routers update
This commit is contained in:
parent
eba433988a
commit
735168c394
21 changed files with 554 additions and 130 deletions
|
|
@ -20,23 +20,25 @@
|
|||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find !default]
|
||||
/ipv6 nd remove [find default=no]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find !dynamic]
|
||||
/ipv6 route remove [find dynamic=no]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find !dynamic]
|
||||
/ipv6 address remove [find dynamic=no]
|
||||
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
|
||||
/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — BGP instance
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing bgp template set [find name=default] disabled=no
|
||||
|
||||
/routing bgp instance
|
||||
add name=bgp-instance-1 as=393837 router-id=10.254.254.111
|
||||
|
||||
|
|
@ -48,7 +50,7 @@ add name=bgp-instance-1 as=393837 router-id=10.254.254.111
|
|||
/ipv6 address
|
||||
add address=2606:1c80:0:10::111/128 interface=lo advertise=no comment="loopback"
|
||||
add address=2606:1c80:0:17::2/64 interface=ether2-climax advertise=no comment="P2P 494<->climax"
|
||||
add address=2606:1c80:1A00::1/64 interface=mgmt advertise=yes comment="494 mgmt LAN"
|
||||
add address=2606:1c80:1A00::1/64 interface=management advertise=yes comment="494 mgmt LAN"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — static routes
|
||||
|
|
@ -63,13 +65,13 @@ add dst-address=2606:1c80:1A00::/44 blackhole distance=200 comment="494 /44 aggr
|
|||
# APPLY — neighbour discovery on the mgmt LAN
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 nd
|
||||
add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
add interface=management ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
/ipv6 nd prefix
|
||||
add interface=mgmt prefix=2606:1c80:1A00::/64 autonomous=yes on-link=yes
|
||||
add interface=management prefix=2606:1c80:1A00::/64 autonomous=yes on-link=yes
|
||||
|
||||
/ipv6 dhcp-server
|
||||
add interface=mgmt name=494-mgmt-stateless address-pool=static-only
|
||||
add interface=management name=494-mgmt-stateless address-pool=static-only
|
||||
|
||||
/ipv6 dhcp-server option
|
||||
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
|
@ -81,7 +83,7 @@ add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
|||
add name=494-cust-pd-1 prefix=2606:1c80:1A01::/48 prefix-length=56
|
||||
|
||||
/ppp profile
|
||||
set [find name=pppoe] remote-ipv6-prefix-pool=494-cust-pd-1 dhcpv6-pd-pool=494-cust-pd-1
|
||||
set [find name=494] remote-ipv6-prefix-pool=494-cust-pd-1 dhcpv6-pd-pool=494-cust-pd-1
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 11:21:08 by RouterOS 7.21.4
|
||||
# 2026-05-09 12:15:11 by RouterOS 7.21.4
|
||||
# software id = K4QG-8NQV
|
||||
#
|
||||
# model = RB5009UG+S+
|
||||
|
|
@ -217,11 +217,16 @@ add add-arp=yes address-pool=mgmt interface=management lease-script="{\
|
|||
\n" lease-time=1h name=dhcp2
|
||||
/ip smb users
|
||||
set [ find default=yes ] disabled=yes
|
||||
/ipv6 dhcp-server option
|
||||
add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
/ipv6 pool
|
||||
add name=494-cust-pd-1 prefix=2606:1c80:1a01::/48 prefix-length=56
|
||||
/ppp profile
|
||||
set *0 dns-server=204.110.191.240,204.110.191.250 local-address=\
|
||||
204.110.188.94 remote-address=public use-upnp=no
|
||||
add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \
|
||||
local-address=100.64.175.254 name=494 on-down="{\
|
||||
add change-tcp-mss=yes dhcpv6-pd-pool=494-cust-pd-1 dns-server=\
|
||||
204.110.191.240,204.110.191.20 local-address=100.64.175.254 name=494 \
|
||||
on-down="{\
|
||||
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
||||
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
|
||||
7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
|
||||
|
|
@ -329,7 +334,8 @@ add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \
|
|||
\n }\
|
||||
\n} while ( \$attempts < \$max )\
|
||||
\n}\
|
||||
\n" remote-address=cgnat use-upnp=no
|
||||
\n" remote-address=cgnat remote-ipv6-prefix-pool=494-cust-pd-1 use-upnp=\
|
||||
no
|
||||
/queue type
|
||||
add kind=fq-codel name=fq-codel
|
||||
/queue interface
|
||||
|
|
@ -342,6 +348,9 @@ set ether6 queue=fq-codel
|
|||
set ether7 queue=fq-codel
|
||||
set ether8 queue=fq-codel
|
||||
set sfp-sfpplus1 queue=fq-codel
|
||||
/routing bgp instance
|
||||
add as=393837 name=bgp-instance-1 router-id=10.254.254.111
|
||||
add as=393837 name=bgp-instance-1 router-id=10.254.254.111
|
||||
/routing id
|
||||
add disabled=no id=10.254.254.111 name=id-1 select-dynamic-id=any \
|
||||
select-from-vrf=main
|
||||
|
|
@ -369,14 +378,20 @@ add bridge=management interface=vlan10_ether7 internal-path-cost=10 \
|
|||
add bridge=management interface=vlan10_ether8 internal-path-cost=10 \
|
||||
path-cost=10
|
||||
/ip firewall connection tracking
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
|
||||
tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
|
||||
tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
|
||||
tcp-time-wait-timeout=2m udp-stream-timeout=2m
|
||||
/ip neighbor discovery-settings
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set discover-interface-list=!dynamic
|
||||
/ip settings
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set tcp-syncookies=yes
|
||||
/ipv6 settings
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set accept-router-advertisements=no
|
||||
/interface pppoe-server server
|
||||
add default-profile=494 disabled=no interface=494 max-mru=1492 max-mtu=1492 \
|
||||
one-session-per-host=yes service-name=494
|
||||
|
|
@ -429,6 +444,15 @@ set port=43133
|
|||
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\
|
||||
10.250.1.70%ether2-climax pref-src="" routing-table=main scope=30 \
|
||||
target-scope=10
|
||||
/ipv6 route
|
||||
add comment="default via climax" distance=1 dst-address=::/0 gateway=\
|
||||
2606:1c80:0:17::1
|
||||
add comment="core loopback (iBGP bootstrap, via climax)" distance=1 \
|
||||
dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:17::1
|
||||
add comment="edge loopback (via climax)" distance=1 dst-address=\
|
||||
2606:1c80:0:10::254/128 gateway=2606:1c80:0:17::1
|
||||
add blackhole comment="494 /44 aggregate (iBGP origin)" distance=200 \
|
||||
dst-address=2606:1c80:1a00::/44
|
||||
/ip service
|
||||
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||
|
|
@ -440,8 +464,38 @@ set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10
|
|||
set api-ssl address=0.0.0.0/0 certificate=myCa
|
||||
/ip ssh
|
||||
set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:10::111/128 advertise=no comment=loopback interface=\
|
||||
lo
|
||||
add address=2606:1c80:0:17::2 advertise=no comment="P2P 494<->climax" \
|
||||
interface=ether2-climax
|
||||
add address=2606:1c80:1a00::1 comment="494 mgmt LAN" interface=management
|
||||
/ipv6 dhcp-server
|
||||
add interface=management name=494-mgmt-stateless
|
||||
/ipv6 firewall filter
|
||||
add action=accept chain=input comment=established connection-state=\
|
||||
established,related
|
||||
add action=drop chain=input comment=invalid connection-state=invalid
|
||||
add action=accept chain=input comment=icmpv6 protocol=icmpv6
|
||||
add action=accept chain=input comment=link-local src-address=fe80::/10
|
||||
add action=accept chain=input comment=internal src-address=2606:1c80::/32
|
||||
add action=drop chain=input comment="default deny"
|
||||
add action=accept chain=forward comment=established connection-state=\
|
||||
established,related
|
||||
add action=drop chain=forward comment=invalid connection-state=invalid
|
||||
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
|
||||
icmpv6
|
||||
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
|
||||
add action=accept chain=forward comment=internal-to-internal dst-address=\
|
||||
2606:1c80::/32 src-address=2606:1c80::/32
|
||||
add action=accept chain=forward comment="v6 outbound from 494 customers" \
|
||||
src-address=2606:1c80:1a00::/44
|
||||
add action=drop chain=forward comment="default deny"
|
||||
/ipv6 nd
|
||||
set [ find default=yes ] advertise-dns=yes
|
||||
add advertise-dns=yes interface=management other-configuration=yes
|
||||
/ipv6 nd prefix
|
||||
add interface=management prefix=2606:1c80:1a00::/64
|
||||
/mpls interface
|
||||
add interface=ether2-climax mpls-mtu=1508
|
||||
/mpls ldp
|
||||
|
|
@ -462,10 +516,22 @@ add accounting-backup=yes address=45.76.56.5 disabled=yes \
|
|||
/routing bfd configuration
|
||||
add disabled=no interfaces=ether2-climax min-rx=200ms min-tx=200ms \
|
||||
multiplier=5 vrf=main
|
||||
/routing bgp connection
|
||||
add afi=ip,ipv6 comment="iBGP to core (v6 RR), v6 transport" instance=\
|
||||
bgp-instance-1 local.address=2606:1c80:0:10::111 .role=ibgp multihop=yes \
|
||||
name=ibgp-rr-core nexthop-choice=force-self output.filter-chain=\
|
||||
v6-ibgp-out .redistribute=connected,static remote.address=\
|
||||
2606:1c80:0:10::253 .as=393837 templates=default
|
||||
/routing filter rule
|
||||
add chain=ospf-in disabled=no rule="accept;\r\
|
||||
\n"
|
||||
add chain=ospf-out disabled=no rule="accept;"
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1A00::/44 || dst==2\
|
||||
606:1c80:0:10::111/128 || (dst-len==64 && dst==2606:1c80:0:17::/64)) { acc\
|
||||
ept; } else { reject; }"
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1A00::/44 || dst==2\
|
||||
606:1c80:0:10::111/128 || (dst-len==64 && dst==2606:1c80:0:17::/64)) { acc\
|
||||
ept; } else { reject; }"
|
||||
/routing ospf interface-template
|
||||
add area=ospf-area-1 auth=sha512 auth-id=1 disabled=no interfaces=\
|
||||
ether2-climax type=ptp use-bfd=no
|
||||
|
|
|
|||
|
|
@ -20,23 +20,25 @@
|
|||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find !default]
|
||||
/ipv6 nd remove [find default=no]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find !dynamic]
|
||||
/ipv6 route remove [find dynamic=no]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find !dynamic]
|
||||
/ipv6 address remove [find dynamic=no]
|
||||
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
|
||||
/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — BGP instance
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing bgp template set [find name=default] disabled=no
|
||||
|
||||
/routing bgp instance
|
||||
add name=bgp-instance-1 as=393837 router-id=10.254.254.110
|
||||
|
||||
|
|
@ -81,7 +83,7 @@ add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
|||
add name=982-cust-pd-1 prefix=2606:1c80:1301::/48 prefix-length=56
|
||||
|
||||
/ppp profile
|
||||
set [find name=pppoe] remote-ipv6-prefix-pool=982-cust-pd-1 dhcpv6-pd-pool=982-cust-pd-1
|
||||
set [find name=982] remote-ipv6-prefix-pool=982-cust-pd-1 dhcpv6-pd-pool=982-cust-pd-1
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 11:21:08 by RouterOS 7.21.4
|
||||
# 2026-05-09 12:15:11 by RouterOS 7.21.4
|
||||
# software id = FUVS-HCM5
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
@ -120,8 +120,13 @@ add address-pool=mgmt interface=mgmt lease-script="{\
|
|||
\n" lease-time=10m name=mgmt
|
||||
/ip smb users
|
||||
set [ find default=yes ] disabled=yes
|
||||
/ipv6 dhcp-server option
|
||||
add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
/ipv6 pool
|
||||
add name=982-cust-pd-1 prefix=2606:1c80:1301::/48 prefix-length=56
|
||||
/ppp profile
|
||||
add local-address=100.64.63.253 name=982 on-down="{\
|
||||
add dhcpv6-pd-pool=982-cust-pd-1 local-address=100.64.63.253 name=982 \
|
||||
on-down="{\
|
||||
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
||||
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
|
||||
7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
|
||||
|
|
@ -229,7 +234,7 @@ add local-address=100.64.63.253 name=982 on-down="{\
|
|||
\n }\
|
||||
\n} while ( \$attempts < \$max )\
|
||||
\n}\
|
||||
\n" remote-address=cgnat
|
||||
\n" remote-address=cgnat remote-ipv6-prefix-pool=982-cust-pd-1
|
||||
/queue type
|
||||
add kind=fq-codel name=fq-codel
|
||||
/queue interface
|
||||
|
|
@ -242,6 +247,8 @@ set ether5 queue=fq-codel
|
|||
set ether6 queue=fq-codel
|
||||
set ether7-380 queue=fq-codel
|
||||
set sfp-sfpplus1 queue=fq-codel
|
||||
/routing bgp instance
|
||||
add as=393837 name=bgp-instance-1 router-id=10.254.254.110
|
||||
/routing bgp template
|
||||
set default disabled=no
|
||||
/routing id
|
||||
|
|
@ -249,10 +256,8 @@ add disabled=no id=10.254.254.110 name=id-1 select-dynamic-id=""
|
|||
/routing ospf instance
|
||||
add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\
|
||||
ospf-out redistribute=connected router-id=id-1
|
||||
add disabled=no name=default-v3 router-id=id-1 version=3
|
||||
/routing ospf area
|
||||
add disabled=no instance=default-v2 name=backbone-v2
|
||||
add disabled=no instance=default-v3 name=backbone-v3
|
||||
/snmp community
|
||||
set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
|
||||
kdyyJrT0Mm
|
||||
|
|
@ -285,12 +290,17 @@ add bridge=mgmt ingress-filtering=no interface=vlan10_ether6 \
|
|||
internal-path-cost=10 path-cost=10
|
||||
add bridge=982 interface=combo1
|
||||
/ip firewall connection tracking
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
|
||||
tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
|
||||
tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
|
||||
tcp-time-wait-timeout=2m udp-stream-timeout=2m
|
||||
/ip settings
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set tcp-syncookies=yes
|
||||
/ipv6 settings
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set accept-router-advertisements=no
|
||||
/interface pppoe-server server
|
||||
add authentication=mschap2 default-profile=982 disabled=no interface=982 \
|
||||
one-session-per-host=yes service-name=982
|
||||
|
|
@ -376,6 +386,15 @@ set [ find default=yes ] dh-group=modp2048 dpd-interval=2m \
|
|||
set port=48348
|
||||
/ip route
|
||||
add disabled=no dst-address=0.0.0.0/0 gateway=10.250.1.38
|
||||
/ipv6 route
|
||||
add comment="default via core" distance=1 dst-address=::/0 gateway=\
|
||||
2606:1c80:0:14::1
|
||||
add comment="core loopback (iBGP bootstrap)" distance=1 dst-address=\
|
||||
2606:1c80:0:10::253/128 gateway=2606:1c80:0:14::1
|
||||
add comment="edge loopback via core" distance=1 dst-address=\
|
||||
2606:1c80:0:10::254/128 gateway=2606:1c80:0:14::1
|
||||
add blackhole comment="982 /44 aggregate (iBGP origin)" distance=200 \
|
||||
dst-address=2606:1c80:1300::/44
|
||||
/ip service
|
||||
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||
|
|
@ -387,8 +406,38 @@ set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10
|
|||
set api-ssl certificate=ca-template
|
||||
/ip ssh
|
||||
set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:10::110/128 advertise=no comment=loopback interface=\
|
||||
lo
|
||||
add address=2606:1c80:0:14::2 advertise=no comment="P2P 982<->core (60GHz)" \
|
||||
interface=ether7-380
|
||||
add address=2606:1c80:1300::1 comment="982 mgmt LAN" interface=mgmt
|
||||
/ipv6 dhcp-server
|
||||
add interface=mgmt name=982-mgmt-stateless
|
||||
/ipv6 firewall filter
|
||||
add action=accept chain=input comment=established connection-state=\
|
||||
established,related
|
||||
add action=drop chain=input comment=invalid connection-state=invalid
|
||||
add action=accept chain=input comment=icmpv6 protocol=icmpv6
|
||||
add action=accept chain=input comment=link-local src-address=fe80::/10
|
||||
add action=accept chain=input comment=internal src-address=2606:1c80::/32
|
||||
add action=drop chain=input comment="default deny"
|
||||
add action=accept chain=forward comment=established connection-state=\
|
||||
established,related
|
||||
add action=drop chain=forward comment=invalid connection-state=invalid
|
||||
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
|
||||
icmpv6
|
||||
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
|
||||
add action=accept chain=forward comment=internal-to-internal dst-address=\
|
||||
2606:1c80::/32 src-address=2606:1c80::/32
|
||||
add action=accept chain=forward comment="v6 outbound from 982 customers" \
|
||||
src-address=2606:1c80:1300::/44
|
||||
add action=drop chain=forward comment="default deny"
|
||||
/ipv6 nd
|
||||
set [ find default=yes ] advertise-dns=yes
|
||||
add advertise-dns=yes interface=mgmt other-configuration=yes
|
||||
/ipv6 nd prefix
|
||||
add interface=mgmt prefix=2606:1c80:1300::/64
|
||||
/mpls interface
|
||||
add interface=ether7-380 mpls-mtu=1508
|
||||
/mpls ldp
|
||||
|
|
@ -408,14 +457,22 @@ add accounting-backup=yes address=45.76.56.5 disabled=yes \
|
|||
300ms
|
||||
/routing bfd configuration
|
||||
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
|
||||
/routing bgp connection
|
||||
add afi=ip,ipv6 comment="iBGP to core (v6 RR), v6 transport" instance=\
|
||||
bgp-instance-1 local.address=2606:1c80:0:10::110 .role=ibgp multihop=yes \
|
||||
name=ibgp-rr-core nexthop-choice=force-self output.filter-chain=\
|
||||
v6-ibgp-out .redistribute=connected,static remote.address=\
|
||||
2606:1c80:0:10::253 .as=393837 templates=default
|
||||
/routing filter rule
|
||||
add chain=ospf-in disabled=no rule="accept;"
|
||||
add chain=ospf-out disabled=no rule="accept;"
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1300::/44 || dst==2\
|
||||
606:1c80:0:10::110/128 || (dst-len==64 && dst==2606:1c80:0:14::/64)) { acc\
|
||||
ept; } else { reject; }"
|
||||
/routing ospf interface-template
|
||||
add area=backbone-v2 auth-id=1 cost=10 disabled=no interfaces=ether7-380 \
|
||||
networks=10.250.1.32/29 priority=1 type=ptp use-bfd=no
|
||||
add area=backbone-v2 disabled=no passive
|
||||
add area=backbone-v3 disabled=no passive
|
||||
/snmp
|
||||
set contact=graham@vntx.net enabled=yes location="33.148902, -96.495811"
|
||||
/system clock
|
||||
|
|
|
|||
|
|
@ -27,13 +27,13 @@
|
|||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find !default]
|
||||
/ipv6 nd remove [find default=no]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find !dynamic]
|
||||
/ipv6 route remove [find dynamic=no]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find !dynamic]
|
||||
/ipv6 address remove [find dynamic=no]
|
||||
|
||||
# OSPFv3 — instance, area, and the orphan culleoka-11ghz template entry
|
||||
# (currently lives under area=backbone-v3) all get removed.
|
||||
|
|
@ -42,7 +42,7 @@
|
|||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
# Drop any stale internal v6 iBGP peers (none present, but defensive).
|
||||
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
|
||||
/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — BGP instance (climax has none today)
|
||||
|
|
@ -75,6 +75,16 @@ add dst-address=::/0 gateway=2606:1c80:0:12::1 distance=1 com
|
|||
# entry helps iBGP control plane converge quickly on first bring-up).
|
||||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:12::1 distance=1 comment="edge loopback via core"
|
||||
|
||||
# 494 sits one hop further out via the climax<->494 P2P; climax is the
|
||||
# only neighbour that can deliver to its loopback. Without this, return
|
||||
# traffic for 494's /128 from core/edge loops at climax.
|
||||
add dst-address=2606:1c80:0:10::111/128 gateway=2606:1c80:0:17::2 distance=1 comment="494 loopback via P2P"
|
||||
|
||||
# verona's loopback is reachable through verona's own P2P side. Adding
|
||||
# this static beats the BGP-learned next-hop during convergence and
|
||||
# avoids the stale-next-hop loop we hit on 2026-05-09.
|
||||
add dst-address=2606:1c80:0:10::101/128 gateway=2606:1c80:0:20::1 distance=1 comment="verona loopback via P2P"
|
||||
|
||||
# Blackhole climax's /44 aggregate so iBGP has the prefix to advertise.
|
||||
add dst-address=2606:1c80:1100::/44 blackhole distance=200 comment="climax /44 aggregate (iBGP origin)"
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 11:21:08 by RouterOS 7.21.4
|
||||
# 2026-05-09 12:15:10 by RouterOS 7.21.4
|
||||
# software id = UETF-WF31
|
||||
#
|
||||
# model = CCR2004-16G-2S+
|
||||
|
|
@ -405,6 +405,8 @@ add comment="core loopback via core P2P" dst-address=2606:1c80:0:10::253/128 \
|
|||
gateway=2606:1c80:0:12::1
|
||||
add comment="verona loopback (bootstrap, beats stale BGP)" distance=1 \
|
||||
dst-address=2606:1c80:0:10::101/128 gateway=2606:1c80:0:20::1
|
||||
add comment="494 loopback via P2P" distance=1 dst-address=\
|
||||
2606:1c80:0:10::111/128 gateway=2606:1c80:0:17::2
|
||||
/ip service
|
||||
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||
|
|
|
|||
|
|
@ -34,13 +34,13 @@
|
|||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find !default]
|
||||
/ipv6 nd remove [find default=no]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find !dynamic]
|
||||
/ipv6 route remove [find dynamic=no]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find !dynamic]
|
||||
/ipv6 address remove [find dynamic=no]
|
||||
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
|
|
@ -91,6 +91,21 @@ add dst-address=::/0 gateway=2606:1c80:0:11::1 distance=2 com
|
|||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:1002::1 distance=1 comment="edge loopback via preseem"
|
||||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:11::1 distance=2 comment="edge loopback via direct"
|
||||
|
||||
# Per-tower /128 bootstrap statics. Every iBGP RR client needs core to be
|
||||
# able to reach its loopback BEFORE the iBGP session is up — chicken/egg
|
||||
# otherwise. distance=1 wins until BGP comes up; once it does, the session
|
||||
# itself reflects the same /128 with the same forwarding outcome, so these
|
||||
# statics stay harmlessly more-specific. Towers reached *through* climax
|
||||
# (494) or *through* newhope (lowry) take the long way; directly-attached
|
||||
# towers (982, culleoka, newhope) use the matching P2P.
|
||||
add dst-address=2606:1c80:0:10::101/128 gateway=2606:1c80:0:12::2 distance=1 comment="verona loopback (via climax)"
|
||||
add dst-address=2606:1c80:0:10::102/128 gateway=2606:1c80:0:12::2 distance=1 comment="climax loopback"
|
||||
add dst-address=2606:1c80:0:10::104/128 gateway=2606:1c80:0:15::2 distance=1 comment="culleoka loopback"
|
||||
add dst-address=2606:1c80:0:10::108/128 gateway=2606:1c80:0:13::2 distance=1 comment="newhope loopback"
|
||||
add dst-address=2606:1c80:0:10::109/128 gateway=2606:1c80:0:13::2 distance=1 comment="lowry loopback (via newhope)"
|
||||
add dst-address=2606:1c80:0:10::110/128 gateway=2606:1c80:0:14::2 distance=1 comment="982 loopback"
|
||||
add dst-address=2606:1c80:0:10::111/128 gateway=2606:1c80:0:12::2 distance=1 comment="494 loopback (via climax)"
|
||||
|
||||
# Blackhole core's /44 aggregate so iBGP has the prefix to advertise upward.
|
||||
add dst-address=2606:1c80:1400::/44 blackhole distance=200 comment="core /44 aggregate (iBGP origin)"
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 11:21:08 by RouterOS 7.21.4
|
||||
# 2026-05-09 12:15:11 by RouterOS 7.21.4
|
||||
# software id = XS5B-41QR
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
@ -488,6 +488,16 @@ add comment="verona loopback via climax" dst-address=2606:1c80:0:10::101/128 \
|
|||
gateway=2606:1c80:0:12::2
|
||||
add comment="climax loopback via climax P2P" dst-address=\
|
||||
2606:1c80:0:10::102/128 gateway=2606:1c80:0:12::2
|
||||
add comment="494 loopback (iBGP bootstrap, via climax)" distance=1 \
|
||||
dst-address=2606:1c80:0:10::111/128 gateway=2606:1c80:0:12::2
|
||||
add comment="982 loopback (iBGP bootstrap)" distance=1 dst-address=\
|
||||
2606:1c80:0:10::110/128 gateway=2606:1c80:0:14::2
|
||||
add comment="culleoka loopback (iBGP bootstrap)" distance=1 dst-address=\
|
||||
2606:1c80:0:10::104/128 gateway=2606:1c80:0:15::2
|
||||
add comment="newhope loopback (iBGP bootstrap)" distance=1 dst-address=\
|
||||
2606:1c80:0:10::108/128 gateway=2606:1c80:0:13::2
|
||||
add comment="lowry loopback (via newhope)" distance=1 dst-address=\
|
||||
2606:1c80:0:10::109/128 gateway=2606:1c80:0:13::2
|
||||
/ip service
|
||||
set ftp disabled=yes
|
||||
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||
|
|
|
|||
|
|
@ -27,23 +27,25 @@
|
|||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find !default]
|
||||
/ipv6 nd remove [find default=no]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find !dynamic]
|
||||
/ipv6 route remove [find dynamic=no]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find !dynamic]
|
||||
/ipv6 address remove [find dynamic=no]
|
||||
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
|
||||
/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — BGP instance
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing bgp template set [find name=default] disabled=no
|
||||
|
||||
/routing bgp instance
|
||||
add name=bgp-instance-1 as=393837 router-id=10.254.254.104
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 11:21:08 by RouterOS 7.21.4
|
||||
# 2026-05-09 12:15:11 by RouterOS 7.21.4
|
||||
# software id = HVP9-3G0K
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
@ -212,11 +212,14 @@ add address-pool=clayton disabled=yes interface=vlan_30_clayton lease-time=\
|
|||
10m name=clayton
|
||||
/ip smb users
|
||||
set [ find default=yes ] disabled=yes
|
||||
/ipv6 dhcp-server option
|
||||
add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
/ipv6 pool
|
||||
add name=climax-v6 prefix=2606:1c80:1:4000::/52 prefix-length=64
|
||||
add name=culleoka-cust-pd-1 prefix=2606:1c80:1601::/48 prefix-length=56
|
||||
/ppp profile
|
||||
add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \
|
||||
local-address=100.64.27.253 name=pppoe on-down="{\
|
||||
add change-tcp-mss=yes dhcpv6-pd-pool=culleoka-cust-pd-1 dns-server=\
|
||||
204.110.191.240,204.110.191.20 local-address=100.64.27.253 name=pppoe \
|
||||
on-down="{\
|
||||
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
||||
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
|
||||
7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
|
||||
|
|
@ -324,8 +327,9 @@ add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \
|
|||
\n }\
|
||||
\n} while ( \$attempts < \$max )\
|
||||
\n}\
|
||||
\n" only-one=no remote-address=culleoka-cgnat use-compression=no \
|
||||
use-encryption=no use-ipv6=no use-mpls=no use-upnp=no
|
||||
\n" only-one=no remote-address=culleoka-cgnat remote-ipv6-prefix-pool=\
|
||||
culleoka-cust-pd-1 use-compression=no use-encryption=no use-ipv6=no \
|
||||
use-mpls=no use-upnp=no
|
||||
/queue simple
|
||||
add burst-limit=1/1 burst-threshold=1/1 burst-time=1s/1s limit-at=1/1 \
|
||||
max-limit=1/1 name=Inactive packet-marks=Inactive priority=2/2 target=""
|
||||
|
|
@ -343,19 +347,17 @@ set "ether7-maybe-bad\?" queue=fq-codel
|
|||
set sfp-sfpplus1-10g-switch queue=fq-codel
|
||||
/routing bgp instance
|
||||
add as=393837 name=bgp-instance-1 router-id=10.254.254.104
|
||||
add as=393837 name=bgp-instance-1 router-id=10.254.254.104
|
||||
/routing bgp template
|
||||
set default as=393837 disabled=yes output.network=bgp-networks .redistribute=\
|
||||
set default as=393837 disabled=no output.network=bgp-networks .redistribute=\
|
||||
connected
|
||||
/routing id
|
||||
add disabled=no id=10.254.254.104 name=id-1 select-dynamic-id=""
|
||||
/routing ospf instance
|
||||
add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\
|
||||
ospf-out redistribute=connected router-id=id-1
|
||||
add disabled=no in-filter-chain=ospf-in name=default-v3 out-filter-chain=\
|
||||
ospf-out redistribute=connected router-id=id-1 version=3
|
||||
/routing ospf area
|
||||
add disabled=no instance=default-v2 name=backbone-v2
|
||||
add disabled=no instance=default-v3 name=backbone-v3
|
||||
/snmp community
|
||||
set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
|
||||
kdyyJrT0Mm
|
||||
|
|
@ -373,12 +375,17 @@ add bridge=culleoka disabled=yes ingress-filtering=no interface=*10 \
|
|||
add bridge=mgmt ingress-filtering=no interface=vlan10_ether2 \
|
||||
internal-path-cost=10 path-cost=10
|
||||
/ip firewall connection tracking
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
|
||||
tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
|
||||
tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
|
||||
tcp-time-wait-timeout=2m udp-stream-timeout=2m
|
||||
/ip settings
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set tcp-syncookies=yes
|
||||
/ipv6 settings
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set accept-router-advertisements=no
|
||||
/interface pppoe-server server
|
||||
add accept-empty-service=no authentication=chap,mschap2 default-profile=pppoe \
|
||||
disabled=no interface=ether2-netonix max-mtu=1492 service-name=culleoka
|
||||
|
|
@ -580,6 +587,17 @@ add src-address=100.64.0.0/10
|
|||
add action=deny
|
||||
/ip route
|
||||
add disabled=no dst-address=0.0.0.0/0 gateway=10.250.1.54
|
||||
/ipv6 route
|
||||
add comment="default via core (primary)" distance=1 dst-address=::/0 gateway=\
|
||||
2606:1c80:0:15::1
|
||||
add comment="default via climax (backup, radio down)" distance=100 \
|
||||
dst-address=::/0 gateway=2606:1c80:0:21::1
|
||||
add comment="core loopback (iBGP bootstrap)" distance=1 dst-address=\
|
||||
2606:1c80:0:10::253/128 gateway=2606:1c80:0:15::1
|
||||
add comment="edge loopback via core" distance=1 dst-address=\
|
||||
2606:1c80:0:10::254/128 gateway=2606:1c80:0:15::1
|
||||
add blackhole comment="culleoka /44 aggregate (iBGP origin)" distance=200 \
|
||||
dst-address=2606:1c80:1600::/44
|
||||
/ip service
|
||||
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||
|
|
@ -594,11 +612,38 @@ set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
|
|||
/ip traffic-flow
|
||||
set cache-entries=256k enabled=yes
|
||||
/ipv6 address
|
||||
add address=2606:1c80::4/128 advertise=no interface=*D
|
||||
add address=2606:1c80:1:4000::/52 advertise=no interface=culleoka
|
||||
add address=2606:1c80:0:10::2 interface=ether1-climax-11ghz
|
||||
add address=2606:1c80:0:10::104/128 advertise=no comment=loopback interface=\
|
||||
lo
|
||||
add address=2606:1c80:0:15::2 advertise=no comment="P2P culleoka<->core" \
|
||||
interface=ether6-380-11ghz
|
||||
add address=2606:1c80:0:21::2 advertise=no comment=\
|
||||
"P2P culleoka<->climax (radio DOWN)" interface=ether1-climax-11ghz
|
||||
add address=2606:1c80:1600::1 comment="culleoka mgmt LAN" interface=mgmt
|
||||
/ipv6 dhcp-server
|
||||
add interface=culleoka name=server1 prefix-pool=climax-v6
|
||||
add interface=mgmt name=culleoka-mgmt-stateless
|
||||
/ipv6 firewall filter
|
||||
add action=accept chain=input comment=established connection-state=\
|
||||
established,related
|
||||
add action=drop chain=input comment=invalid connection-state=invalid
|
||||
add action=accept chain=input comment=icmpv6 protocol=icmpv6
|
||||
add action=accept chain=input comment=link-local src-address=fe80::/10
|
||||
add action=accept chain=input comment=internal src-address=2606:1c80::/32
|
||||
add action=drop chain=input comment="default deny"
|
||||
add action=accept chain=forward comment=established connection-state=\
|
||||
established,related
|
||||
add action=drop chain=forward comment=invalid connection-state=invalid
|
||||
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
|
||||
icmpv6
|
||||
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
|
||||
add action=accept chain=forward comment=internal-to-internal dst-address=\
|
||||
2606:1c80::/32 src-address=2606:1c80::/32
|
||||
add action=accept chain=forward comment="v6 outbound from culleoka customers" \
|
||||
src-address=2606:1c80:1600::/44
|
||||
add action=drop chain=forward comment="default deny"
|
||||
/ipv6 nd
|
||||
add advertise-dns=yes interface=mgmt other-configuration=yes
|
||||
/ipv6 nd prefix
|
||||
add interface=mgmt prefix=2606:1c80:1600::/64
|
||||
/mpls interface
|
||||
add interface=ether6-380-11ghz mpls-mtu=1508
|
||||
/mpls ldp
|
||||
|
|
@ -619,24 +664,23 @@ add accounting-backup=yes address=45.76.56.5 disabled=yes \
|
|||
/routing bfd configuration
|
||||
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
|
||||
/routing bgp connection
|
||||
add afi=ip,ipv6 cisco-vpls-nlri-len-fmt=auto-bits connect=yes instance=\
|
||||
bgp-instance-1 listen=yes local.role=ibgp name=culleoka_climax \
|
||||
nexthop-choice=force-self remote.address=10.250.1.14 .as=393837 .port=179 \
|
||||
templates=default
|
||||
add afi=ip,ipv6 comment="iBGP to core (v6 RR), v6 transport" instance=\
|
||||
bgp-instance-1 local.address=2606:1c80:0:10::104 .role=ibgp multihop=yes \
|
||||
name=ibgp-rr-core nexthop-choice=force-self output.filter-chain=\
|
||||
v6-ibgp-out .redistribute=connected,static remote.address=\
|
||||
2606:1c80:0:10::253 .as=393837 templates=default
|
||||
/routing filter rule
|
||||
add chain=ospf-in disabled=no rule="accept;"
|
||||
add chain=ospf-out disabled=no rule="accept;"
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1600::/44 || dst==2\
|
||||
606:1c80:0:10::104/128 || (dst-len==64 && (dst==2606:1c80:0:15::/64 || dst\
|
||||
==2606:1c80:0:21::/64))) { accept; } else { reject; }"
|
||||
/routing ospf interface-template
|
||||
add area=backbone-v2 auth=sha512 auth-id=1 cost=20 disabled=no interfaces=\
|
||||
ether1-climax-11ghz priority=1 type=ptp use-bfd=yes
|
||||
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
||||
ether6-380-11ghz priority=1 type=ptp use-bfd=yes
|
||||
add area=backbone-v3 cost=10 disabled=no passive priority=1 use-bfd=no
|
||||
add area=backbone-v2 disabled=no passive
|
||||
add area=backbone-v3 auth=sha512 auth-id=1 disabled=yes interfaces=\
|
||||
ether1-climax-11ghz type=ptp
|
||||
add area=backbone-v3 auth=sha512 auth-id=1 disabled=yes interfaces=\
|
||||
ether6-380-11ghz type=ptp
|
||||
/routing ospf static-neighbor
|
||||
add address=10.250.1.14%ether1-climax-11ghz area=backbone-v2 comment=climax \
|
||||
disabled=no poll-interval=10s
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# may/09/2026 11:21:08 by RouterOS 6.49.18
|
||||
# may/09/2026 12:15:10 by RouterOS 6.49.18
|
||||
# software id = 8XZE-R7EJ
|
||||
#
|
||||
# model = CCR2004-1G-12S+2XS
|
||||
|
|
|
|||
|
|
@ -22,14 +22,14 @@
|
|||
# WIPE — clean prior v6 config (preserve auto-link-local + Starlink ULA)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 nd remove [find !default]
|
||||
/ipv6 nd remove [find default=no]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 dhcp-server remove [find]
|
||||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 pool remove [find name=home-pd]
|
||||
/ipv6 route remove [find static=yes]
|
||||
/ipv6 address remove [find !dynamic and !disabled]
|
||||
/ipv6 address remove [find dynamic=no and disabled=no]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — settings
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 11:21:08 by RouterOS 7.22.3
|
||||
# 2026-05-09 12:15:10 by RouterOS 7.22.3
|
||||
# software id = ZGNY-ZJW7
|
||||
#
|
||||
# model = RB5009UG+S+
|
||||
|
|
|
|||
|
|
@ -20,23 +20,25 @@
|
|||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find !default]
|
||||
/ipv6 nd remove [find default=no]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find !dynamic]
|
||||
/ipv6 route remove [find dynamic=no]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find !dynamic]
|
||||
/ipv6 address remove [find dynamic=no]
|
||||
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
|
||||
/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — BGP instance
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing bgp template set [find name=default] disabled=no
|
||||
|
||||
/routing bgp instance
|
||||
add name=bgp-instance-1 as=393837 router-id=10.254.254.109
|
||||
|
||||
|
|
@ -48,7 +50,7 @@ add name=bgp-instance-1 as=393837 router-id=10.254.254.109
|
|||
/ipv6 address
|
||||
add address=2606:1c80:0:10::109/128 interface=lo advertise=no comment="loopback"
|
||||
add address=2606:1c80:0:18::2/64 interface=ether1-newhope advertise=no comment="P2P lowry<->newhope"
|
||||
add address=2606:1c80:1900::1/64 interface=mgmt advertise=yes comment="lowry mgmt LAN"
|
||||
add address=2606:1c80:1900::1/64 interface=management advertise=yes comment="lowry mgmt LAN"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — static routes
|
||||
|
|
@ -63,13 +65,13 @@ add dst-address=2606:1c80:1900::/44 blackhole distance=200 comment="lowry /44 ag
|
|||
# APPLY — neighbour discovery on the mgmt LAN
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 nd
|
||||
add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
add interface=management ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
/ipv6 nd prefix
|
||||
add interface=mgmt prefix=2606:1c80:1900::/64 autonomous=yes on-link=yes
|
||||
add interface=management prefix=2606:1c80:1900::/64 autonomous=yes on-link=yes
|
||||
|
||||
/ipv6 dhcp-server
|
||||
add interface=mgmt name=lowry-mgmt-stateless address-pool=static-only
|
||||
add interface=management name=lowry-mgmt-stateless address-pool=static-only
|
||||
|
||||
/ipv6 dhcp-server option
|
||||
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 11:21:08 by RouterOS 7.21.4
|
||||
# 2026-05-09 12:15:11 by RouterOS 7.21.4
|
||||
# software id = 2I9X-PQZP
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
@ -143,11 +143,14 @@ add address-pool=mgmt interface=management lease-script="{\
|
|||
\n" lease-time=1h name=mgmt
|
||||
/ip smb users
|
||||
set [ find default=yes ] disabled=yes
|
||||
/ipv6 dhcp-server option
|
||||
add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
/ipv6 pool
|
||||
add name=lowrycrossing-v6 prefix=2606:1c80:1:6000::/52 prefix-length=64
|
||||
add name=lowry-cust-pd-1 prefix=2606:1c80:1901::/48 prefix-length=56
|
||||
/ppp profile
|
||||
add change-tcp-mss=yes dns-server=204.110.191.20,204.110.191.240 \
|
||||
local-address=100.64.159.254 name=pppoe on-down="{\
|
||||
add change-tcp-mss=yes dhcpv6-pd-pool=lowry-cust-pd-1 dns-server=\
|
||||
204.110.191.20,204.110.191.240 local-address=100.64.159.254 name=pppoe \
|
||||
on-down="{\
|
||||
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
||||
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
|
||||
7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
|
||||
|
|
@ -255,8 +258,9 @@ add change-tcp-mss=yes dns-server=204.110.191.20,204.110.191.240 \
|
|||
\n }\
|
||||
\n} while ( \$attempts < \$max )\
|
||||
\n}\
|
||||
\n" only-one=yes remote-address=cgnat use-compression=no use-encryption=\
|
||||
no use-ipv6=no use-upnp=no
|
||||
\n" only-one=yes remote-address=cgnat remote-ipv6-prefix-pool=\
|
||||
lowry-cust-pd-1 use-compression=no use-encryption=no use-ipv6=no \
|
||||
use-upnp=no
|
||||
/queue type
|
||||
add kind=pcq name=delinquent_download pcq-classifier=dst-address \
|
||||
pcq-dst-address6-mask=64 pcq-rate=64k pcq-src-address6-mask=64 \
|
||||
|
|
@ -312,18 +316,17 @@ set ether5 queue=fq-codel
|
|||
set ether6 queue=fq-codel
|
||||
set ether7 queue=fq-codel
|
||||
set sfp-sfpplus1 queue=fq-codel
|
||||
/routing bgp instance
|
||||
add as=393837 name=bgp-instance-1 router-id=10.254.254.109
|
||||
/routing bgp template
|
||||
set default disabled=yes output.network=bgp-networks
|
||||
set default disabled=no output.network=bgp-networks
|
||||
/routing id
|
||||
add disabled=no id=10.254.254.109 name=id-1 select-dynamic-id=""
|
||||
/routing ospf instance
|
||||
add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\
|
||||
ospf-out redistribute=connected router-id=id-1
|
||||
add disabled=no in-filter-chain=ospf-in name=default-v3 out-filter-chain=\
|
||||
ospf-out redistribute=connected router-id=id-1 version=3
|
||||
/routing ospf area
|
||||
add disabled=no instance=default-v2 name=backbone-v2
|
||||
add disabled=no instance=default-v3 name=backbone-v3
|
||||
/snmp community
|
||||
set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
|
||||
kdyyJrT0Mm
|
||||
|
|
@ -362,12 +365,17 @@ add bridge=management ingress-filtering=no interface=vlan_10_ether6 \
|
|||
add bridge=management ingress-filtering=no interface=vlan_10_ether7 \
|
||||
internal-path-cost=10 path-cost=10
|
||||
/ip firewall connection tracking
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
|
||||
tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
|
||||
tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
|
||||
tcp-time-wait-timeout=2m udp-stream-timeout=2m
|
||||
/ip settings
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set tcp-syncookies=yes
|
||||
/ipv6 settings
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set accept-router-advertisements=no
|
||||
/interface pppoe-server server
|
||||
add default-profile=pppoe disabled=no interface=lowrycrossing max-mtu=1492 \
|
||||
mrru=1600 one-session-per-host=yes service-name=lowrycrossing
|
||||
|
|
@ -1256,6 +1264,15 @@ set [ find default=yes ] dh-group=modp2048 dpd-interval=2m \
|
|||
set cache-path=web-proxy1 port=34133
|
||||
/ip route
|
||||
add disabled=no dst-address=0.0.0.0/0 gateway=10.250.1.110
|
||||
/ipv6 route
|
||||
add comment="default via newhope" distance=1 dst-address=::/0 gateway=\
|
||||
2606:1c80:0:18::1
|
||||
add comment="core loopback (iBGP bootstrap, via newhope)" distance=1 \
|
||||
dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:18::1
|
||||
add comment="edge loopback (via newhope)" distance=1 dst-address=\
|
||||
2606:1c80:0:10::254/128 gateway=2606:1c80:0:18::1
|
||||
add blackhole comment="lowry /44 aggregate (iBGP origin)" distance=200 \
|
||||
dst-address=2606:1c80:1900::/44
|
||||
/ip service
|
||||
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||
|
|
@ -1268,11 +1285,34 @@ set api-ssl certificate=vntx.net.pem_0
|
|||
/ip ssh
|
||||
set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
|
||||
/ipv6 address
|
||||
add address=2606:1c80:1:6000::/52 advertise=no disabled=yes interface=\
|
||||
lowrycrossing
|
||||
add address=2606:1c80:0:9::2 disabled=yes interface=vlan_20_sfpplus1_newhope
|
||||
add address=2606:1c80:0:10::109/128 advertise=no comment=loopback interface=\
|
||||
lo
|
||||
add address=2606:1c80:0:18::2 advertise=no comment="P2P lowry<->newhope" \
|
||||
interface=ether1-newhope
|
||||
add address=2606:1c80:1900::1 comment="lowry mgmt LAN" interface=management
|
||||
/ipv6 dhcp-server
|
||||
add interface=lowrycrossing name=server1 prefix-pool=lowrycrossing-v6
|
||||
add interface=management name=lowry-mgmt-stateless
|
||||
/ipv6 firewall filter
|
||||
add action=accept chain=input comment=established connection-state=\
|
||||
established,related
|
||||
add action=drop chain=input comment=invalid connection-state=invalid
|
||||
add action=accept chain=input comment=icmpv6 protocol=icmpv6
|
||||
add action=accept chain=input comment=link-local src-address=fe80::/10
|
||||
add action=accept chain=input comment=internal src-address=2606:1c80::/32
|
||||
add action=drop chain=input comment="default deny"
|
||||
add action=accept chain=forward comment=established connection-state=\
|
||||
established,related
|
||||
add action=drop chain=forward comment=invalid connection-state=invalid
|
||||
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
|
||||
icmpv6
|
||||
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
|
||||
add action=accept chain=forward comment=internal-to-internal dst-address=\
|
||||
2606:1c80::/32 src-address=2606:1c80::/32
|
||||
add action=accept chain=forward comment="v6 outbound from lowry customers" \
|
||||
src-address=2606:1c80:1900::/44
|
||||
add action=drop chain=forward comment="default deny"
|
||||
/ipv6 nd
|
||||
add advertise-dns=yes interface=management other-configuration=yes
|
||||
/lcd
|
||||
set time-interval=hour
|
||||
/mpls interface
|
||||
|
|
@ -1295,15 +1335,21 @@ add accounting-backup=yes address=45.76.56.5 require-message-auth=no service=\
|
|||
set accept=yes
|
||||
/routing bfd configuration
|
||||
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
|
||||
/routing bgp connection
|
||||
add afi=ip,ipv6 comment="iBGP to core (v6 RR), v6 transport" instance=\
|
||||
bgp-instance-1 local.address=2606:1c80:0:10::109 .role=ibgp multihop=yes \
|
||||
name=ibgp-rr-core nexthop-choice=force-self output.filter-chain=\
|
||||
v6-ibgp-out .redistribute=connected,static remote.address=\
|
||||
2606:1c80:0:10::253 .as=393837 templates=default
|
||||
/routing filter rule
|
||||
add chain=ospf-in disabled=no rule="accept;"
|
||||
add chain=ospf-out disabled=no rule="accept;"
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1900::/44 || dst==2\
|
||||
606:1c80:0:10::109/128 || (dst-len==64 && dst==2606:1c80:0:18::/64)) { acc\
|
||||
ept; } else { reject; }"
|
||||
/routing ospf interface-template
|
||||
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
||||
ether1-newhope priority=1 type=ptp use-bfd=yes
|
||||
add area=backbone-v3 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
||||
ether1-newhope passive priority=1 type=ptp use-bfd=no
|
||||
add area=backbone-v3 cost=10 disabled=no use-bfd=no
|
||||
add area=backbone-v2 disabled=no passive
|
||||
/snmp
|
||||
set contact=graham@vntx.net enabled=yes location="33.160873, -96.540479"
|
||||
|
|
|
|||
|
|
@ -245,11 +245,102 @@ func runOverSSH(r Router, sshPort int, cmd string) ([]byte, error) {
|
|||
return stdout.Bytes(), nil
|
||||
}
|
||||
|
||||
// flattenRSC converts a .rsc-style script (with sticky section paths and
|
||||
// backslash continuations) into a stream of self-contained ROS commands,
|
||||
// one per line. ROS's non-interactive SSH shell treats each line
|
||||
// independently — it does NOT remember the most recent section path the
|
||||
// way /import or the interactive prompt do — so a script like
|
||||
//
|
||||
// /ipv6 address
|
||||
// add address=... interface=...
|
||||
// add address=... interface=...
|
||||
//
|
||||
// fails with "bad command name add" unless we rewrite it as
|
||||
//
|
||||
// /ipv6 address add address=... interface=...
|
||||
// /ipv6 address add address=... interface=...
|
||||
//
|
||||
// before piping it in. This function does that rewrite and also: drops
|
||||
// `#` comments, drops blank lines, and joins lines ending in `\`.
|
||||
func flattenRSC(script []byte) []byte {
|
||||
lines := strings.Split(string(script), "\n")
|
||||
|
||||
// Collapse "\" line-continuations first so we can reason per logical line.
|
||||
var joined []string
|
||||
var carry strings.Builder
|
||||
for _, line := range lines {
|
||||
s := strings.TrimRight(line, "\r")
|
||||
if strings.HasSuffix(s, "\\") {
|
||||
carry.WriteString(strings.TrimSuffix(s, "\\"))
|
||||
carry.WriteString(" ")
|
||||
continue
|
||||
}
|
||||
if carry.Len() > 0 {
|
||||
carry.WriteString(s)
|
||||
joined = append(joined, carry.String())
|
||||
carry.Reset()
|
||||
continue
|
||||
}
|
||||
joined = append(joined, s)
|
||||
}
|
||||
if carry.Len() > 0 {
|
||||
joined = append(joined, carry.String())
|
||||
}
|
||||
|
||||
var out strings.Builder
|
||||
section := ""
|
||||
for _, raw := range joined {
|
||||
s := strings.TrimSpace(raw)
|
||||
if s == "" || strings.HasPrefix(s, "#") {
|
||||
continue
|
||||
}
|
||||
if strings.HasPrefix(s, "/") {
|
||||
// A line starting with `/` is either a section header
|
||||
// (e.g. `/ipv6 address`) or an already-flat command
|
||||
// (e.g. `/ipv6 settings set forward=yes`). We detect a
|
||||
// flat command by the presence of a verb token after
|
||||
// the path words. Heuristic: if the line contains
|
||||
// ` add ` / ` set ` / ` remove ` / ` print ` / ` get`,
|
||||
// it's a flat command — emit as-is and don't change
|
||||
// the section. Otherwise treat the whole line as a
|
||||
// new section path.
|
||||
rest := s
|
||||
isFlat := false
|
||||
for _, verb := range []string{" add ", " add\t", " set ", " set\t", " remove ", " remove\t", " print", " get", " import "} {
|
||||
if strings.Contains(rest, verb) || strings.HasSuffix(rest, " add") || strings.HasSuffix(rest, " set") || strings.HasSuffix(rest, " remove") || strings.HasSuffix(rest, " print") || strings.HasSuffix(rest, " get") {
|
||||
isFlat = true
|
||||
break
|
||||
}
|
||||
}
|
||||
if isFlat {
|
||||
out.WriteString(s)
|
||||
out.WriteByte('\n')
|
||||
continue
|
||||
}
|
||||
section = s
|
||||
continue
|
||||
}
|
||||
if section == "" {
|
||||
// Defensive: command with no preceding section. Send
|
||||
// as-is and let RouterOS report the error.
|
||||
out.WriteString(s)
|
||||
out.WriteByte('\n')
|
||||
continue
|
||||
}
|
||||
out.WriteString(section)
|
||||
out.WriteByte(' ')
|
||||
out.WriteString(s)
|
||||
out.WriteByte('\n')
|
||||
}
|
||||
return []byte(out.String())
|
||||
}
|
||||
|
||||
// runScriptOverSSH pipes a multi-line .rsc script through an SSH session as
|
||||
// if the user had typed it. Each line is parsed by RouterOS's CLI, exactly
|
||||
// like /import does — section paths persist across lines, errors print but
|
||||
// don't abort the rest of the script. A trailing "/quit\n" is appended so
|
||||
// the shell exits cleanly when the file ends.
|
||||
// if the user had typed it. The script is first flattened (section paths
|
||||
// inlined, comments stripped, `\` continuations joined) because ROS's
|
||||
// non-interactive SSH shell forgets the section path between lines.
|
||||
// Per-line errors print but don't abort the rest of the script. A trailing
|
||||
// "/quit\n" is appended so the shell exits when the file ends.
|
||||
func runScriptOverSSH(r Router, sshPort int, script []byte) ([]byte, error) {
|
||||
client, err := dialSSH(r, sshPort)
|
||||
if err != nil {
|
||||
|
|
@ -267,7 +358,7 @@ func runScriptOverSSH(r Router, sshPort int, script []byte) ([]byte, error) {
|
|||
session.Stdout = &stdout
|
||||
session.Stderr = &stderr
|
||||
|
||||
body := append([]byte{}, script...)
|
||||
body := flattenRSC(script)
|
||||
if len(body) == 0 || body[len(body)-1] != '\n' {
|
||||
body = append(body, '\n')
|
||||
}
|
||||
|
|
@ -279,11 +370,15 @@ func runScriptOverSSH(r Router, sshPort int, script []byte) ([]byte, error) {
|
|||
}
|
||||
|
||||
if err := session.Wait(); err != nil {
|
||||
// Wait returns *ssh.ExitMissingError if the server didn't send an
|
||||
// exit status — common for ROS shells that close the channel
|
||||
// without one. Treat as success if we got output.
|
||||
// ROS shells exit with status 1 on /quit (they don't distinguish
|
||||
// "session ended normally" from "command failed"), and sometimes
|
||||
// close the channel without any exit status at all. Both look
|
||||
// like errors to ssh.Session.Wait(); treat them as success.
|
||||
// Real per-line failures show up in the captured stdout where
|
||||
// the user can see them.
|
||||
var exitErr *ssh.ExitError
|
||||
var exitMissing *ssh.ExitMissingError
|
||||
if !errors.As(err, &exitMissing) {
|
||||
if !errors.As(err, &exitErr) && !errors.As(err, &exitMissing) {
|
||||
return stdout.Bytes(), fmt.Errorf("ssh wait: %w (stderr: %s)", err, stderr.String())
|
||||
}
|
||||
}
|
||||
|
|
@ -568,7 +663,10 @@ commands:
|
|||
(e.g. mikrotik-tool api verona /ip/route/print)
|
||||
schema show parameter names accepted under an API path on one router,
|
||||
plus matching examples from local .rsc exports
|
||||
(e.g. mikrotik-tool schema verona /routing/bgp/connection)`)
|
||||
(e.g. mikrotik-tool schema verona /routing/bgp/connection)
|
||||
script push a local .rsc file to one router and run it via SSH; output
|
||||
from the router (errors, /export prints, etc.) is mirrored to
|
||||
stdout (e.g. mikrotik-tool script 494 494-v6-apply.rsc)`)
|
||||
os.Exit(2)
|
||||
}
|
||||
|
||||
|
|
@ -623,6 +721,12 @@ func main() {
|
|||
os.Exit(2)
|
||||
}
|
||||
runSchema(cfg, args[1], args[2])
|
||||
case "script":
|
||||
if len(args) < 3 {
|
||||
fmt.Fprintln(os.Stderr, "usage: mikrotik-tool script <router> <file.rsc>")
|
||||
os.Exit(2)
|
||||
}
|
||||
runScript(cfg, args[1], args[2])
|
||||
default:
|
||||
fmt.Fprintf(os.Stderr, "unknown command: %s\n", args[0])
|
||||
usage()
|
||||
|
|
|
|||
Binary file not shown.
|
|
@ -24,23 +24,25 @@
|
|||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find !default]
|
||||
/ipv6 nd remove [find default=no]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find !dynamic]
|
||||
/ipv6 route remove [find dynamic=no]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find !dynamic]
|
||||
/ipv6 address remove [find dynamic=no]
|
||||
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
|
||||
/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — BGP instance
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing bgp template set [find name=default] disabled=no
|
||||
|
||||
/routing bgp instance
|
||||
add name=bgp-instance-1 as=393837 router-id=10.254.254.108
|
||||
|
||||
|
|
@ -53,7 +55,7 @@ add name=bgp-instance-1 as=393837 router-id=10.254.254.108
|
|||
add address=2606:1c80:0:10::108/128 interface=lo advertise=no comment="loopback"
|
||||
add address=2606:1c80:0:13::2/64 interface=ether2-380 advertise=no comment="P2P newhope<->core"
|
||||
add address=2606:1c80:0:18::1/64 interface=ether6-lowrycrossing advertise=no comment="P2P newhope<->lowry"
|
||||
add address=2606:1c80:1800::1/64 interface=mgmt advertise=yes comment="newhope mgmt LAN"
|
||||
add address=2606:1c80:1800::1/64 interface=bridge_cpe_mgmt advertise=yes comment="newhope mgmt LAN"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — static routes
|
||||
|
|
@ -62,19 +64,26 @@ add address=2606:1c80:1800::1/64 interface=mgmt advertise
|
|||
add dst-address=::/0 gateway=2606:1c80:0:13::1 distance=1 comment="default via core"
|
||||
add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:13::1 distance=1 comment="core loopback (iBGP bootstrap)"
|
||||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:13::1 distance=1 comment="edge loopback via core"
|
||||
|
||||
# Lowry sits one hop further out via the newhope<->lowry P2P. newhope is
|
||||
# the only neighbour that can deliver to lowry's loopback, so we hold a
|
||||
# static for it; without this, traffic for :10::109 from core/edge loops
|
||||
# at newhope until iBGP fully converges.
|
||||
add dst-address=2606:1c80:0:10::109/128 gateway=2606:1c80:0:18::2 distance=1 comment="lowry loopback via P2P"
|
||||
|
||||
add dst-address=2606:1c80:1800::/44 blackhole distance=200 comment="newhope /44 aggregate (iBGP origin)"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — neighbour discovery on the mgmt LAN
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 nd
|
||||
add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
add interface=bridge_cpe_mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
/ipv6 nd prefix
|
||||
add interface=mgmt prefix=2606:1c80:1800::/64 autonomous=yes on-link=yes
|
||||
add interface=bridge_cpe_mgmt prefix=2606:1c80:1800::/64 autonomous=yes on-link=yes
|
||||
|
||||
/ipv6 dhcp-server
|
||||
add interface=mgmt name=newhope-mgmt-stateless address-pool=static-only
|
||||
add interface=bridge_cpe_mgmt name=newhope-mgmt-stateless address-pool=static-only
|
||||
|
||||
/ipv6 dhcp-server option
|
||||
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
|
@ -86,7 +95,7 @@ add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
|||
add name=newhope-cust-pd-1 prefix=2606:1c80:1801::/48 prefix-length=56
|
||||
|
||||
/ppp profile
|
||||
set [find name=pppoe] remote-ipv6-prefix-pool=newhope-cust-pd-1 dhcpv6-pd-pool=newhope-cust-pd-1
|
||||
set [find name=newhope] remote-ipv6-prefix-pool=newhope-cust-pd-1 dhcpv6-pd-pool=newhope-cust-pd-1
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 11:21:08 by RouterOS 7.21.4
|
||||
# 2026-05-09 12:15:11 by RouterOS 7.21.4
|
||||
# software id = 5HTF-YFWV
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
@ -150,12 +150,15 @@ add address-pool=dhcp_pool6 interface=ether7-tower lease-time=1h name=\
|
|||
newhope-tower
|
||||
/ip smb users
|
||||
set [ find default=yes ] disabled=yes
|
||||
/ipv6 dhcp-server option
|
||||
add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
/ipv6 pool
|
||||
add name=newhope-v6 prefix=2606:1c80:1:5000::/52 prefix-length=64
|
||||
add name=newhope-cust-pd-1 prefix=2606:1c80:1801::/48 prefix-length=56
|
||||
/ppp profile
|
||||
set *0 remote-address=dhcp_pool3
|
||||
add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \
|
||||
local-address=100.64.19.253 name=newhope on-down="{\
|
||||
add change-tcp-mss=yes dhcpv6-pd-pool=newhope-cust-pd-1 dns-server=\
|
||||
204.110.191.240,204.110.191.20 local-address=100.64.19.253 name=newhope \
|
||||
on-down="{\
|
||||
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
||||
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
|
||||
7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
|
||||
|
|
@ -263,7 +266,8 @@ add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \
|
|||
\n }\
|
||||
\n} while ( \$attempts < \$max )\
|
||||
\n}\
|
||||
\n" remote-address=cgnat use-upnp=no
|
||||
\n" remote-address=cgnat remote-ipv6-prefix-pool=newhope-cust-pd-1 \
|
||||
use-upnp=no
|
||||
/queue type
|
||||
add kind=pcq name=delinquent_download pcq-classifier=dst-address \
|
||||
pcq-dst-address6-mask=64 pcq-rate=64k pcq-src-address6-mask=64 \
|
||||
|
|
@ -282,19 +286,18 @@ set ether5-switch queue=fq-codel
|
|||
set ether6-lowrycrossing queue=fq-codel
|
||||
set ether7-tower queue=fq-codel
|
||||
set sfp-sfpplus1-edgepoint queue=fq-codel
|
||||
/routing bgp instance
|
||||
add as=393837 name=bgp-instance-1 router-id=10.254.254.108
|
||||
/routing bgp template
|
||||
set default as=393837 disabled=yes output.network=bgp-networks .redistribute=\
|
||||
set default as=393837 disabled=no output.network=bgp-networks .redistribute=\
|
||||
connected
|
||||
/routing id
|
||||
add disabled=no id=10.254.254.108 name=id-1 select-dynamic-id=""
|
||||
/routing ospf instance
|
||||
add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\
|
||||
ospf-out redistribute=connected,rip router-id=id-1
|
||||
add disabled=no in-filter-chain=ospf-in name=default-v3 out-filter-chain=\
|
||||
ospf-out router-id=id-1 version=3
|
||||
/routing ospf area
|
||||
add disabled=no instance=default-v2 name=backbone-v2
|
||||
add disabled=no instance=default-v3 name=backbone-v3
|
||||
/snmp community
|
||||
set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
|
||||
kdyyJrT0Mm
|
||||
|
|
@ -311,12 +314,17 @@ add bridge=newhope ingress-filtering=no interface=combo1 internal-path-cost=\
|
|||
add bridge=newhope interface=ether5-switch
|
||||
add bridge=newhope interface=sfp-sfpplus1-edgepoint
|
||||
/ip firewall connection tracking
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
|
||||
tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
|
||||
tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
|
||||
tcp-time-wait-timeout=2m udp-stream-timeout=2m
|
||||
/ip settings
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set tcp-syncookies=yes
|
||||
/ipv6 settings
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set accept-router-advertisements=no
|
||||
/interface pppoe-server server
|
||||
add authentication=mschap2 default-profile=newhope disabled=no interface=\
|
||||
newhope max-mru=1492 max-mtu=1492 one-session-per-host=yes service-name=\
|
||||
|
|
@ -506,6 +514,17 @@ add disabled=no dst-address=100.64.20.0/22 gateway=10.250.1.105 \
|
|||
routing-table=main
|
||||
add disabled=no dst-address=10.10.144.0/20 gateway=10.250.1.105 \
|
||||
routing-table=main
|
||||
/ipv6 route
|
||||
add comment="default via core" distance=1 dst-address=::/0 gateway=\
|
||||
2606:1c80:0:13::1
|
||||
add comment="core loopback (iBGP bootstrap)" distance=1 dst-address=\
|
||||
2606:1c80:0:10::253/128 gateway=2606:1c80:0:13::1
|
||||
add comment="edge loopback via core" distance=1 dst-address=\
|
||||
2606:1c80:0:10::254/128 gateway=2606:1c80:0:13::1
|
||||
add blackhole comment="newhope /44 aggregate (iBGP origin)" distance=200 \
|
||||
dst-address=2606:1c80:1800::/44
|
||||
add comment="lowry loopback via P2P" distance=1 dst-address=\
|
||||
2606:1c80:0:10::109/128 gateway=2606:1c80:0:18::2
|
||||
/ip service
|
||||
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||
|
|
@ -520,10 +539,40 @@ set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
|
|||
/ip traffic-flow
|
||||
set cache-entries=256k enabled=yes
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:1001::2 interface=ether2-380
|
||||
add address=2606:1c80:0:10::108/128 advertise=no comment=loopback interface=\
|
||||
lo
|
||||
add address=2606:1c80:0:13::2 advertise=no comment="P2P newhope<->core" \
|
||||
interface=ether2-380
|
||||
add address=2606:1c80:0:18::1 advertise=no comment="P2P newhope<->lowry" \
|
||||
interface=ether6-lowrycrossing
|
||||
add address=2606:1c80:1800::1 comment="newhope mgmt LAN" interface=\
|
||||
bridge_cpe_mgmt
|
||||
/ipv6 dhcp-server
|
||||
add disabled=yes interface=sfp-sfpplus1-edgepoint name=server1 prefix-pool=\
|
||||
newhope-v6
|
||||
add interface=bridge_cpe_mgmt name=newhope-mgmt-stateless
|
||||
/ipv6 firewall filter
|
||||
add action=accept chain=input comment=established connection-state=\
|
||||
established,related
|
||||
add action=drop chain=input comment=invalid connection-state=invalid
|
||||
add action=accept chain=input comment=icmpv6 protocol=icmpv6
|
||||
add action=accept chain=input comment=link-local src-address=fe80::/10
|
||||
add action=accept chain=input comment=internal src-address=2606:1c80::/32
|
||||
add action=drop chain=input comment="default deny"
|
||||
add action=accept chain=forward comment=established connection-state=\
|
||||
established,related
|
||||
add action=drop chain=forward comment=invalid connection-state=invalid
|
||||
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
|
||||
icmpv6
|
||||
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
|
||||
add action=accept chain=forward comment=internal-to-internal dst-address=\
|
||||
2606:1c80::/32 src-address=2606:1c80::/32
|
||||
add action=accept chain=forward comment="v6 outbound from newhope customers" \
|
||||
src-address=2606:1c80:1800::/44
|
||||
add action=accept chain=forward comment=\
|
||||
"v6 outbound from lowry customers (transit)" src-address=\
|
||||
2606:1c80:1900::/44
|
||||
add action=drop chain=forward comment="default deny"
|
||||
/ipv6 nd
|
||||
add advertise-dns=yes interface=bridge_cpe_mgmt other-configuration=yes
|
||||
/mpls interface
|
||||
add interface=ether2-380 mpls-mtu=1508
|
||||
add interface=ether6-lowrycrossing mpls-mtu=1508
|
||||
|
|
@ -546,11 +595,20 @@ add accounting-backup=yes address=45.76.56.5 require-message-auth=no service=\
|
|||
set accept=yes
|
||||
/routing bfd configuration
|
||||
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
|
||||
/routing bgp connection
|
||||
add afi=ip,ipv6 comment="iBGP to core (v6 RR), v6 transport" instance=\
|
||||
bgp-instance-1 local.address=2606:1c80:0:10::108 .role=ibgp multihop=yes \
|
||||
name=ibgp-rr-core nexthop-choice=force-self output.filter-chain=\
|
||||
v6-ibgp-out .redistribute=connected,static remote.address=\
|
||||
2606:1c80:0:10::253 .as=393837 templates=default
|
||||
/routing filter rule
|
||||
add chain=ospf-in disabled=no rule="accept;"
|
||||
add chain=ospf-out disabled=no rule="accept;"
|
||||
add chain=bgp-in disabled=no rule="accept;"
|
||||
add chain=bgp-out disabled=no rule="accept;"
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1800::/44 || dst==2\
|
||||
606:1c80:0:10::108/128 || (dst-len==64 && (dst==2606:1c80:0:13::/64 || dst\
|
||||
==2606:1c80:0:18::/64))) { accept; } else { reject; }"
|
||||
/routing ospf interface-template
|
||||
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
||||
ether4 priority=1 type=ptp use-bfd=yes
|
||||
|
|
@ -558,12 +616,7 @@ add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
|||
ether6-lowrycrossing priority=1 type=ptp use-bfd=yes
|
||||
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
||||
ether2-380 priority=1 type=ptp use-bfd=yes
|
||||
add area=backbone-v3 cost=10 disabled=no priority=1 use-bfd=no
|
||||
add area=backbone-v2 disabled=no passive
|
||||
add area=backbone-v3 auth=sha512 auth-id=1 disabled=yes interfaces=ether4 \
|
||||
type=ptp
|
||||
add area=backbone-v3 auth=sha512 auth-id=1 disabled=yes interfaces=ether2-380 \
|
||||
type=ptp
|
||||
/routing rip static-neighbor
|
||||
add address="" disabled=no instance=*1
|
||||
/snmp
|
||||
|
|
|
|||
|
|
@ -27,13 +27,13 @@
|
|||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find !default]
|
||||
/ipv6 nd remove [find default=no]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find !dynamic]
|
||||
/ipv6 route remove [find dynamic=no]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find !dynamic]
|
||||
/ipv6 address remove [find dynamic=no]
|
||||
|
||||
# OSPFv3 — remove the v3 instance, area, interface-template entry, leave v2 alone.
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
|
|
@ -41,7 +41,7 @@
|
|||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
# Any leftover v6 BGP — wipe internal-only, never touch upstream peers.
|
||||
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
|
||||
/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — addresses
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 11:21:08 by RouterOS 7.21.4
|
||||
# 2026-05-09 12:15:10 by RouterOS 7.21.4
|
||||
# software id = Y1CT-1WB1
|
||||
#
|
||||
# model = CCR2004-16G-2S+
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue