/routing bgp network
|
||||
remove [find] # if the menu still exists in your ROS7 build
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 4. Stage the ROS7 routing config
|
||||
|
||||
### 4a. Routing IDs and instances
|
||||
|
||||
```rsc
|
||||
/routing id
|
||||
add disabled=no id=10.254.254.254 name=id-1 select-dynamic-id=""
|
||||
|
||||
/routing bgp instance
|
||||
add as=393837 cluster-id=10.254.254.254 name=bgp-instance-1 \
|
||||
router-id=10.254.254.254
|
||||
|
||||
/routing bgp template
|
||||
set default as=393837 disabled=no
|
||||
|
||||
/routing ospf instance
|
||||
add disabled=no in-filter-chain=ospf-in name=default-v2 \
|
||||
out-filter-chain=ospf-out redistribute=connected,static \
|
||||
router-id=id-1 routing-table=main \
|
||||
originate-default=always
|
||||
|
||||
/routing ospf instance
|
||||
add disabled=no in-filter-chain=ospf-in name=default-v3 \
|
||||
out-filter-chain=ospf-out redistribute=connected,static \
|
||||
router-id=id-1 routing-table=main version=3 \
|
||||
originate-default=always
|
||||
|
||||
/routing ospf area
|
||||
add disabled=no instance=default-v2 name=backbone-v2
|
||||
add disabled=no instance=default-v3 name=backbone-v3
|
||||
```
|
||||
|
||||
### 4b. Filter chains (THE default-deny fix)
|
||||
|
||||
Auto-converter does NOT bridge these — must be added explicitly and
|
||||
referenced from the instances/connections.
|
||||
|
||||
```rsc
|
||||
/routing filter rule
|
||||
# OSPF: accept everything in both directions
|
||||
add chain=ospf-in disabled=no rule="accept"
|
||||
add chain=ospf-out disabled=no rule="accept"
|
||||
|
||||
# eBGP to TWC: inbound = default route only
|
||||
add chain=twc-in disabled=no rule=\
|
||||
"if (dst==0.0.0.0/0 && dst-len==0) { accept } else { reject }"
|
||||
|
||||
# eBGP to TWC: outbound = only our /22 and our v6 /32
|
||||
add chain=twc-out disabled=no rule=\
|
||||
"if ((dst==204.110.188.0/22 && dst-len==22) || (dst==2606:1c80::/32 && dst-len==32)) { accept } else { reject }"
|
||||
|
||||
# iBGP-RR (v6 transport, v4+v6 NLRI): RR client filters
|
||||
add chain=v6-rr-in disabled=no rule=\
|
||||
"if (dst==0.0.0.0/0 || dst==::/0 || dst-len==44 || dst-len==64 || dst-len==128) { accept } else { reject }"
|
||||
add chain=v6-rr-out disabled=no rule=\
|
||||
"if (dst==0.0.0.0/0 || dst==::/0 || dst-len==44 || dst-len==64 || dst-len==128) { accept } else { reject }"
|
||||
```
|
||||
|
||||
Note: `dst-len==44` covers per-tower IPv6 allocations, `==64` covers
|
||||
per-link/server LANs, `==128` covers loopbacks. Adjust if your v6 plan in
|
||||
`ipv6.md` uses different prefix lengths.
|
||||
|
||||
### 4c. BGP connections
|
||||
|
||||
```rsc
|
||||
/routing bgp connection
|
||||
# eBGP to TWC, v4
|
||||
add disabled=no afi=ip as=393837 name=twc \
|
||||
instance=bgp-instance-1 \
|
||||
local.address=71.41.226.118 \
|
||||
remote.address=71.41.226.117 .as=11427 \
|
||||
input.filter=twc-in \
|
||||
output.filter-chain=twc-out \
|
||||
output.network=204.110.188.0/22 \
|
||||
output.redistribute=""
|
||||
|
||||
# eBGP to TWC, v6
|
||||
add disabled=no afi=ipv6 as=393837 name=twc-v6 \
|
||||
instance=bgp-instance-1 \
|
||||
local.address=2605:6000:0:8::f:373 \
|
||||
remote.address=2605:6000:0:8::f:372 .as=11427 \
|
||||
input.filter=twc-in \
|
||||
output.filter-chain=twc-out \
|
||||
output.network=2606:1c80::/32 \
|
||||
output.redistribute=""
|
||||
|
||||
# iBGP-RR to core (v4+v6 NLRI over v6 transport, edge is the RR)
|
||||
add disabled=no afi=ip,ipv6 as=393837 \
|
||||
comment="iBGP-RR to core" \
|
||||
instance=bgp-instance-1 \
|
||||
local.address=2606:1c80:0:10::254 .role=ibgp-rr \
|
||||
remote.address=2606:1c80:0:10::253 .as=393837 \
|
||||
multihop=yes \
|
||||
nexthop-choice=force-self \
|
||||
input.filter=v6-rr-in \
|
||||
output.filter-chain=v6-rr-out \
|
||||
output.redistribute=connected,static,ospf \
|
||||
output.default-originate=always \
|
||||
name=ibgp-rr-core
|
||||
```
|
||||
|
||||
If/when you add more RR clients (climax, culleoka, etc. peering directly to
|
||||
edge), they each get their own `/routing bgp connection` block mirroring the
|
||||
`ibgp-rr-core` pattern with `.role=ibgp-rr` on edge's side.
|
||||
|
||||
### 4d. OSPF interface templates and static neighbors
|
||||
|
||||
Replicate the per-interface settings from the old `/routing ospf interface`
|
||||
block. Adjust auth values to match the rest of the fleet (verify shared
|
||||
key from climax or core first).
|
||||
|
||||
```rsc
|
||||
/routing ospf interface-template
|
||||
# Preseem (primary path to core) - wired, BFD on
|
||||
add disabled=no area=backbone-v2 auth-id=1 cost=10 \
|
||||
interfaces=sfp-sfpplus11-preseem priority=1 type=ptp use-bfd=yes
|
||||
|
||||
# Direct backup to core - wired, BFD on
|
||||
add disabled=no area=backbone-v2 auth-id=1 cost=100 \
|
||||
interfaces=sfp-sfpplus7-core-direct priority=1 type=ptp use-bfd=yes
|
||||
|
||||
# Server switch VLAN9 (loopback / server LAN)
|
||||
add disabled=no area=backbone-v2 \
|
||||
interfaces=sfp-sfpplus8-server-switch type=broadcast
|
||||
|
||||
add disabled=no area=backbone-v2 passive=yes \
|
||||
interfaces=vlan9_sfpplus8 type=broadcast
|
||||
|
||||
# Spectrum WAN - passive (we don't run OSPF to TWC)
|
||||
add disabled=no area=backbone-v2 passive=yes \
|
||||
interfaces=sfp-sfpplus12-spectrum type=broadcast
|
||||
|
||||
# IPv6 area equivalents on the same wired links
|
||||
add disabled=no area=backbone-v3 cost=10 \
|
||||
interfaces=sfp-sfpplus11-preseem type=ptp use-bfd=yes
|
||||
add disabled=no area=backbone-v3 cost=100 \
|
||||
interfaces=sfp-sfpplus7-core-direct type=ptp use-bfd=yes
|
||||
add disabled=no area=backbone-v3 \
|
||||
interfaces=sfp-sfpplus8-server-switch type=broadcast
|
||||
|
||||
/routing ospf static-neighbor
|
||||
# Core (preseem path)
|
||||
add disabled=no area=backbone-v2 \
|
||||
address=204.110.191.185%sfp-sfpplus11-preseem
|
||||
# Core (direct path) - if you want OSPF on this link as a hot standby
|
||||
add disabled=no area=backbone-v2 \
|
||||
address=204.110.191.181%sfp-sfpplus7-core-direct
|
||||
```
|
||||
|
||||
**Do not** add the old NBMA neighbors `10.250.1.94`, `10.250.1.57`,
|
||||
`10.250.1.201`, `10.250.2.1` — those were stale wireless backbone
|
||||
neighbors that don't apply to edge (edge has no wireless backbone links).
|
||||
|
||||
### 4e. BFD
|
||||
|
||||
```rsc
|
||||
/routing bfd configuration
|
||||
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5 \
|
||||
vrf=main
|
||||
```
|
||||
|
||||
Per the fleet note in CLAUDE.md, BFD on wireless backbone links is
|
||||
problematic — edge has none, so this global config is fine.
|
||||
|
||||
### 4f. MPLS / LDP
|
||||
|
||||
```rsc
|
||||
/mpls interface
|
||||
# (mpls-mtu was already set in stage 1, but verify)
|
||||
set [find interface=sfp-sfpplus7-core-direct] mpls-mtu=1508
|
||||
set [find interface=sfp-sfpplus11-preseem] mpls-mtu=1508
|
||||
set [find interface=sfp-sfpplus8-server-switch] mpls-mtu=1508
|
||||
|
||||
/mpls ldp
|
||||
add disabled=no lsr-id=10.254.254.254 \
|
||||
transport-addresses=10.254.254.254 vrf=main
|
||||
|
||||
/mpls ldp interface
|
||||
add interface=sfp-sfpplus7-core-direct
|
||||
add interface=sfp-sfpplus11-preseem
|
||||
add interface=sfp-sfpplus8-server-switch
|
||||
```
|
||||
|
||||
LDP accept/advertise filtering: the ROS6 export was set to only advertise
|
||||
the loopback `/32` (`/mpls ldp advertise-filter add prefix=10.254.254.254/32`
|
||||
+ `add advertise=no`). If you want to preserve that behavior, add a filter
|
||||
chain:
|
||||
|
||||
```rsc
|
||||
/routing filter rule
|
||||
add chain=ldp-advertise disabled=no rule=\
|
||||
"if (dst==10.254.254.254/32 && dst-len==32) { accept } else { reject }"
|
||||
# Reference from /mpls ldp - syntax varies by ROS7 version, check
|
||||
# /mpls ldp print detail after adding the rule
|
||||
```
|
||||
|
||||
For most fleets this is over-engineering — LDP advertising all loopbacks
|
||||
is normally fine. Skip unless you have a specific reason.
|
||||
|
||||
---
|
||||
|
||||
## 5. Verification
|
||||
|
||||
```rsc
|
||||
# Interfaces and addressing
|
||||
/interface print
|
||||
/ip address print
|
||||
|
||||
# OSPF adjacencies
|
||||
/routing ospf neighbor print
|
||||
# expect: core via sfp-sfpplus11-preseem (Full), optionally
|
||||
# core via sfp-sfpplus7-core-direct (Full)
|
||||
|
||||
# OSPF routes
|
||||
/ip route print where ospf
|
||||
/ipv6 route print where ospf
|
||||
|
||||
# BGP sessions
|
||||
/routing bgp session print
|
||||
# expect: twc (Established), twc-v6 (Established), ibgp-rr-core (Established)
|
||||
|
||||
# BGP advertisements to TWC
|
||||
/routing bgp advertisements print peer=twc
|
||||
# expect: 204.110.188.0/22 advertised
|
||||
/routing bgp advertisements print peer=twc-v6
|
||||
# expect: 2606:1c80::/32 advertised
|
||||
|
||||
# BGP routes received
|
||||
/routing route print where bgp
|
||||
# expect: 0.0.0.0/0 from TWC v4, ::/0 from TWC v6, plus customer prefixes
|
||||
# from iBGP-RR
|
||||
|
||||
# LDP sessions
|
||||
/mpls ldp neighbor print
|
||||
# expect: session to core via direct + preseem links
|
||||
|
||||
# LDP-installed labels
|
||||
/mpls forwarding-table print
|
||||
|
||||
# BFD sessions
|
||||
/routing bfd session print
|
||||
# expect: up to core via preseem and direct
|
||||
|
||||
# Full reachability check
|
||||
/ping 10.254.254.253 # core loopback
|
||||
/ping 10.254.254.101 # verona loopback
|
||||
/tool traceroute 10.254.254.102 src-address=10.254.254.254 # to climax via MPLS
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 6. If things go wrong
|
||||
|
||||
The Spectrum default route (`/ip route add distance=1 gateway=71.41.226.117`)
|
||||
and the manually-pinned statics in `/ip route` (lines 508-531 of the old
|
||||
export) keep edge reachable from the Internet even without BGP/OSPF. From
|
||||
inside the network, the static `204.110.191.182/30` link to core stays up
|
||||
and is OSPF-independent.
|
||||
|
||||
Rollback path: `/system package downgrade` with the prior 6.49.18 npk
|
||||
available in the file store. Keep `edge.rsc.pre-ros7-<date>` around to
|
||||
re-paste any pieces the upgrade mangles unrecoverably.
|
||||
|
||||
---
|
||||
|
||||
## 7. Post-upgrade cleanup
|
||||
|
||||
```bash
|
||||
# back on the workstation
|
||||
cd /Users/graham/dev/network/mikrotik-tool
|
||||
./mikrotik-tool export # fresh edge.rsc on ROS7
|
||||
git add edge.rsc edge-upgrade.md
|
||||
git commit -m "edge: ROS7 upgrade"
|
||||
```
|
||||
|
||||
Update CLAUDE.md to remove the "Edge runs ROS 6.49.18 (legacy, no MPLS,
|
||||
ignore for the spine)" note once edge is fully on ROS7 with MPLS in the
|
||||
spine.
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# may/10/2026 05:53:37 by RouterOS 6.49.18
|
||||
# may/11/2026 09:53:59 by RouterOS 6.49.18
|
||||
# software id = 8XZE-R7EJ
|
||||
#
|
||||
# model = CCR2004-1G-12S+2XS
|
||||
|
|
@ -509,24 +509,19 @@ add distance=1 gateway=71.41.226.117
|
|||
add distance=1 dst-address=10.10.0.0/20 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.10.16.0/20 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.8/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.8/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.24/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.64/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.64/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.88/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.88/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.254.254.101/32 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.254.254.102/32 gateway=204.110.191.185
|
||||
add distance=1 dst-address=100.64.0.0/10 gateway=204.110.191.185
|
||||
add distance=1 dst-address=100.64.0.0/22 gateway=204.110.191.185
|
||||
add distance=1 dst-address=100.64.4.0/22 gateway=204.110.191.185
|
||||
add distance=1 dst-address=100.64.4.0/22 gateway=204.110.191.185
|
||||
add distance=1 dst-address=100.64.12.0/22 gateway=204.110.191.185
|
||||
add distance=1 dst-address=172.63.0.0/20 gateway=204.110.191.253
|
||||
add distance=1 dst-address=204.110.188.0/22 gateway=204.110.191.181
|
||||
add distance=1 dst-address=204.110.188.0/27 gateway=204.110.191.253
|
||||
add distance=1 dst-address=204.110.188.32/27 gateway=204.110.191.185
|
||||
add distance=1 dst-address=204.110.188.32/27 gateway=204.110.191.185
|
||||
add distance=1 dst-address=204.110.188.224/27 gateway=204.110.191.185
|
||||
add distance=1 dst-address=204.110.191.0/27 gateway=204.110.191.185
|
||||
/ip service
|
||||
|
|
@ -612,14 +607,6 @@ add in-filter=twc-in name=twc out-filter=twc-out remote-address=71.41.226.117 \
|
|||
remote-as=11427 ttl=default
|
||||
add address-families=ipv6 in-filter=twc-in name=twc-v6 out-filter=twc-out \
|
||||
remote-address=2605:6000:0:8::f:372 remote-as=11427 ttl=default
|
||||
add comment="TEAM-CYMRU BOGON Server #1" disabled=yes in-filter=\
|
||||
BOGON-SERVER-IN max-prefix-limit=50 multihop=yes name=CYMRU-1 out-filter=\
|
||||
BGP-DROP remote-address=38.229.6.20 remote-as=65332 tcp-md5-key=\
|
||||
mC9LaaOi0P
|
||||
add comment="TEAM-CYMRU BOGON Server #2" disabled=yes in-filter=\
|
||||
BOGON-SERVER-IN max-prefix-limit=50 multihop=yes name=CYMRU-1 out-filter=\
|
||||
BGP-DROP remote-address=38.229.46.20 remote-as=65332 tcp-md5-key=\
|
||||
mC9LaaOi0P
|
||||
add address-families=ip,ipv6 default-originate=always disabled=yes name=\
|
||||
edge_core_preseem nexthop-choice=propagate out-filter=bgp-default-only \
|
||||
remote-address=204.110.191.185 remote-as=393837
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-10 14:48:48 by RouterOS 7.22.3
|
||||
# 2026-05-11 09:53:59 by RouterOS 7.22.3
|
||||
# software id = ZGNY-ZJW7
|
||||
#
|
||||
# model = RB5009UG+S+
|
||||
|
|
@ -72,7 +72,7 @@ add dont-require-permissions=no name=api-ssl-certgen owner=admin policy=\
|
|||
\$certName trusted=yes; /ip/service set api-ssl certificate=\$certName dis\
|
||||
abled=no; /ip/service set api disabled=yes;"
|
||||
/container
|
||||
add envlists=tailscale interface=veth1 layer-dir="" name=\
|
||||
add envlists=tailscale interface=veth1 layer-dir="" logging=yes name=\
|
||||
tailscale-mikrotik:latest remote-image=\
|
||||
fluent-networks/tailscale-mikrotik:latest root-dir=\
|
||||
/disk1/containers/tailscale start-on-boot=yes workdir=/
|
||||
|
|
@ -81,7 +81,7 @@ set registry-url=https://ghcr.io tmpdir=/disk1/pull
|
|||
/container envs
|
||||
add key=ADVERTISE_ROUTES list=tailscale value=10.0.8.0/22,10.0.16.0/22
|
||||
add key=AUTH_KEY list=tailscale value=\
|
||||
tskey-auth-k9B9aH7Cyk11CNTRL-yYzpiX8XThCFiVV3pVMthCUKfN8wKTjBD
|
||||
tskey-auth-kBDB2uu3ms11CNTRL-2hFgTg5bzqeASw8XAx1prepozbPFVsYoc
|
||||
add key=CONTAINER_GATEWAY list=tailscale value=172.17.0.1
|
||||
add key=PASSWORD list=tailscale value=h8xd9tkryg
|
||||
add key=RUNNING_SCRIPT list=tailscale value=/var/lib/tailscale/running.sh
|
||||
|
|
@ -119,9 +119,6 @@ add address=172.17.0.1/16 interface=dockers network=172.17.0.0
|
|||
add address=204.110.191.1/27 interface=ether5-vntx-static network=\
|
||||
204.110.191.0
|
||||
add address=10.0.19.254/22 interface=bridge network=10.0.16.0
|
||||
add address=10.99.1.1/24 interface=*16 network=10.99.1.0
|
||||
add address=10.0.101.253/24 disabled=yes interface=ether4-house-60g network=\
|
||||
10.0.101.0
|
||||
add address=10.0.15.254/21 interface=ether3-servers network=10.0.8.0
|
||||
/ip dhcp-client
|
||||
add add-default-route=no interface=ether6-tmobile name=client1 use-peer-dns=\
|
||||
|
|
@ -429,7 +426,7 @@ add comment=wigle.net disabled=no distance=1 dst-address=54.70.85.50/32 \
|
|||
add dst-address=100.64.0.0/10 gateway=172.17.0.2
|
||||
add comment="Default via TMO (primary)" disabled=no distance=1 dst-address=\
|
||||
0.0.0.0/0 gateway=192.168.12.1 target-scope=11
|
||||
add comment="Default via VNTX (secondary)" disabled=yes distance=2 \
|
||||
add comment="Default via VNTX (secondary)" disabled=no distance=2 \
|
||||
dst-address=0.0.0.0/0 gateway=204.110.191.30 target-scope=11
|
||||
add check-gateway=ping comment="Default via Starlink (last\
|
||||
\n resort)" distance=3 dst-address=0.0.0.0/0 gateway=4.2.2.3 \
|
||||
|
|
@ -442,6 +439,8 @@ add check-gateway=ping comment="VNTX probe pin" distance=1 dst-address=\
|
|||
4.2.2.2/32 gateway=204.110.191.30%ether5-vntx-static scope=10
|
||||
add check-gateway=ping comment="Starlink probe pin" distance=1 dst-address=\
|
||||
4.2.2.3/32 gateway=192.168.1.1%ether7-starlink scope=10
|
||||
add disabled=no distance=1 dst-address=192.168.100.0/24 gateway=\
|
||||
ether7-starlink routing-table=main scope=30 target-scope=10
|
||||
/ip service
|
||||
set ftp disabled=yes
|
||||
set telnet disabled=yes
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 15:08:05 by RouterOS 7.21.4
|
||||
# 2026-05-11 09:53:59 by RouterOS 7.21.4
|
||||
# software id = 2I9X-PQZP
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
@ -365,16 +365,13 @@ add bridge=management ingress-filtering=no interface=vlan_10_ether6 \
|
|||
add bridge=management ingress-filtering=no interface=vlan_10_ether7 \
|
||||
internal-path-cost=10 path-cost=10
|
||||
/ip firewall connection tracking
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
|
||||
tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
|
||||
tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
|
||||
tcp-time-wait-timeout=2m udp-stream-timeout=2m
|
||||
/ip settings
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set tcp-syncookies=yes
|
||||
/ipv6 settings
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set accept-router-advertisements=no
|
||||
/interface pppoe-server server
|
||||
add default-profile=pppoe disabled=no interface=lowrycrossing max-mtu=1492 \
|
||||
|
|
@ -1388,7 +1385,6 @@ add address=0.us.pool.ntp.org
|
|||
/system package update
|
||||
set channel=long-term
|
||||
/system routerboard settings
|
||||
# Firmware upgraded successfully, please reboot for changes to take effect!
|
||||
set auto-upgrade=yes
|
||||
/system scheduler
|
||||
add disabled=yes interval=1w name=sched_backup on-event=backup policy=\
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-10 14:48:49 by RouterOS 7.21.4
|
||||
# 2026-05-11 09:53:59 by RouterOS 7.21.4
|
||||
# software id = 5HTF-YFWV
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 16:19:30 by RouterOS 7.21.4
|
||||
# 2026-05-11 09:53:59 by RouterOS 7.21.4
|
||||
# software id = Y1CT-1WB1
|
||||
#
|
||||
# model = CCR2004-16G-2S+
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue