From 4cc2fbe6c4690488c44aa6c98b752695042412ff Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Mon, 11 May 2026 09:54:13 -0500 Subject: [PATCH] routers update --- mikrotik-tool/494.rsc | 4 +- mikrotik-tool/982.rsc | 2 +- mikrotik-tool/climax.rsc | 2 +- mikrotik-tool/core.rsc | 2 +- mikrotik-tool/culleoka.rsc | 2 +- mikrotik-tool/edge-upgrade.md | 412 ++++++++++++++++++++++++++++++++++ mikrotik-tool/edge.rsc | 15 +- mikrotik-tool/home.rsc | 13 +- mikrotik-tool/lowry.rsc | 6 +- mikrotik-tool/newhope.rsc | 2 +- mikrotik-tool/verona.rsc | 2 +- 11 files changed, 429 insertions(+), 33 deletions(-) create mode 100644 mikrotik-tool/edge-upgrade.md diff --git a/mikrotik-tool/494.rsc b/mikrotik-tool/494.rsc index 7367418..ae8b8b8 100644 --- a/mikrotik-tool/494.rsc +++ b/mikrotik-tool/494.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 21:18:17 by RouterOS 7.21.4 +# 2026-05-11 09:53:59 by RouterOS 7.21.4 # software id = K4QG-8NQV # # model = RB5009UG+S+ @@ -539,6 +539,8 @@ add address=10.250.1.70%ether2-climax area=ospf-area-1 disabled=no \ poll-interval=10s /snmp set contact=graham@vntx.net enabled=yes location="33.208204, -96.462530" +/system clock +set time-zone-name=America/Chicago /system identity set name=494 /system logging diff --git a/mikrotik-tool/982.rsc b/mikrotik-tool/982.rsc index 3302d3b..d74f2df 100644 --- a/mikrotik-tool/982.rsc +++ b/mikrotik-tool/982.rsc @@ -1,4 +1,4 @@ -# 2026-05-10 14:48:48 by RouterOS 7.21.4 +# 2026-05-11 09:53:59 by RouterOS 7.21.4 # software id = FUVS-HCM5 # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/climax.rsc b/mikrotik-tool/climax.rsc index a04a6da..c0c70eb 100644 --- a/mikrotik-tool/climax.rsc +++ b/mikrotik-tool/climax.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 16:18:38 by RouterOS 7.21.4 +# 2026-05-11 09:53:59 by RouterOS 7.21.4 # software id = UETF-WF31 # # model = CCR2004-16G-2S+ diff --git a/mikrotik-tool/core.rsc b/mikrotik-tool/core.rsc index 6bd8e1a..4413ed6 100644 --- a/mikrotik-tool/core.rsc +++ b/mikrotik-tool/core.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 16:20:09 by RouterOS 7.21.4 +# 2026-05-11 09:53:59 by RouterOS 7.21.4 # software id = XS5B-41QR # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/culleoka.rsc b/mikrotik-tool/culleoka.rsc index 05dbba7..b029a89 100644 --- a/mikrotik-tool/culleoka.rsc +++ b/mikrotik-tool/culleoka.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 16:21:31 by RouterOS 7.21.4 +# 2026-05-11 09:53:59 by RouterOS 7.21.4 # software id = HVP9-3G0K # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/edge-upgrade.md b/mikrotik-tool/edge-upgrade.md new file mode 100644 index 0000000..8d17e02 --- /dev/null +++ b/mikrotik-tool/edge-upgrade.md @@ -0,0 +1,412 @@ +# edge → RouterOS 7 upgrade runbook + +Edge is a CCR2004-1G-12S+2XS currently on 6.49.18 (the only ROS6 box left in +the fleet). The auto-converter handles `/ip firewall`, `/ip address`, +`/ip route`, `/interface`, `/snmp`, `/system`, and most NAT correctly. The +following areas need manual pre-staging because the ROS7 converter either +silently drops them or rewrites them into dead code: + +- `/routing filter` → `/routing filter rule` (BGP/OSPF filter chains) +- `/routing bgp instance` + `/routing bgp peer` → `/routing bgp instance` + + `/routing bgp template` + `/routing bgp connection` +- `/routing ospf instance` + `/routing ospf interface` + `/routing ospf nbma-neighbor` + → `/routing ospf instance` + `/routing ospf area` + + `/routing ospf interface-template` + `/routing ospf static-neighbor` +- `/routing bfd interface` → `/routing bfd configuration` +- `/mpls ldp` set → `/mpls ldp` add + `/mpls ldp interface` +- `/routing rip` (delete entirely) + +Reference for ROS7 conventions: `core.rsc`, `climax.rsc`. + +--- + +## 0. Pre-flight (before touching the router) + +```bash +# from your workstation +cd /Users/graham/dev/network/mikrotik-tool +./mikrotik-tool export # snapshot fresh /export +cp edge.rsc edge.rsc.pre-ros7-$(date +%F) # keep the ROS6 baseline +``` + +Verify console/out-of-band access (Spectrum link on `sfp-sfpplus12` is the +WAN — if BGP doesn't come back, you lose remote access via that path; iBGP +to core via preseem is the management fallback). + +Confirm OSPF auth shared key from one of the peers (climax or core) so the +new `/routing ospf interface-template` can be configured with matching auth. +Edge's ROS6 export doesn't include the secret. + +--- + +## 1. Stage One: in-place fixes on ROS6 (optional cleanups) + +These are pure ROS6 commands you can run now to reduce churn during the +upgrade. + +```rsc +# Normalize mpls-mtu to fleet standard 1508 (currently 1530) +/mpls interface +set [find interface=sfp-sfpplus8-server-switch] mpls-mtu=1508 +set [find default=yes] mpls-mtu=1508 + +# Add IPv4 anchor for BGP origination +# In ROS6, /routing bgp network injects 204.110.188.0/22 directly. +# In ROS7, we need the prefix to exist in the routing table for it to be +# advertised. Adding the anchor now is harmless on ROS6. +/ip route +add dst-address=204.110.188.0/22 type=blackhole distance=200 \ + comment="anchor for BGP origination to TWC (ROS7 needs RIB entry)" +``` + +--- + +## 2. Upgrade to RouterOS 7 + +```rsc +# On the router (Winbox/SSH): +/system package update +set channel=long-term +check-for-updates +# verify it offers 7.21.4 (the fleet standard, see CLAUDE.md fleet topology) +install +# router reboots +``` + +After reboot, verify version and that interfaces came back: + +```rsc +/system resource print +/interface print +/ip address print +``` + +OSPF/BGP **will be broken at this point** — the auto-converter has run but +filter chains, BGP connections, and OSPF templates are either missing or +wrong. Static routes still work, so the Spectrum default + the static +backbones to climax keep the box reachable. + +--- + +## 3. Clear the auto-converted garbage + +```rsc +# BGP - remove auto-converted artifacts +/routing bgp connection +remove [find] +/routing bgp template +remove [find name!=default] + +# OSPF - remove auto-converted artifacts +/routing ospf interface-template +remove [find] +/routing ospf static-neighbor +remove [find] +/routing ospf area +remove [find name!=backbone] +/routing ospf instance +remove [find name!=default-v2] + +# Filter chains - remove anything auto-converted +/routing filter rule +remove [find] + +# LDP - remove auto-converted artifacts +/mpls ldp interface +remove [find] +/mpls ldp +remove [find] + +# BFD - remove auto-converted artifacts +/routing bfd configuration +remove [find] + +# RIP - delete it, never coming back +/routing rip +# (RIP package is not installed by default on ROS7, may already be gone) + +# Old BGP network announcements (replaced by RIB anchor + filter chain) +/routing bgp network +remove [find] # if the menu still exists in your ROS7 build +``` + +--- + +## 4. Stage the ROS7 routing config + +### 4a. Routing IDs and instances + +```rsc +/routing id +add disabled=no id=10.254.254.254 name=id-1 select-dynamic-id="" + +/routing bgp instance +add as=393837 cluster-id=10.254.254.254 name=bgp-instance-1 \ + router-id=10.254.254.254 + +/routing bgp template +set default as=393837 disabled=no + +/routing ospf instance +add disabled=no in-filter-chain=ospf-in name=default-v2 \ + out-filter-chain=ospf-out redistribute=connected,static \ + router-id=id-1 routing-table=main \ + originate-default=always + +/routing ospf instance +add disabled=no in-filter-chain=ospf-in name=default-v3 \ + out-filter-chain=ospf-out redistribute=connected,static \ + router-id=id-1 routing-table=main version=3 \ + originate-default=always + +/routing ospf area +add disabled=no instance=default-v2 name=backbone-v2 +add disabled=no instance=default-v3 name=backbone-v3 +``` + +### 4b. Filter chains (THE default-deny fix) + +Auto-converter does NOT bridge these — must be added explicitly and +referenced from the instances/connections. + +```rsc +/routing filter rule +# OSPF: accept everything in both directions +add chain=ospf-in disabled=no rule="accept" +add chain=ospf-out disabled=no rule="accept" + +# eBGP to TWC: inbound = default route only +add chain=twc-in disabled=no rule=\ + "if (dst==0.0.0.0/0 && dst-len==0) { accept } else { reject }" + +# eBGP to TWC: outbound = only our /22 and our v6 /32 +add chain=twc-out disabled=no rule=\ + "if ((dst==204.110.188.0/22 && dst-len==22) || (dst==2606:1c80::/32 && dst-len==32)) { accept } else { reject }" + +# iBGP-RR (v6 transport, v4+v6 NLRI): RR client filters +add chain=v6-rr-in disabled=no rule=\ + "if (dst==0.0.0.0/0 || dst==::/0 || dst-len==44 || dst-len==64 || dst-len==128) { accept } else { reject }" +add chain=v6-rr-out disabled=no rule=\ + "if (dst==0.0.0.0/0 || dst==::/0 || dst-len==44 || dst-len==64 || dst-len==128) { accept } else { reject }" +``` + +Note: `dst-len==44` covers per-tower IPv6 allocations, `==64` covers +per-link/server LANs, `==128` covers loopbacks. Adjust if your v6 plan in +`ipv6.md` uses different prefix lengths. + +### 4c. BGP connections + +```rsc +/routing bgp connection +# eBGP to TWC, v4 +add disabled=no afi=ip as=393837 name=twc \ + instance=bgp-instance-1 \ + local.address=71.41.226.118 \ + remote.address=71.41.226.117 .as=11427 \ + input.filter=twc-in \ + output.filter-chain=twc-out \ + output.network=204.110.188.0/22 \ + output.redistribute="" + +# eBGP to TWC, v6 +add disabled=no afi=ipv6 as=393837 name=twc-v6 \ + instance=bgp-instance-1 \ + local.address=2605:6000:0:8::f:373 \ + remote.address=2605:6000:0:8::f:372 .as=11427 \ + input.filter=twc-in \ + output.filter-chain=twc-out \ + output.network=2606:1c80::/32 \ + output.redistribute="" + +# iBGP-RR to core (v4+v6 NLRI over v6 transport, edge is the RR) +add disabled=no afi=ip,ipv6 as=393837 \ + comment="iBGP-RR to core" \ + instance=bgp-instance-1 \ + local.address=2606:1c80:0:10::254 .role=ibgp-rr \ + remote.address=2606:1c80:0:10::253 .as=393837 \ + multihop=yes \ + nexthop-choice=force-self \ + input.filter=v6-rr-in \ + output.filter-chain=v6-rr-out \ + output.redistribute=connected,static,ospf \ + output.default-originate=always \ + name=ibgp-rr-core +``` + +If/when you add more RR clients (climax, culleoka, etc. peering directly to +edge), they each get their own `/routing bgp connection` block mirroring the +`ibgp-rr-core` pattern with `.role=ibgp-rr` on edge's side. + +### 4d. OSPF interface templates and static neighbors + +Replicate the per-interface settings from the old `/routing ospf interface` +block. Adjust auth values to match the rest of the fleet (verify shared +key from climax or core first). + +```rsc +/routing ospf interface-template +# Preseem (primary path to core) - wired, BFD on +add disabled=no area=backbone-v2 auth-id=1 cost=10 \ + interfaces=sfp-sfpplus11-preseem priority=1 type=ptp use-bfd=yes + +# Direct backup to core - wired, BFD on +add disabled=no area=backbone-v2 auth-id=1 cost=100 \ + interfaces=sfp-sfpplus7-core-direct priority=1 type=ptp use-bfd=yes + +# Server switch VLAN9 (loopback / server LAN) +add disabled=no area=backbone-v2 \ + interfaces=sfp-sfpplus8-server-switch type=broadcast + +add disabled=no area=backbone-v2 passive=yes \ + interfaces=vlan9_sfpplus8 type=broadcast + +# Spectrum WAN - passive (we don't run OSPF to TWC) +add disabled=no area=backbone-v2 passive=yes \ + interfaces=sfp-sfpplus12-spectrum type=broadcast + +# IPv6 area equivalents on the same wired links +add disabled=no area=backbone-v3 cost=10 \ + interfaces=sfp-sfpplus11-preseem type=ptp use-bfd=yes +add disabled=no area=backbone-v3 cost=100 \ + interfaces=sfp-sfpplus7-core-direct type=ptp use-bfd=yes +add disabled=no area=backbone-v3 \ + interfaces=sfp-sfpplus8-server-switch type=broadcast + +/routing ospf static-neighbor +# Core (preseem path) +add disabled=no area=backbone-v2 \ + address=204.110.191.185%sfp-sfpplus11-preseem +# Core (direct path) - if you want OSPF on this link as a hot standby +add disabled=no area=backbone-v2 \ + address=204.110.191.181%sfp-sfpplus7-core-direct +``` + +**Do not** add the old NBMA neighbors `10.250.1.94`, `10.250.1.57`, +`10.250.1.201`, `10.250.2.1` — those were stale wireless backbone +neighbors that don't apply to edge (edge has no wireless backbone links). + +### 4e. BFD + +```rsc +/routing bfd configuration +add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5 \ + vrf=main +``` + +Per the fleet note in CLAUDE.md, BFD on wireless backbone links is +problematic — edge has none, so this global config is fine. + +### 4f. MPLS / LDP + +```rsc +/mpls interface +# (mpls-mtu was already set in stage 1, but verify) +set [find interface=sfp-sfpplus7-core-direct] mpls-mtu=1508 +set [find interface=sfp-sfpplus11-preseem] mpls-mtu=1508 +set [find interface=sfp-sfpplus8-server-switch] mpls-mtu=1508 + +/mpls ldp +add disabled=no lsr-id=10.254.254.254 \ + transport-addresses=10.254.254.254 vrf=main + +/mpls ldp interface +add interface=sfp-sfpplus7-core-direct +add interface=sfp-sfpplus11-preseem +add interface=sfp-sfpplus8-server-switch +``` + +LDP accept/advertise filtering: the ROS6 export was set to only advertise +the loopback `/32` (`/mpls ldp advertise-filter add prefix=10.254.254.254/32` ++ `add advertise=no`). If you want to preserve that behavior, add a filter +chain: + +```rsc +/routing filter rule +add chain=ldp-advertise disabled=no rule=\ + "if (dst==10.254.254.254/32 && dst-len==32) { accept } else { reject }" +# Reference from /mpls ldp - syntax varies by ROS7 version, check +# /mpls ldp print detail after adding the rule +``` + +For most fleets this is over-engineering — LDP advertising all loopbacks +is normally fine. Skip unless you have a specific reason. + +--- + +## 5. Verification + +```rsc +# Interfaces and addressing +/interface print +/ip address print + +# OSPF adjacencies +/routing ospf neighbor print +# expect: core via sfp-sfpplus11-preseem (Full), optionally +# core via sfp-sfpplus7-core-direct (Full) + +# OSPF routes +/ip route print where ospf +/ipv6 route print where ospf + +# BGP sessions +/routing bgp session print +# expect: twc (Established), twc-v6 (Established), ibgp-rr-core (Established) + +# BGP advertisements to TWC +/routing bgp advertisements print peer=twc +# expect: 204.110.188.0/22 advertised +/routing bgp advertisements print peer=twc-v6 +# expect: 2606:1c80::/32 advertised + +# BGP routes received +/routing route print where bgp +# expect: 0.0.0.0/0 from TWC v4, ::/0 from TWC v6, plus customer prefixes +# from iBGP-RR + +# LDP sessions +/mpls ldp neighbor print +# expect: session to core via direct + preseem links + +# LDP-installed labels +/mpls forwarding-table print + +# BFD sessions +/routing bfd session print +# expect: up to core via preseem and direct + +# Full reachability check +/ping 10.254.254.253 # core loopback +/ping 10.254.254.101 # verona loopback +/tool traceroute 10.254.254.102 src-address=10.254.254.254 # to climax via MPLS +``` + +--- + +## 6. If things go wrong + +The Spectrum default route (`/ip route add distance=1 gateway=71.41.226.117`) +and the manually-pinned statics in `/ip route` (lines 508-531 of the old +export) keep edge reachable from the Internet even without BGP/OSPF. From +inside the network, the static `204.110.191.182/30` link to core stays up +and is OSPF-independent. + +Rollback path: `/system package downgrade` with the prior 6.49.18 npk +available in the file store. Keep `edge.rsc.pre-ros7-` around to +re-paste any pieces the upgrade mangles unrecoverably. + +--- + +## 7. Post-upgrade cleanup + +```bash +# back on the workstation +cd /Users/graham/dev/network/mikrotik-tool +./mikrotik-tool export # fresh edge.rsc on ROS7 +git add edge.rsc edge-upgrade.md +git commit -m "edge: ROS7 upgrade" +``` + +Update CLAUDE.md to remove the "Edge runs ROS 6.49.18 (legacy, no MPLS, +ignore for the spine)" note once edge is fully on ROS7 with MPLS in the +spine. diff --git a/mikrotik-tool/edge.rsc b/mikrotik-tool/edge.rsc index 5c76cc6..6f02872 100644 --- a/mikrotik-tool/edge.rsc +++ b/mikrotik-tool/edge.rsc @@ -1,4 +1,4 @@ -# may/10/2026 05:53:37 by RouterOS 6.49.18 +# may/11/2026 09:53:59 by RouterOS 6.49.18 # software id = 8XZE-R7EJ # # model = CCR2004-1G-12S+2XS @@ -509,24 +509,19 @@ add distance=1 gateway=71.41.226.117 add distance=1 dst-address=10.10.0.0/20 gateway=204.110.191.185 add distance=1 dst-address=10.10.16.0/20 gateway=204.110.191.185 add distance=1 dst-address=10.250.1.8/29 gateway=204.110.191.185 -add distance=1 dst-address=10.250.1.8/29 gateway=204.110.191.185 add distance=1 dst-address=10.250.1.24/29 gateway=204.110.191.185 add distance=1 dst-address=10.250.1.64/29 gateway=204.110.191.185 -add distance=1 dst-address=10.250.1.64/29 gateway=204.110.191.185 -add distance=1 dst-address=10.250.1.88/29 gateway=204.110.191.185 add distance=1 dst-address=10.250.1.88/29 gateway=204.110.191.185 add distance=1 dst-address=10.254.254.101/32 gateway=204.110.191.185 add distance=1 dst-address=10.254.254.102/32 gateway=204.110.191.185 add distance=1 dst-address=100.64.0.0/10 gateway=204.110.191.185 add distance=1 dst-address=100.64.0.0/22 gateway=204.110.191.185 add distance=1 dst-address=100.64.4.0/22 gateway=204.110.191.185 -add distance=1 dst-address=100.64.4.0/22 gateway=204.110.191.185 add distance=1 dst-address=100.64.12.0/22 gateway=204.110.191.185 add distance=1 dst-address=172.63.0.0/20 gateway=204.110.191.253 add distance=1 dst-address=204.110.188.0/22 gateway=204.110.191.181 add distance=1 dst-address=204.110.188.0/27 gateway=204.110.191.253 add distance=1 dst-address=204.110.188.32/27 gateway=204.110.191.185 -add distance=1 dst-address=204.110.188.32/27 gateway=204.110.191.185 add distance=1 dst-address=204.110.188.224/27 gateway=204.110.191.185 add distance=1 dst-address=204.110.191.0/27 gateway=204.110.191.185 /ip service @@ -612,14 +607,6 @@ add in-filter=twc-in name=twc out-filter=twc-out remote-address=71.41.226.117 \ remote-as=11427 ttl=default add address-families=ipv6 in-filter=twc-in name=twc-v6 out-filter=twc-out \ remote-address=2605:6000:0:8::f:372 remote-as=11427 ttl=default -add comment="TEAM-CYMRU BOGON Server #1" disabled=yes in-filter=\ - BOGON-SERVER-IN max-prefix-limit=50 multihop=yes name=CYMRU-1 out-filter=\ - BGP-DROP remote-address=38.229.6.20 remote-as=65332 tcp-md5-key=\ - mC9LaaOi0P -add comment="TEAM-CYMRU BOGON Server #2" disabled=yes in-filter=\ - BOGON-SERVER-IN max-prefix-limit=50 multihop=yes name=CYMRU-1 out-filter=\ - BGP-DROP remote-address=38.229.46.20 remote-as=65332 tcp-md5-key=\ - mC9LaaOi0P add address-families=ip,ipv6 default-originate=always disabled=yes name=\ edge_core_preseem nexthop-choice=propagate out-filter=bgp-default-only \ remote-address=204.110.191.185 remote-as=393837 diff --git a/mikrotik-tool/home.rsc b/mikrotik-tool/home.rsc index 51c8688..5be02fa 100644 --- a/mikrotik-tool/home.rsc +++ b/mikrotik-tool/home.rsc @@ -1,4 +1,4 @@ -# 2026-05-10 14:48:48 by RouterOS 7.22.3 +# 2026-05-11 09:53:59 by RouterOS 7.22.3 # software id = ZGNY-ZJW7 # # model = RB5009UG+S+ @@ -72,7 +72,7 @@ add dont-require-permissions=no name=api-ssl-certgen owner=admin policy=\ \$certName trusted=yes; /ip/service set api-ssl certificate=\$certName dis\ abled=no; /ip/service set api disabled=yes;" /container -add envlists=tailscale interface=veth1 layer-dir="" name=\ +add envlists=tailscale interface=veth1 layer-dir="" logging=yes name=\ tailscale-mikrotik:latest remote-image=\ fluent-networks/tailscale-mikrotik:latest root-dir=\ /disk1/containers/tailscale start-on-boot=yes workdir=/ @@ -81,7 +81,7 @@ set registry-url=https://ghcr.io tmpdir=/disk1/pull /container envs add key=ADVERTISE_ROUTES list=tailscale value=10.0.8.0/22,10.0.16.0/22 add key=AUTH_KEY list=tailscale value=\ - tskey-auth-k9B9aH7Cyk11CNTRL-yYzpiX8XThCFiVV3pVMthCUKfN8wKTjBD + tskey-auth-kBDB2uu3ms11CNTRL-2hFgTg5bzqeASw8XAx1prepozbPFVsYoc add key=CONTAINER_GATEWAY list=tailscale value=172.17.0.1 add key=PASSWORD list=tailscale value=h8xd9tkryg add key=RUNNING_SCRIPT list=tailscale value=/var/lib/tailscale/running.sh @@ -119,9 +119,6 @@ add address=172.17.0.1/16 interface=dockers network=172.17.0.0 add address=204.110.191.1/27 interface=ether5-vntx-static network=\ 204.110.191.0 add address=10.0.19.254/22 interface=bridge network=10.0.16.0 -add address=10.99.1.1/24 interface=*16 network=10.99.1.0 -add address=10.0.101.253/24 disabled=yes interface=ether4-house-60g network=\ - 10.0.101.0 add address=10.0.15.254/21 interface=ether3-servers network=10.0.8.0 /ip dhcp-client add add-default-route=no interface=ether6-tmobile name=client1 use-peer-dns=\ @@ -429,7 +426,7 @@ add comment=wigle.net disabled=no distance=1 dst-address=54.70.85.50/32 \ add dst-address=100.64.0.0/10 gateway=172.17.0.2 add comment="Default via TMO (primary)" disabled=no distance=1 dst-address=\ 0.0.0.0/0 gateway=192.168.12.1 target-scope=11 -add comment="Default via VNTX (secondary)" disabled=yes distance=2 \ +add comment="Default via VNTX (secondary)" disabled=no distance=2 \ dst-address=0.0.0.0/0 gateway=204.110.191.30 target-scope=11 add check-gateway=ping comment="Default via Starlink (last\ \n resort)" distance=3 dst-address=0.0.0.0/0 gateway=4.2.2.3 \ @@ -442,6 +439,8 @@ add check-gateway=ping comment="VNTX probe pin" distance=1 dst-address=\ 4.2.2.2/32 gateway=204.110.191.30%ether5-vntx-static scope=10 add check-gateway=ping comment="Starlink probe pin" distance=1 dst-address=\ 4.2.2.3/32 gateway=192.168.1.1%ether7-starlink scope=10 +add disabled=no distance=1 dst-address=192.168.100.0/24 gateway=\ + ether7-starlink routing-table=main scope=30 target-scope=10 /ip service set ftp disabled=yes set telnet disabled=yes diff --git a/mikrotik-tool/lowry.rsc b/mikrotik-tool/lowry.rsc index 88b3ac8..5aa2009 100644 --- a/mikrotik-tool/lowry.rsc +++ b/mikrotik-tool/lowry.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 15:08:05 by RouterOS 7.21.4 +# 2026-05-11 09:53:59 by RouterOS 7.21.4 # software id = 2I9X-PQZP # # model = CCR1009-7G-1C-1S+ @@ -365,16 +365,13 @@ add bridge=management ingress-filtering=no interface=vlan_10_ether6 \ add bridge=management ingress-filtering=no interface=vlan_10_ether7 \ internal-path-cost=10 path-cost=10 /ip firewall connection tracking -# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \ tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \ tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \ tcp-time-wait-timeout=2m udp-stream-timeout=2m /ip settings -# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings set tcp-syncookies=yes /ipv6 settings -# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings set accept-router-advertisements=no /interface pppoe-server server add default-profile=pppoe disabled=no interface=lowrycrossing max-mtu=1492 \ @@ -1388,7 +1385,6 @@ add address=0.us.pool.ntp.org /system package update set channel=long-term /system routerboard settings -# Firmware upgraded successfully, please reboot for changes to take effect! set auto-upgrade=yes /system scheduler add disabled=yes interval=1w name=sched_backup on-event=backup policy=\ diff --git a/mikrotik-tool/newhope.rsc b/mikrotik-tool/newhope.rsc index 66c72ba..1edb48a 100644 --- a/mikrotik-tool/newhope.rsc +++ b/mikrotik-tool/newhope.rsc @@ -1,4 +1,4 @@ -# 2026-05-10 14:48:49 by RouterOS 7.21.4 +# 2026-05-11 09:53:59 by RouterOS 7.21.4 # software id = 5HTF-YFWV # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/verona.rsc b/mikrotik-tool/verona.rsc index 822684c..8ce104c 100644 --- a/mikrotik-tool/verona.rsc +++ b/mikrotik-tool/verona.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 16:19:30 by RouterOS 7.21.4 +# 2026-05-11 09:53:59 by RouterOS 7.21.4 # software id = Y1CT-1WB1 # # model = CCR2004-16G-2S+