graham/network
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

routers update

Browse source
This commit is contained in:
Graham McIntire 2026-05-09 12:15:42 -05:00
parent eba433988a
commit 735168c394
No known key found for this signature in database
GPG key ID: F4ABF488E6029E59
21 changed files with 554 additions and 130 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
mikrotik-tool/494-v6-apply.rsc
View file

@ -20,23 +20,25 @@
/ipv6 dhcp-server option remove [find] /ipv6 dhcp-server option remove [find]
/ipv6 dhcp-client remove [find] /ipv6 dhcp-client remove [find]
/ipv6 nd prefix remove [find] /ipv6 nd prefix remove [find]
/ipv6 nd remove [find !default] /ipv6 nd remove [find default=no]
/ipv6 pool remove [find] /ipv6 pool remove [find]
/ipv6 route remove [find !dynamic] /ipv6 route remove [find dynamic=no]
/ipv6 firewall filter remove [find] /ipv6 firewall filter remove [find]
/ipv6 firewall mangle remove [find] /ipv6 firewall mangle remove [find]
/ipv6 firewall raw remove [find] /ipv6 firewall raw remove [find]
/ipv6 address remove [find !dynamic] /ipv6 address remove [find dynamic=no]
/routing ospf interface-template remove [find area=backbone-v3] /routing ospf interface-template remove [find area=backbone-v3]
/routing ospf area remove [find name=backbone-v3] /routing ospf area remove [find name=backbone-v3]
/routing ospf instance remove [find name=default-v3] /routing ospf instance remove [find name=default-v3]
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"] /routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
# APPLY — BGP instance # APPLY — BGP instance
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
/routing bgp template set [find name=default] disabled=no
/routing bgp instance /routing bgp instance
add name=bgp-instance-1 as=393837 router-id=10.254.254.111 add name=bgp-instance-1 as=393837 router-id=10.254.254.111
@ -48,7 +50,7 @@ add name=bgp-instance-1 as=393837 router-id=10.254.254.111
/ipv6 address /ipv6 address
add address=2606:1c80:0:10::111/128 interface=lo advertise=no comment="loopback" add address=2606:1c80:0:10::111/128 interface=lo advertise=no comment="loopback"
add address=2606:1c80:0:17::2/64 interface=ether2-climax advertise=no comment="P2P 494<->climax" add address=2606:1c80:0:17::2/64 interface=ether2-climax advertise=no comment="P2P 494<->climax"
add address=2606:1c80:1A00::1/64 interface=mgmt advertise=yes comment="494 mgmt LAN" add address=2606:1c80:1A00::1/64 interface=management advertise=yes comment="494 mgmt LAN"
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
# APPLY — static routes # APPLY — static routes
@ -63,13 +65,13 @@ add dst-address=2606:1c80:1A00::/44 blackhole distance=200 comment="494 /44 aggr
# APPLY — neighbour discovery on the mgmt LAN # APPLY — neighbour discovery on the mgmt LAN
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
/ipv6 nd /ipv6 nd
add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes add interface=management ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
/ipv6 nd prefix /ipv6 nd prefix
add interface=mgmt prefix=2606:1c80:1A00::/64 autonomous=yes on-link=yes add interface=management prefix=2606:1c80:1A00::/64 autonomous=yes on-link=yes
/ipv6 dhcp-server /ipv6 dhcp-server
add interface=mgmt name=494-mgmt-stateless address-pool=static-only add interface=management name=494-mgmt-stateless address-pool=static-only
/ipv6 dhcp-server option /ipv6 dhcp-server option
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
@ -81,7 +83,7 @@ add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
add name=494-cust-pd-1 prefix=2606:1c80:1A01::/48 prefix-length=56 add name=494-cust-pd-1 prefix=2606:1c80:1A01::/48 prefix-length=56
/ppp profile /ppp profile
set [find name=pppoe] remote-ipv6-prefix-pool=494-cust-pd-1 dhcpv6-pd-pool=494-cust-pd-1 set [find name=494] remote-ipv6-prefix-pool=494-cust-pd-1 dhcpv6-pd-pool=494-cust-pd-1
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
# APPLY — firewall # APPLY — firewall

74
mikrotik-tool/494.rsc
View file

@ -1,4 +1,4 @@
# 2026-05-09 11:21:08 by RouterOS 7.21.4 # 2026-05-09 12:15:11 by RouterOS 7.21.4
# software id = K4QG-8NQV # software id = K4QG-8NQV
# #
# model = RB5009UG+S+ # model = RB5009UG+S+
@ -217,11 +217,16 @@ add add-arp=yes address-pool=mgmt interface=management lease-script="{\
\n" lease-time=1h name=dhcp2 \n" lease-time=1h name=dhcp2
/ip smb users /ip smb users
set [ find default=yes ] disabled=yes set [ find default=yes ] disabled=yes
/ipv6 dhcp-server option
add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
/ipv6 pool
add name=494-cust-pd-1 prefix=2606:1c80:1a01::/48 prefix-length=56
/ppp profile /ppp profile
set *0 dns-server=204.110.191.240,204.110.191.250 local-address=\ set *0 dns-server=204.110.191.240,204.110.191.250 local-address=\
204.110.188.94 remote-address=public use-upnp=no 204.110.188.94 remote-address=public use-upnp=no
add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \ add change-tcp-mss=yes dhcpv6-pd-pool=494-cust-pd-1 dns-server=\
local-address=100.64.175.254 name=494 on-down="{\ 204.110.191.240,204.110.191.20 local-address=100.64.175.254 name=494 \
on-down="{\
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\ \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\ uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
7f4443-fc8a-4fe0-807c-f535d2aa1865\"\ 7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
@ -329,7 +334,8 @@ add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \
\n }\ \n }\
\n} while ( \$attempts < \$max )\ \n} while ( \$attempts < \$max )\
\n}\ \n}\
\n" remote-address=cgnat use-upnp=no \n" remote-address=cgnat remote-ipv6-prefix-pool=494-cust-pd-1 use-upnp=\
no
/queue type /queue type
add kind=fq-codel name=fq-codel add kind=fq-codel name=fq-codel
/queue interface /queue interface
@ -342,6 +348,9 @@ set ether6 queue=fq-codel
set ether7 queue=fq-codel set ether7 queue=fq-codel
set ether8 queue=fq-codel set ether8 queue=fq-codel
set sfp-sfpplus1 queue=fq-codel set sfp-sfpplus1 queue=fq-codel
/routing bgp instance
add as=393837 name=bgp-instance-1 router-id=10.254.254.111
add as=393837 name=bgp-instance-1 router-id=10.254.254.111
/routing id /routing id
add disabled=no id=10.254.254.111 name=id-1 select-dynamic-id=any \ add disabled=no id=10.254.254.111 name=id-1 select-dynamic-id=any \
select-from-vrf=main select-from-vrf=main
@ -369,14 +378,20 @@ add bridge=management interface=vlan10_ether7 internal-path-cost=10 \
add bridge=management interface=vlan10_ether8 internal-path-cost=10 \ add bridge=management interface=vlan10_ether8 internal-path-cost=10 \
path-cost=10 path-cost=10
/ip firewall connection tracking /ip firewall connection tracking
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \ set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \ tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \ tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
tcp-time-wait-timeout=2m udp-stream-timeout=2m tcp-time-wait-timeout=2m udp-stream-timeout=2m
/ip neighbor discovery-settings /ip neighbor discovery-settings
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
set discover-interface-list=!dynamic set discover-interface-list=!dynamic
/ip settings /ip settings
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
set tcp-syncookies=yes set tcp-syncookies=yes
/ipv6 settings
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
set accept-router-advertisements=no
/interface pppoe-server server /interface pppoe-server server
add default-profile=494 disabled=no interface=494 max-mru=1492 max-mtu=1492 \ add default-profile=494 disabled=no interface=494 max-mru=1492 max-mtu=1492 \
one-session-per-host=yes service-name=494 one-session-per-host=yes service-name=494
@ -429,6 +444,15 @@ set port=43133
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\ add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\
10.250.1.70%ether2-climax pref-src="" routing-table=main scope=30 \ 10.250.1.70%ether2-climax pref-src="" routing-table=main scope=30 \
target-scope=10 target-scope=10
/ipv6 route
add comment="default via climax" distance=1 dst-address=::/0 gateway=\
2606:1c80:0:17::1
add comment="core loopback (iBGP bootstrap, via climax)" distance=1 \
dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:17::1
add comment="edge loopback (via climax)" distance=1 dst-address=\
2606:1c80:0:10::254/128 gateway=2606:1c80:0:17::1
add blackhole comment="494 /44 aggregate (iBGP origin)" distance=200 \
dst-address=2606:1c80:1a00::/44
/ip service /ip service
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
@ -440,8 +464,38 @@ set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10
set api-ssl address=0.0.0.0/0 certificate=myCa set api-ssl address=0.0.0.0/0 certificate=myCa
/ip ssh /ip ssh
set host-key-type=ed25519 password-authentication=yes strong-crypto=yes set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
/ipv6 address
add address=2606:1c80:0:10::111/128 advertise=no comment=loopback interface=\
lo
add address=2606:1c80:0:17::2 advertise=no comment="P2P 494<->climax" \
interface=ether2-climax
add address=2606:1c80:1a00::1 comment="494 mgmt LAN" interface=management
/ipv6 dhcp-server
add interface=management name=494-mgmt-stateless
/ipv6 firewall filter
add action=accept chain=input comment=established connection-state=\
established,related
add action=drop chain=input comment=invalid connection-state=invalid
add action=accept chain=input comment=icmpv6 protocol=icmpv6
add action=accept chain=input comment=link-local src-address=fe80::/10
add action=accept chain=input comment=internal src-address=2606:1c80::/32
add action=drop chain=input comment="default deny"
add action=accept chain=forward comment=established connection-state=\
established,related
add action=drop chain=forward comment=invalid connection-state=invalid
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
icmpv6
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
add action=accept chain=forward comment=internal-to-internal dst-address=\
2606:1c80::/32 src-address=2606:1c80::/32
add action=accept chain=forward comment="v6 outbound from 494 customers" \
src-address=2606:1c80:1a00::/44
add action=drop chain=forward comment="default deny"
/ipv6 nd /ipv6 nd
set [ find default=yes ] advertise-dns=yes set [ find default=yes ] advertise-dns=yes
add advertise-dns=yes interface=management other-configuration=yes
/ipv6 nd prefix
add interface=management prefix=2606:1c80:1a00::/64
/mpls interface /mpls interface
add interface=ether2-climax mpls-mtu=1508 add interface=ether2-climax mpls-mtu=1508
/mpls ldp /mpls ldp
@ -462,10 +516,22 @@ add accounting-backup=yes address=45.76.56.5 disabled=yes \
/routing bfd configuration /routing bfd configuration
add disabled=no interfaces=ether2-climax min-rx=200ms min-tx=200ms \ add disabled=no interfaces=ether2-climax min-rx=200ms min-tx=200ms \
multiplier=5 vrf=main multiplier=5 vrf=main
/routing bgp connection
add afi=ip,ipv6 comment="iBGP to core (v6 RR), v6 transport" instance=\
bgp-instance-1 local.address=2606:1c80:0:10::111 .role=ibgp multihop=yes \
name=ibgp-rr-core nexthop-choice=force-self output.filter-chain=\
v6-ibgp-out .redistribute=connected,static remote.address=\
2606:1c80:0:10::253 .as=393837 templates=default
/routing filter rule /routing filter rule
add chain=ospf-in disabled=no rule="accept;\r\ add chain=ospf-in disabled=no rule="accept;\r\
\n" \n"
add chain=ospf-out disabled=no rule="accept;" add chain=ospf-out disabled=no rule="accept;"
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1A00::/44 || dst==2\
606:1c80:0:10::111/128 || (dst-len==64 && dst==2606:1c80:0:17::/64)) { acc\
ept; } else { reject; }"
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1A00::/44 || dst==2\
606:1c80:0:10::111/128 || (dst-len==64 && dst==2606:1c80:0:17::/64)) { acc\
ept; } else { reject; }"
/routing ospf interface-template /routing ospf interface-template
add area=ospf-area-1 auth=sha512 auth-id=1 disabled=no interfaces=\ add area=ospf-area-1 auth=sha512 auth-id=1 disabled=no interfaces=\
ether2-climax type=ptp use-bfd=no ether2-climax type=ptp use-bfd=no

12
mikrotik-tool/982-v6-apply.rsc
View file

@ -20,23 +20,25 @@
/ipv6 dhcp-server option remove [find] /ipv6 dhcp-server option remove [find]
/ipv6 dhcp-client remove [find] /ipv6 dhcp-client remove [find]
/ipv6 nd prefix remove [find] /ipv6 nd prefix remove [find]
/ipv6 nd remove [find !default] /ipv6 nd remove [find default=no]
/ipv6 pool remove [find] /ipv6 pool remove [find]
/ipv6 route remove [find !dynamic] /ipv6 route remove [find dynamic=no]
/ipv6 firewall filter remove [find] /ipv6 firewall filter remove [find]
/ipv6 firewall mangle remove [find] /ipv6 firewall mangle remove [find]
/ipv6 firewall raw remove [find] /ipv6 firewall raw remove [find]
/ipv6 address remove [find !dynamic] /ipv6 address remove [find dynamic=no]
/routing ospf interface-template remove [find area=backbone-v3] /routing ospf interface-template remove [find area=backbone-v3]
/routing ospf area remove [find name=backbone-v3] /routing ospf area remove [find name=backbone-v3]
/routing ospf instance remove [find name=default-v3] /routing ospf instance remove [find name=default-v3]
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"] /routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
# APPLY — BGP instance # APPLY — BGP instance
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
/routing bgp template set [find name=default] disabled=no
/routing bgp instance /routing bgp instance
add name=bgp-instance-1 as=393837 router-id=10.254.254.110 add name=bgp-instance-1 as=393837 router-id=10.254.254.110
@ -81,7 +83,7 @@ add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
add name=982-cust-pd-1 prefix=2606:1c80:1301::/48 prefix-length=56 add name=982-cust-pd-1 prefix=2606:1c80:1301::/48 prefix-length=56
/ppp profile /ppp profile
set [find name=pppoe] remote-ipv6-prefix-pool=982-cust-pd-1 dhcpv6-pd-pool=982-cust-pd-1 set [find name=982] remote-ipv6-prefix-pool=982-cust-pd-1 dhcpv6-pd-pool=982-cust-pd-1
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
# APPLY — firewall # APPLY — firewall

69
mikrotik-tool/982.rsc
View file

@ -1,4 +1,4 @@
# 2026-05-09 11:21:08 by RouterOS 7.21.4 # 2026-05-09 12:15:11 by RouterOS 7.21.4
# software id = FUVS-HCM5 # software id = FUVS-HCM5
# #
# model = CCR1009-7G-1C-1S+ # model = CCR1009-7G-1C-1S+
@ -120,8 +120,13 @@ add address-pool=mgmt interface=mgmt lease-script="{\
\n" lease-time=10m name=mgmt \n" lease-time=10m name=mgmt
/ip smb users /ip smb users
set [ find default=yes ] disabled=yes set [ find default=yes ] disabled=yes
/ipv6 dhcp-server option
add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
/ipv6 pool
add name=982-cust-pd-1 prefix=2606:1c80:1301::/48 prefix-length=56
/ppp profile /ppp profile
add local-address=100.64.63.253 name=982 on-down="{\ add dhcpv6-pd-pool=982-cust-pd-1 local-address=100.64.63.253 name=982 \
on-down="{\
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\ \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\ uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
7f4443-fc8a-4fe0-807c-f535d2aa1865\"\ 7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
@ -229,7 +234,7 @@ add local-address=100.64.63.253 name=982 on-down="{\
\n }\ \n }\
\n} while ( \$attempts < \$max )\ \n} while ( \$attempts < \$max )\
\n}\ \n}\
\n" remote-address=cgnat \n" remote-address=cgnat remote-ipv6-prefix-pool=982-cust-pd-1
/queue type /queue type
add kind=fq-codel name=fq-codel add kind=fq-codel name=fq-codel
/queue interface /queue interface
@ -242,6 +247,8 @@ set ether5 queue=fq-codel
set ether6 queue=fq-codel set ether6 queue=fq-codel
set ether7-380 queue=fq-codel set ether7-380 queue=fq-codel
set sfp-sfpplus1 queue=fq-codel set sfp-sfpplus1 queue=fq-codel
/routing bgp instance
add as=393837 name=bgp-instance-1 router-id=10.254.254.110
/routing bgp template /routing bgp template
set default disabled=no set default disabled=no
/routing id /routing id
@ -249,10 +256,8 @@ add disabled=no id=10.254.254.110 name=id-1 select-dynamic-id=""
/routing ospf instance /routing ospf instance
add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\ add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\
ospf-out redistribute=connected router-id=id-1 ospf-out redistribute=connected router-id=id-1
add disabled=no name=default-v3 router-id=id-1 version=3
/routing ospf area /routing ospf area
add disabled=no instance=default-v2 name=backbone-v2 add disabled=no instance=default-v2 name=backbone-v2
add disabled=no instance=default-v3 name=backbone-v3
/snmp community /snmp community
set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\ set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
kdyyJrT0Mm kdyyJrT0Mm
@ -285,12 +290,17 @@ add bridge=mgmt ingress-filtering=no interface=vlan10_ether6 \
internal-path-cost=10 path-cost=10 internal-path-cost=10 path-cost=10
add bridge=982 interface=combo1 add bridge=982 interface=combo1
/ip firewall connection tracking /ip firewall connection tracking
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \ set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \ tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \ tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
tcp-time-wait-timeout=2m udp-stream-timeout=2m tcp-time-wait-timeout=2m udp-stream-timeout=2m
/ip settings /ip settings
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
set tcp-syncookies=yes set tcp-syncookies=yes
/ipv6 settings
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
set accept-router-advertisements=no
/interface pppoe-server server /interface pppoe-server server
add authentication=mschap2 default-profile=982 disabled=no interface=982 \ add authentication=mschap2 default-profile=982 disabled=no interface=982 \
one-session-per-host=yes service-name=982 one-session-per-host=yes service-name=982
@ -376,6 +386,15 @@ set [ find default=yes ] dh-group=modp2048 dpd-interval=2m \
set port=48348 set port=48348
/ip route /ip route
add disabled=no dst-address=0.0.0.0/0 gateway=10.250.1.38 add disabled=no dst-address=0.0.0.0/0 gateway=10.250.1.38
/ipv6 route
add comment="default via core" distance=1 dst-address=::/0 gateway=\
2606:1c80:0:14::1
add comment="core loopback (iBGP bootstrap)" distance=1 dst-address=\
2606:1c80:0:10::253/128 gateway=2606:1c80:0:14::1
add comment="edge loopback via core" distance=1 dst-address=\
2606:1c80:0:10::254/128 gateway=2606:1c80:0:14::1
add blackhole comment="982 /44 aggregate (iBGP origin)" distance=200 \
dst-address=2606:1c80:1300::/44
/ip service /ip service
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
@ -387,8 +406,38 @@ set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10
set api-ssl certificate=ca-template set api-ssl certificate=ca-template
/ip ssh /ip ssh
set host-key-type=ed25519 password-authentication=yes strong-crypto=yes set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
/ipv6 address
add address=2606:1c80:0:10::110/128 advertise=no comment=loopback interface=\
lo
add address=2606:1c80:0:14::2 advertise=no comment="P2P 982<->core (60GHz)" \
interface=ether7-380
add address=2606:1c80:1300::1 comment="982 mgmt LAN" interface=mgmt
/ipv6 dhcp-server
add interface=mgmt name=982-mgmt-stateless
/ipv6 firewall filter
add action=accept chain=input comment=established connection-state=\
established,related
add action=drop chain=input comment=invalid connection-state=invalid
add action=accept chain=input comment=icmpv6 protocol=icmpv6
add action=accept chain=input comment=link-local src-address=fe80::/10
add action=accept chain=input comment=internal src-address=2606:1c80::/32
add action=drop chain=input comment="default deny"
add action=accept chain=forward comment=established connection-state=\
established,related
add action=drop chain=forward comment=invalid connection-state=invalid
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
icmpv6
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
add action=accept chain=forward comment=internal-to-internal dst-address=\
2606:1c80::/32 src-address=2606:1c80::/32
add action=accept chain=forward comment="v6 outbound from 982 customers" \
src-address=2606:1c80:1300::/44
add action=drop chain=forward comment="default deny"
/ipv6 nd /ipv6 nd
set [ find default=yes ] advertise-dns=yes set [ find default=yes ] advertise-dns=yes
add advertise-dns=yes interface=mgmt other-configuration=yes
/ipv6 nd prefix
add interface=mgmt prefix=2606:1c80:1300::/64
/mpls interface /mpls interface
add interface=ether7-380 mpls-mtu=1508 add interface=ether7-380 mpls-mtu=1508
/mpls ldp /mpls ldp
@ -408,14 +457,22 @@ add accounting-backup=yes address=45.76.56.5 disabled=yes \
300ms 300ms
/routing bfd configuration /routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5 add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/routing bgp connection
add afi=ip,ipv6 comment="iBGP to core (v6 RR), v6 transport" instance=\
bgp-instance-1 local.address=2606:1c80:0:10::110 .role=ibgp multihop=yes \
name=ibgp-rr-core nexthop-choice=force-self output.filter-chain=\
v6-ibgp-out .redistribute=connected,static remote.address=\
2606:1c80:0:10::253 .as=393837 templates=default
/routing filter rule /routing filter rule
add chain=ospf-in disabled=no rule="accept;" add chain=ospf-in disabled=no rule="accept;"
add chain=ospf-out disabled=no rule="accept;" add chain=ospf-out disabled=no rule="accept;"
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1300::/44 || dst==2\
606:1c80:0:10::110/128 || (dst-len==64 && dst==2606:1c80:0:14::/64)) { acc\
ept; } else { reject; }"
/routing ospf interface-template /routing ospf interface-template
add area=backbone-v2 auth-id=1 cost=10 disabled=no interfaces=ether7-380 \ add area=backbone-v2 auth-id=1 cost=10 disabled=no interfaces=ether7-380 \
networks=10.250.1.32/29 priority=1 type=ptp use-bfd=no networks=10.250.1.32/29 priority=1 type=ptp use-bfd=no
add area=backbone-v2 disabled=no passive add area=backbone-v2 disabled=no passive
add area=backbone-v3 disabled=no passive
/snmp /snmp
set contact=graham@vntx.net enabled=yes location="33.148902, -96.495811" set contact=graham@vntx.net enabled=yes location="33.148902, -96.495811"
/system clock /system clock

18
mikrotik-tool/climax-v6-apply.rsc
View file

@ -27,13 +27,13 @@
/ipv6 dhcp-server option remove [find] /ipv6 dhcp-server option remove [find]
/ipv6 dhcp-client remove [find] /ipv6 dhcp-client remove [find]
/ipv6 nd prefix remove [find] /ipv6 nd prefix remove [find]
/ipv6 nd remove [find !default] /ipv6 nd remove [find default=no]
/ipv6 pool remove [find] /ipv6 pool remove [find]
/ipv6 route remove [find !dynamic] /ipv6 route remove [find dynamic=no]
/ipv6 firewall filter remove [find] /ipv6 firewall filter remove [find]
/ipv6 firewall mangle remove [find] /ipv6 firewall mangle remove [find]
/ipv6 firewall raw remove [find] /ipv6 firewall raw remove [find]
/ipv6 address remove [find !dynamic] /ipv6 address remove [find dynamic=no]
# OSPFv3 — instance, area, and the orphan culleoka-11ghz template entry # OSPFv3 — instance, area, and the orphan culleoka-11ghz template entry
# (currently lives under area=backbone-v3) all get removed. # (currently lives under area=backbone-v3) all get removed.
@ -42,7 +42,7 @@
/routing ospf instance remove [find name=default-v3] /routing ospf instance remove [find name=default-v3]
# Drop any stale internal v6 iBGP peers (none present, but defensive). # Drop any stale internal v6 iBGP peers (none present, but defensive).
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"] /routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
# APPLY — BGP instance (climax has none today) # APPLY — BGP instance (climax has none today)
@ -75,6 +75,16 @@ add dst-address=::/0 gateway=2606:1c80:0:12::1 distance=1 com
# entry helps iBGP control plane converge quickly on first bring-up). # entry helps iBGP control plane converge quickly on first bring-up).
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:12::1 distance=1 comment="edge loopback via core" add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:12::1 distance=1 comment="edge loopback via core"
# 494 sits one hop further out via the climax<->494 P2P; climax is the
# only neighbour that can deliver to its loopback. Without this, return
# traffic for 494's /128 from core/edge loops at climax.
add dst-address=2606:1c80:0:10::111/128 gateway=2606:1c80:0:17::2 distance=1 comment="494 loopback via P2P"
# verona's loopback is reachable through verona's own P2P side. Adding
# this static beats the BGP-learned next-hop during convergence and
# avoids the stale-next-hop loop we hit on 2026-05-09.
add dst-address=2606:1c80:0:10::101/128 gateway=2606:1c80:0:20::1 distance=1 comment="verona loopback via P2P"
# Blackhole climax's /44 aggregate so iBGP has the prefix to advertise. # Blackhole climax's /44 aggregate so iBGP has the prefix to advertise.
add dst-address=2606:1c80:1100::/44 blackhole distance=200 comment="climax /44 aggregate (iBGP origin)" add dst-address=2606:1c80:1100::/44 blackhole distance=200 comment="climax /44 aggregate (iBGP origin)"

4
mikrotik-tool/climax.rsc
View file

@ -1,4 +1,4 @@
# 2026-05-09 11:21:08 by RouterOS 7.21.4 # 2026-05-09 12:15:10 by RouterOS 7.21.4
# software id = UETF-WF31 # software id = UETF-WF31
# #
# model = CCR2004-16G-2S+ # model = CCR2004-16G-2S+
@ -405,6 +405,8 @@ add comment="core loopback via core P2P" dst-address=2606:1c80:0:10::253/128 \
gateway=2606:1c80:0:12::1 gateway=2606:1c80:0:12::1
add comment="verona loopback (bootstrap, beats stale BGP)" distance=1 \ add comment="verona loopback (bootstrap, beats stale BGP)" distance=1 \
dst-address=2606:1c80:0:10::101/128 gateway=2606:1c80:0:20::1 dst-address=2606:1c80:0:10::101/128 gateway=2606:1c80:0:20::1
add comment="494 loopback via P2P" distance=1 dst-address=\
2606:1c80:0:10::111/128 gateway=2606:1c80:0:17::2
/ip service /ip service
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes

21
mikrotik-tool/core-v6-apply.rsc
View file

@ -34,13 +34,13 @@
/ipv6 dhcp-server option remove [find] /ipv6 dhcp-server option remove [find]
/ipv6 dhcp-client remove [find] /ipv6 dhcp-client remove [find]
/ipv6 nd prefix remove [find] /ipv6 nd prefix remove [find]
/ipv6 nd remove [find !default] /ipv6 nd remove [find default=no]
/ipv6 pool remove [find] /ipv6 pool remove [find]
/ipv6 route remove [find !dynamic] /ipv6 route remove [find dynamic=no]
/ipv6 firewall filter remove [find] /ipv6 firewall filter remove [find]
/ipv6 firewall mangle remove [find] /ipv6 firewall mangle remove [find]
/ipv6 firewall raw remove [find] /ipv6 firewall raw remove [find]
/ipv6 address remove [find !dynamic] /ipv6 address remove [find dynamic=no]
/routing ospf interface-template remove [find area=backbone-v3] /routing ospf interface-template remove [find area=backbone-v3]
/routing ospf area remove [find name=backbone-v3] /routing ospf area remove [find name=backbone-v3]
@ -91,6 +91,21 @@ add dst-address=::/0 gateway=2606:1c80:0:11::1 distance=2 com
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:1002::1 distance=1 comment="edge loopback via preseem" add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:1002::1 distance=1 comment="edge loopback via preseem"
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:11::1 distance=2 comment="edge loopback via direct" add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:11::1 distance=2 comment="edge loopback via direct"
# Per-tower /128 bootstrap statics. Every iBGP RR client needs core to be
# able to reach its loopback BEFORE the iBGP session is up — chicken/egg
# otherwise. distance=1 wins until BGP comes up; once it does, the session
# itself reflects the same /128 with the same forwarding outcome, so these
# statics stay harmlessly more-specific. Towers reached *through* climax
# (494) or *through* newhope (lowry) take the long way; directly-attached
# towers (982, culleoka, newhope) use the matching P2P.
add dst-address=2606:1c80:0:10::101/128 gateway=2606:1c80:0:12::2 distance=1 comment="verona loopback (via climax)"
add dst-address=2606:1c80:0:10::102/128 gateway=2606:1c80:0:12::2 distance=1 comment="climax loopback"
add dst-address=2606:1c80:0:10::104/128 gateway=2606:1c80:0:15::2 distance=1 comment="culleoka loopback"
add dst-address=2606:1c80:0:10::108/128 gateway=2606:1c80:0:13::2 distance=1 comment="newhope loopback"
add dst-address=2606:1c80:0:10::109/128 gateway=2606:1c80:0:13::2 distance=1 comment="lowry loopback (via newhope)"
add dst-address=2606:1c80:0:10::110/128 gateway=2606:1c80:0:14::2 distance=1 comment="982 loopback"
add dst-address=2606:1c80:0:10::111/128 gateway=2606:1c80:0:12::2 distance=1 comment="494 loopback (via climax)"
# Blackhole core's /44 aggregate so iBGP has the prefix to advertise upward. # Blackhole core's /44 aggregate so iBGP has the prefix to advertise upward.
add dst-address=2606:1c80:1400::/44 blackhole distance=200 comment="core /44 aggregate (iBGP origin)" add dst-address=2606:1c80:1400::/44 blackhole distance=200 comment="core /44 aggregate (iBGP origin)"

12
mikrotik-tool/core.rsc
View file

@ -1,4 +1,4 @@
# 2026-05-09 11:21:08 by RouterOS 7.21.4 # 2026-05-09 12:15:11 by RouterOS 7.21.4
# software id = XS5B-41QR # software id = XS5B-41QR
# #
# model = CCR1009-7G-1C-1S+ # model = CCR1009-7G-1C-1S+
@ -488,6 +488,16 @@ add comment="verona loopback via climax" dst-address=2606:1c80:0:10::101/128 \
gateway=2606:1c80:0:12::2 gateway=2606:1c80:0:12::2
add comment="climax loopback via climax P2P" dst-address=\ add comment="climax loopback via climax P2P" dst-address=\
2606:1c80:0:10::102/128 gateway=2606:1c80:0:12::2 2606:1c80:0:10::102/128 gateway=2606:1c80:0:12::2
add comment="494 loopback (iBGP bootstrap, via climax)" distance=1 \
dst-address=2606:1c80:0:10::111/128 gateway=2606:1c80:0:12::2
add comment="982 loopback (iBGP bootstrap)" distance=1 dst-address=\
2606:1c80:0:10::110/128 gateway=2606:1c80:0:14::2
add comment="culleoka loopback (iBGP bootstrap)" distance=1 dst-address=\
2606:1c80:0:10::104/128 gateway=2606:1c80:0:15::2
add comment="newhope loopback (iBGP bootstrap)" distance=1 dst-address=\
2606:1c80:0:10::108/128 gateway=2606:1c80:0:13::2
add comment="lowry loopback (via newhope)" distance=1 dst-address=\
2606:1c80:0:10::109/128 gateway=2606:1c80:0:13::2
/ip service /ip service
set ftp disabled=yes set ftp disabled=yes
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes

10
mikrotik-tool/culleoka-v6-apply.rsc
View file

@ -27,23 +27,25 @@
/ipv6 dhcp-server option remove [find] /ipv6 dhcp-server option remove [find]
/ipv6 dhcp-client remove [find] /ipv6 dhcp-client remove [find]
/ipv6 nd prefix remove [find] /ipv6 nd prefix remove [find]
/ipv6 nd remove [find !default] /ipv6 nd remove [find default=no]
/ipv6 pool remove [find] /ipv6 pool remove [find]
/ipv6 route remove [find !dynamic] /ipv6 route remove [find dynamic=no]
/ipv6 firewall filter remove [find] /ipv6 firewall filter remove [find]
/ipv6 firewall mangle remove [find] /ipv6 firewall mangle remove [find]
/ipv6 firewall raw remove [find] /ipv6 firewall raw remove [find]
/ipv6 address remove [find !dynamic] /ipv6 address remove [find dynamic=no]
/routing ospf interface-template remove [find area=backbone-v3] /routing ospf interface-template remove [find area=backbone-v3]
/routing ospf area remove [find name=backbone-v3] /routing ospf area remove [find name=backbone-v3]
/routing ospf instance remove [find name=default-v3] /routing ospf instance remove [find name=default-v3]
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"] /routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
# APPLY — BGP instance # APPLY — BGP instance
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
/routing bgp template set [find name=default] disabled=no
/routing bgp instance /routing bgp instance
add name=bgp-instance-1 as=393837 router-id=10.254.254.104 add name=bgp-instance-1 as=393837 router-id=10.254.254.104

90
mikrotik-tool/culleoka.rsc
View file

@ -1,4 +1,4 @@
# 2026-05-09 11:21:08 by RouterOS 7.21.4 # 2026-05-09 12:15:11 by RouterOS 7.21.4
# software id = HVP9-3G0K # software id = HVP9-3G0K
# #
# model = CCR1009-7G-1C-1S+ # model = CCR1009-7G-1C-1S+
@ -212,11 +212,14 @@ add address-pool=clayton disabled=yes interface=vlan_30_clayton lease-time=\
10m name=clayton 10m name=clayton
/ip smb users /ip smb users
set [ find default=yes ] disabled=yes set [ find default=yes ] disabled=yes
/ipv6 dhcp-server option
add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
/ipv6 pool /ipv6 pool
add name=climax-v6 prefix=2606:1c80:1:4000::/52 prefix-length=64 add name=culleoka-cust-pd-1 prefix=2606:1c80:1601::/48 prefix-length=56
/ppp profile /ppp profile
add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \ add change-tcp-mss=yes dhcpv6-pd-pool=culleoka-cust-pd-1 dns-server=\
local-address=100.64.27.253 name=pppoe on-down="{\ 204.110.191.240,204.110.191.20 local-address=100.64.27.253 name=pppoe \
on-down="{\
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\ \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\ uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
7f4443-fc8a-4fe0-807c-f535d2aa1865\"\ 7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
@ -324,8 +327,9 @@ add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \
\n }\ \n }\
\n} while ( \$attempts < \$max )\ \n} while ( \$attempts < \$max )\
\n}\ \n}\
\n" only-one=no remote-address=culleoka-cgnat use-compression=no \ \n" only-one=no remote-address=culleoka-cgnat remote-ipv6-prefix-pool=\
use-encryption=no use-ipv6=no use-mpls=no use-upnp=no culleoka-cust-pd-1 use-compression=no use-encryption=no use-ipv6=no \
use-mpls=no use-upnp=no
/queue simple /queue simple
add burst-limit=1/1 burst-threshold=1/1 burst-time=1s/1s limit-at=1/1 \ add burst-limit=1/1 burst-threshold=1/1 burst-time=1s/1s limit-at=1/1 \
max-limit=1/1 name=Inactive packet-marks=Inactive priority=2/2 target="" max-limit=1/1 name=Inactive packet-marks=Inactive priority=2/2 target=""
@ -343,19 +347,17 @@ set "ether7-maybe-bad\?" queue=fq-codel
set sfp-sfpplus1-10g-switch queue=fq-codel set sfp-sfpplus1-10g-switch queue=fq-codel
/routing bgp instance /routing bgp instance
add as=393837 name=bgp-instance-1 router-id=10.254.254.104 add as=393837 name=bgp-instance-1 router-id=10.254.254.104
add as=393837 name=bgp-instance-1 router-id=10.254.254.104
/routing bgp template /routing bgp template
set default as=393837 disabled=yes output.network=bgp-networks .redistribute=\ set default as=393837 disabled=no output.network=bgp-networks .redistribute=\
connected connected
/routing id /routing id
add disabled=no id=10.254.254.104 name=id-1 select-dynamic-id="" add disabled=no id=10.254.254.104 name=id-1 select-dynamic-id=""
/routing ospf instance /routing ospf instance
add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\ add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\
ospf-out redistribute=connected router-id=id-1 ospf-out redistribute=connected router-id=id-1
add disabled=no in-filter-chain=ospf-in name=default-v3 out-filter-chain=\
ospf-out redistribute=connected router-id=id-1 version=3
/routing ospf area /routing ospf area
add disabled=no instance=default-v2 name=backbone-v2 add disabled=no instance=default-v2 name=backbone-v2
add disabled=no instance=default-v3 name=backbone-v3
/snmp community /snmp community
set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\ set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
kdyyJrT0Mm kdyyJrT0Mm
@ -373,12 +375,17 @@ add bridge=culleoka disabled=yes ingress-filtering=no interface=*10 \
add bridge=mgmt ingress-filtering=no interface=vlan10_ether2 \ add bridge=mgmt ingress-filtering=no interface=vlan10_ether2 \
internal-path-cost=10 path-cost=10 internal-path-cost=10 path-cost=10
/ip firewall connection tracking /ip firewall connection tracking
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \ set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \ tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \ tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
tcp-time-wait-timeout=2m udp-stream-timeout=2m tcp-time-wait-timeout=2m udp-stream-timeout=2m
/ip settings /ip settings
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
set tcp-syncookies=yes set tcp-syncookies=yes
/ipv6 settings
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
set accept-router-advertisements=no
/interface pppoe-server server /interface pppoe-server server
add accept-empty-service=no authentication=chap,mschap2 default-profile=pppoe \ add accept-empty-service=no authentication=chap,mschap2 default-profile=pppoe \
disabled=no interface=ether2-netonix max-mtu=1492 service-name=culleoka disabled=no interface=ether2-netonix max-mtu=1492 service-name=culleoka
@ -580,6 +587,17 @@ add src-address=100.64.0.0/10
add action=deny add action=deny
/ip route /ip route
add disabled=no dst-address=0.0.0.0/0 gateway=10.250.1.54 add disabled=no dst-address=0.0.0.0/0 gateway=10.250.1.54
/ipv6 route
add comment="default via core (primary)" distance=1 dst-address=::/0 gateway=\
2606:1c80:0:15::1
add comment="default via climax (backup, radio down)" distance=100 \
dst-address=::/0 gateway=2606:1c80:0:21::1
add comment="core loopback (iBGP bootstrap)" distance=1 dst-address=\
2606:1c80:0:10::253/128 gateway=2606:1c80:0:15::1
add comment="edge loopback via core" distance=1 dst-address=\
2606:1c80:0:10::254/128 gateway=2606:1c80:0:15::1
add blackhole comment="culleoka /44 aggregate (iBGP origin)" distance=200 \
dst-address=2606:1c80:1600::/44
/ip service /ip service
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
@ -594,11 +612,38 @@ set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
/ip traffic-flow /ip traffic-flow
set cache-entries=256k enabled=yes set cache-entries=256k enabled=yes
/ipv6 address /ipv6 address
add address=2606:1c80::4/128 advertise=no interface=*D add address=2606:1c80:0:10::104/128 advertise=no comment=loopback interface=\
add address=2606:1c80:1:4000::/52 advertise=no interface=culleoka lo
add address=2606:1c80:0:10::2 interface=ether1-climax-11ghz add address=2606:1c80:0:15::2 advertise=no comment="P2P culleoka<->core" \
interface=ether6-380-11ghz
add address=2606:1c80:0:21::2 advertise=no comment=\
"P2P culleoka<->climax (radio DOWN)" interface=ether1-climax-11ghz
add address=2606:1c80:1600::1 comment="culleoka mgmt LAN" interface=mgmt
/ipv6 dhcp-server /ipv6 dhcp-server
add interface=culleoka name=server1 prefix-pool=climax-v6 add interface=mgmt name=culleoka-mgmt-stateless
/ipv6 firewall filter
add action=accept chain=input comment=established connection-state=\
established,related
add action=drop chain=input comment=invalid connection-state=invalid
add action=accept chain=input comment=icmpv6 protocol=icmpv6
add action=accept chain=input comment=link-local src-address=fe80::/10
add action=accept chain=input comment=internal src-address=2606:1c80::/32
add action=drop chain=input comment="default deny"
add action=accept chain=forward comment=established connection-state=\
established,related
add action=drop chain=forward comment=invalid connection-state=invalid
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
icmpv6
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
add action=accept chain=forward comment=internal-to-internal dst-address=\
2606:1c80::/32 src-address=2606:1c80::/32
add action=accept chain=forward comment="v6 outbound from culleoka customers" \
src-address=2606:1c80:1600::/44
add action=drop chain=forward comment="default deny"
/ipv6 nd
add advertise-dns=yes interface=mgmt other-configuration=yes
/ipv6 nd prefix
add interface=mgmt prefix=2606:1c80:1600::/64
/mpls interface /mpls interface
add interface=ether6-380-11ghz mpls-mtu=1508 add interface=ether6-380-11ghz mpls-mtu=1508
/mpls ldp /mpls ldp
@ -619,24 +664,23 @@ add accounting-backup=yes address=45.76.56.5 disabled=yes \
/routing bfd configuration /routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5 add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/routing bgp connection /routing bgp connection
add afi=ip,ipv6 cisco-vpls-nlri-len-fmt=auto-bits connect=yes instance=\ add afi=ip,ipv6 comment="iBGP to core (v6 RR), v6 transport" instance=\
bgp-instance-1 listen=yes local.role=ibgp name=culleoka_climax \ bgp-instance-1 local.address=2606:1c80:0:10::104 .role=ibgp multihop=yes \
nexthop-choice=force-self remote.address=10.250.1.14 .as=393837 .port=179 \ name=ibgp-rr-core nexthop-choice=force-self output.filter-chain=\
templates=default v6-ibgp-out .redistribute=connected,static remote.address=\
2606:1c80:0:10::253 .as=393837 templates=default
/routing filter rule /routing filter rule
add chain=ospf-in disabled=no rule="accept;" add chain=ospf-in disabled=no rule="accept;"
add chain=ospf-out disabled=no rule="accept;" add chain=ospf-out disabled=no rule="accept;"
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1600::/44 || dst==2\
606:1c80:0:10::104/128 || (dst-len==64 && (dst==2606:1c80:0:15::/64 || dst\
==2606:1c80:0:21::/64))) { accept; } else { reject; }"
/routing ospf interface-template /routing ospf interface-template
add area=backbone-v2 auth=sha512 auth-id=1 cost=20 disabled=no interfaces=\ add area=backbone-v2 auth=sha512 auth-id=1 cost=20 disabled=no interfaces=\
ether1-climax-11ghz priority=1 type=ptp use-bfd=yes ether1-climax-11ghz priority=1 type=ptp use-bfd=yes
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\ add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
ether6-380-11ghz priority=1 type=ptp use-bfd=yes ether6-380-11ghz priority=1 type=ptp use-bfd=yes
add area=backbone-v3 cost=10 disabled=no passive priority=1 use-bfd=no
add area=backbone-v2 disabled=no passive add area=backbone-v2 disabled=no passive
add area=backbone-v3 auth=sha512 auth-id=1 disabled=yes interfaces=\
ether1-climax-11ghz type=ptp
add area=backbone-v3 auth=sha512 auth-id=1 disabled=yes interfaces=\
ether6-380-11ghz type=ptp
/routing ospf static-neighbor /routing ospf static-neighbor
add address=10.250.1.14%ether1-climax-11ghz area=backbone-v2 comment=climax \ add address=10.250.1.14%ether1-climax-11ghz area=backbone-v2 comment=climax \
disabled=no poll-interval=10s disabled=no poll-interval=10s

2
mikrotik-tool/edge.rsc
View file

@ -1,4 +1,4 @@
# may/09/2026 11:21:08 by RouterOS 6.49.18 # may/09/2026 12:15:10 by RouterOS 6.49.18
# software id = 8XZE-R7EJ # software id = 8XZE-R7EJ
# #
# model = CCR2004-1G-12S+2XS # model = CCR2004-1G-12S+2XS

4
mikrotik-tool/home-v6-apply.rsc
View file

@ -22,14 +22,14 @@
# WIPE — clean prior v6 config (preserve auto-link-local + Starlink ULA) # WIPE — clean prior v6 config (preserve auto-link-local + Starlink ULA)
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
/ipv6 firewall filter remove [find] /ipv6 firewall filter remove [find]
/ipv6 nd remove [find !default] /ipv6 nd remove [find default=no]
/ipv6 nd prefix remove [find] /ipv6 nd prefix remove [find]
/ipv6 dhcp-server remove [find] /ipv6 dhcp-server remove [find]
/ipv6 dhcp-server option remove [find] /ipv6 dhcp-server option remove [find]
/ipv6 dhcp-client remove [find] /ipv6 dhcp-client remove [find]
/ipv6 pool remove [find name=home-pd] /ipv6 pool remove [find name=home-pd]
/ipv6 route remove [find static=yes] /ipv6 route remove [find static=yes]
/ipv6 address remove [find !dynamic and !disabled] /ipv6 address remove [find dynamic=no and disabled=no]
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
# APPLY — settings # APPLY — settings

2
mikrotik-tool/home.rsc
View file

@ -1,4 +1,4 @@
# 2026-05-09 11:21:08 by RouterOS 7.22.3 # 2026-05-09 12:15:10 by RouterOS 7.22.3
# software id = ZGNY-ZJW7 # software id = ZGNY-ZJW7
# #
# model = RB5009UG+S+ # model = RB5009UG+S+

18
mikrotik-tool/lowry-v6-apply.rsc
View file

@ -20,23 +20,25 @@
/ipv6 dhcp-server option remove [find] /ipv6 dhcp-server option remove [find]
/ipv6 dhcp-client remove [find] /ipv6 dhcp-client remove [find]
/ipv6 nd prefix remove [find] /ipv6 nd prefix remove [find]
/ipv6 nd remove [find !default] /ipv6 nd remove [find default=no]
/ipv6 pool remove [find] /ipv6 pool remove [find]
/ipv6 route remove [find !dynamic] /ipv6 route remove [find dynamic=no]
/ipv6 firewall filter remove [find] /ipv6 firewall filter remove [find]
/ipv6 firewall mangle remove [find] /ipv6 firewall mangle remove [find]
/ipv6 firewall raw remove [find] /ipv6 firewall raw remove [find]
/ipv6 address remove [find !dynamic] /ipv6 address remove [find dynamic=no]
/routing ospf interface-template remove [find area=backbone-v3] /routing ospf interface-template remove [find area=backbone-v3]
/routing ospf area remove [find name=backbone-v3] /routing ospf area remove [find name=backbone-v3]
/routing ospf instance remove [find name=default-v3] /routing ospf instance remove [find name=default-v3]
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"] /routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
# APPLY — BGP instance # APPLY — BGP instance
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
/routing bgp template set [find name=default] disabled=no
/routing bgp instance /routing bgp instance
add name=bgp-instance-1 as=393837 router-id=10.254.254.109 add name=bgp-instance-1 as=393837 router-id=10.254.254.109
@ -48,7 +50,7 @@ add name=bgp-instance-1 as=393837 router-id=10.254.254.109
/ipv6 address /ipv6 address
add address=2606:1c80:0:10::109/128 interface=lo advertise=no comment="loopback" add address=2606:1c80:0:10::109/128 interface=lo advertise=no comment="loopback"
add address=2606:1c80:0:18::2/64 interface=ether1-newhope advertise=no comment="P2P lowry<->newhope" add address=2606:1c80:0:18::2/64 interface=ether1-newhope advertise=no comment="P2P lowry<->newhope"
add address=2606:1c80:1900::1/64 interface=mgmt advertise=yes comment="lowry mgmt LAN" add address=2606:1c80:1900::1/64 interface=management advertise=yes comment="lowry mgmt LAN"
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
# APPLY — static routes # APPLY — static routes
@ -63,13 +65,13 @@ add dst-address=2606:1c80:1900::/44 blackhole distance=200 comment="lowry /44 ag
# APPLY — neighbour discovery on the mgmt LAN # APPLY — neighbour discovery on the mgmt LAN
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
/ipv6 nd /ipv6 nd
add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes add interface=management ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
/ipv6 nd prefix /ipv6 nd prefix
add interface=mgmt prefix=2606:1c80:1900::/64 autonomous=yes on-link=yes add interface=management prefix=2606:1c80:1900::/64 autonomous=yes on-link=yes
/ipv6 dhcp-server /ipv6 dhcp-server
add interface=mgmt name=lowry-mgmt-stateless address-pool=static-only add interface=management name=lowry-mgmt-stateless address-pool=static-only
/ipv6 dhcp-server option /ipv6 dhcp-server option
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"

80
mikrotik-tool/lowry.rsc
View file

@ -1,4 +1,4 @@
# 2026-05-09 11:21:08 by RouterOS 7.21.4 # 2026-05-09 12:15:11 by RouterOS 7.21.4
# software id = 2I9X-PQZP # software id = 2I9X-PQZP
# #
# model = CCR1009-7G-1C-1S+ # model = CCR1009-7G-1C-1S+
@ -143,11 +143,14 @@ add address-pool=mgmt interface=management lease-script="{\
\n" lease-time=1h name=mgmt \n" lease-time=1h name=mgmt
/ip smb users /ip smb users
set [ find default=yes ] disabled=yes set [ find default=yes ] disabled=yes
/ipv6 dhcp-server option
add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
/ipv6 pool /ipv6 pool
add name=lowrycrossing-v6 prefix=2606:1c80:1:6000::/52 prefix-length=64 add name=lowry-cust-pd-1 prefix=2606:1c80:1901::/48 prefix-length=56
/ppp profile /ppp profile
add change-tcp-mss=yes dns-server=204.110.191.20,204.110.191.240 \ add change-tcp-mss=yes dhcpv6-pd-pool=lowry-cust-pd-1 dns-server=\
local-address=100.64.159.254 name=pppoe on-down="{\ 204.110.191.20,204.110.191.240 local-address=100.64.159.254 name=pppoe \
on-down="{\
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\ \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\ uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
7f4443-fc8a-4fe0-807c-f535d2aa1865\"\ 7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
@ -255,8 +258,9 @@ add change-tcp-mss=yes dns-server=204.110.191.20,204.110.191.240 \
\n }\ \n }\
\n} while ( \$attempts < \$max )\ \n} while ( \$attempts < \$max )\
\n}\ \n}\
\n" only-one=yes remote-address=cgnat use-compression=no use-encryption=\ \n" only-one=yes remote-address=cgnat remote-ipv6-prefix-pool=\
no use-ipv6=no use-upnp=no lowry-cust-pd-1 use-compression=no use-encryption=no use-ipv6=no \
use-upnp=no
/queue type /queue type
add kind=pcq name=delinquent_download pcq-classifier=dst-address \ add kind=pcq name=delinquent_download pcq-classifier=dst-address \
pcq-dst-address6-mask=64 pcq-rate=64k pcq-src-address6-mask=64 \ pcq-dst-address6-mask=64 pcq-rate=64k pcq-src-address6-mask=64 \
@ -312,18 +316,17 @@ set ether5 queue=fq-codel
set ether6 queue=fq-codel set ether6 queue=fq-codel
set ether7 queue=fq-codel set ether7 queue=fq-codel
set sfp-sfpplus1 queue=fq-codel set sfp-sfpplus1 queue=fq-codel
/routing bgp instance
add as=393837 name=bgp-instance-1 router-id=10.254.254.109
/routing bgp template /routing bgp template
set default disabled=yes output.network=bgp-networks set default disabled=no output.network=bgp-networks
/routing id /routing id
add disabled=no id=10.254.254.109 name=id-1 select-dynamic-id="" add disabled=no id=10.254.254.109 name=id-1 select-dynamic-id=""
/routing ospf instance /routing ospf instance
add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\ add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\
ospf-out redistribute=connected router-id=id-1 ospf-out redistribute=connected router-id=id-1
add disabled=no in-filter-chain=ospf-in name=default-v3 out-filter-chain=\
ospf-out redistribute=connected router-id=id-1 version=3
/routing ospf area /routing ospf area
add disabled=no instance=default-v2 name=backbone-v2 add disabled=no instance=default-v2 name=backbone-v2
add disabled=no instance=default-v3 name=backbone-v3
/snmp community /snmp community
set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\ set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
kdyyJrT0Mm kdyyJrT0Mm
@ -362,12 +365,17 @@ add bridge=management ingress-filtering=no interface=vlan_10_ether6 \
add bridge=management ingress-filtering=no interface=vlan_10_ether7 \ add bridge=management ingress-filtering=no interface=vlan_10_ether7 \
internal-path-cost=10 path-cost=10 internal-path-cost=10 path-cost=10
/ip firewall connection tracking /ip firewall connection tracking
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \ set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \ tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \ tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
tcp-time-wait-timeout=2m udp-stream-timeout=2m tcp-time-wait-timeout=2m udp-stream-timeout=2m
/ip settings /ip settings
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
set tcp-syncookies=yes set tcp-syncookies=yes
/ipv6 settings
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
set accept-router-advertisements=no
/interface pppoe-server server /interface pppoe-server server
add default-profile=pppoe disabled=no interface=lowrycrossing max-mtu=1492 \ add default-profile=pppoe disabled=no interface=lowrycrossing max-mtu=1492 \
mrru=1600 one-session-per-host=yes service-name=lowrycrossing mrru=1600 one-session-per-host=yes service-name=lowrycrossing
@ -1256,6 +1264,15 @@ set [ find default=yes ] dh-group=modp2048 dpd-interval=2m \
set cache-path=web-proxy1 port=34133 set cache-path=web-proxy1 port=34133
/ip route /ip route
add disabled=no dst-address=0.0.0.0/0 gateway=10.250.1.110 add disabled=no dst-address=0.0.0.0/0 gateway=10.250.1.110
/ipv6 route
add comment="default via newhope" distance=1 dst-address=::/0 gateway=\
2606:1c80:0:18::1
add comment="core loopback (iBGP bootstrap, via newhope)" distance=1 \
dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:18::1
add comment="edge loopback (via newhope)" distance=1 dst-address=\
2606:1c80:0:10::254/128 gateway=2606:1c80:0:18::1
add blackhole comment="lowry /44 aggregate (iBGP origin)" distance=200 \
dst-address=2606:1c80:1900::/44
/ip service /ip service
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
@ -1268,11 +1285,34 @@ set api-ssl certificate=vntx.net.pem_0
/ip ssh /ip ssh
set host-key-type=ed25519 password-authentication=yes strong-crypto=yes set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
/ipv6 address /ipv6 address
add address=2606:1c80:1:6000::/52 advertise=no disabled=yes interface=\ add address=2606:1c80:0:10::109/128 advertise=no comment=loopback interface=\
lowrycrossing lo
add address=2606:1c80:0:9::2 disabled=yes interface=vlan_20_sfpplus1_newhope add address=2606:1c80:0:18::2 advertise=no comment="P2P lowry<->newhope" \
interface=ether1-newhope
add address=2606:1c80:1900::1 comment="lowry mgmt LAN" interface=management
/ipv6 dhcp-server /ipv6 dhcp-server
add interface=lowrycrossing name=server1 prefix-pool=lowrycrossing-v6 add interface=management name=lowry-mgmt-stateless
/ipv6 firewall filter
add action=accept chain=input comment=established connection-state=\
established,related
add action=drop chain=input comment=invalid connection-state=invalid
add action=accept chain=input comment=icmpv6 protocol=icmpv6
add action=accept chain=input comment=link-local src-address=fe80::/10
add action=accept chain=input comment=internal src-address=2606:1c80::/32
add action=drop chain=input comment="default deny"
add action=accept chain=forward comment=established connection-state=\
established,related
add action=drop chain=forward comment=invalid connection-state=invalid
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
icmpv6
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
add action=accept chain=forward comment=internal-to-internal dst-address=\
2606:1c80::/32 src-address=2606:1c80::/32
add action=accept chain=forward comment="v6 outbound from lowry customers" \
src-address=2606:1c80:1900::/44
add action=drop chain=forward comment="default deny"
/ipv6 nd
add advertise-dns=yes interface=management other-configuration=yes
/lcd /lcd
set time-interval=hour set time-interval=hour
/mpls interface /mpls interface
@ -1295,15 +1335,21 @@ add accounting-backup=yes address=45.76.56.5 require-message-auth=no service=\
set accept=yes set accept=yes
/routing bfd configuration /routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5 add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/routing bgp connection
add afi=ip,ipv6 comment="iBGP to core (v6 RR), v6 transport" instance=\
bgp-instance-1 local.address=2606:1c80:0:10::109 .role=ibgp multihop=yes \
name=ibgp-rr-core nexthop-choice=force-self output.filter-chain=\
v6-ibgp-out .redistribute=connected,static remote.address=\
2606:1c80:0:10::253 .as=393837 templates=default
/routing filter rule /routing filter rule
add chain=ospf-in disabled=no rule="accept;" add chain=ospf-in disabled=no rule="accept;"
add chain=ospf-out disabled=no rule="accept;" add chain=ospf-out disabled=no rule="accept;"
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1900::/44 || dst==2\
606:1c80:0:10::109/128 || (dst-len==64 && dst==2606:1c80:0:18::/64)) { acc\
ept; } else { reject; }"
/routing ospf interface-template /routing ospf interface-template
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\ add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
ether1-newhope priority=1 type=ptp use-bfd=yes ether1-newhope priority=1 type=ptp use-bfd=yes
add area=backbone-v3 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
ether1-newhope passive priority=1 type=ptp use-bfd=no
add area=backbone-v3 cost=10 disabled=no use-bfd=no
add area=backbone-v2 disabled=no passive add area=backbone-v2 disabled=no passive
/snmp /snmp
set contact=graham@vntx.net enabled=yes location="33.160873, -96.540479" set contact=graham@vntx.net enabled=yes location="33.160873, -96.540479"

124
mikrotik-tool/main.go
View file

@ -245,11 +245,102 @@ func runOverSSH(r Router, sshPort int, cmd string) ([]byte, error) {
return stdout.Bytes(), nil return stdout.Bytes(), nil
} }
// flattenRSC converts a .rsc-style script (with sticky section paths and
// backslash continuations) into a stream of self-contained ROS commands,
// one per line. ROS's non-interactive SSH shell treats each line
// independently — it does NOT remember the most recent section path the
// way /import or the interactive prompt do — so a script like
//
// /ipv6 address
// add address=... interface=...
// add address=... interface=...
//
// fails with "bad command name add" unless we rewrite it as
//
// /ipv6 address add address=... interface=...
// /ipv6 address add address=... interface=...
//
// before piping it in. This function does that rewrite and also: drops
// `#` comments, drops blank lines, and joins lines ending in `\`.
func flattenRSC(script []byte) []byte {
lines := strings.Split(string(script), "\n")
// Collapse "\" line-continuations first so we can reason per logical line.
var joined []string
var carry strings.Builder
for _, line := range lines {
s := strings.TrimRight(line, "\r")
if strings.HasSuffix(s, "\\") {
carry.WriteString(strings.TrimSuffix(s, "\\"))
carry.WriteString(" ")
continue
}
if carry.Len() > 0 {
carry.WriteString(s)
joined = append(joined, carry.String())
carry.Reset()
continue
}
joined = append(joined, s)
}
if carry.Len() > 0 {
joined = append(joined, carry.String())
}
var out strings.Builder
section := ""
for _, raw := range joined {
s := strings.TrimSpace(raw)
if s == "" || strings.HasPrefix(s, "#") {
continue
}
if strings.HasPrefix(s, "/") {
// A line starting with `/` is either a section header
// (e.g. `/ipv6 address`) or an already-flat command
// (e.g. `/ipv6 settings set forward=yes`). We detect a
// flat command by the presence of a verb token after
// the path words. Heuristic: if the line contains
// ` add ` / ` set ` / ` remove ` / ` print ` / ` get`,
// it's a flat command — emit as-is and don't change
// the section. Otherwise treat the whole line as a
// new section path.
rest := s
isFlat := false
for _, verb := range []string{" add ", " add\t", " set ", " set\t", " remove ", " remove\t", " print", " get", " import "} {
if strings.Contains(rest, verb) || strings.HasSuffix(rest, " add") || strings.HasSuffix(rest, " set") || strings.HasSuffix(rest, " remove") || strings.HasSuffix(rest, " print") || strings.HasSuffix(rest, " get") {
isFlat = true
break
}
}
if isFlat {
out.WriteString(s)
out.WriteByte('\n')
continue
}
section = s
continue
}
if section == "" {
// Defensive: command with no preceding section. Send
// as-is and let RouterOS report the error.
out.WriteString(s)
out.WriteByte('\n')
continue
}
out.WriteString(section)
out.WriteByte(' ')
out.WriteString(s)
out.WriteByte('\n')
}
return []byte(out.String())
}
// runScriptOverSSH pipes a multi-line .rsc script through an SSH session as // runScriptOverSSH pipes a multi-line .rsc script through an SSH session as
// if the user had typed it. Each line is parsed by RouterOS's CLI, exactly // if the user had typed it. The script is first flattened (section paths
// like /import does — section paths persist across lines, errors print but // inlined, comments stripped, `\` continuations joined) because ROS's
// don't abort the rest of the script. A trailing "/quit\n" is appended so // non-interactive SSH shell forgets the section path between lines.
// the shell exits cleanly when the file ends. // Per-line errors print but don't abort the rest of the script. A trailing
// "/quit\n" is appended so the shell exits when the file ends.
func runScriptOverSSH(r Router, sshPort int, script []byte) ([]byte, error) { func runScriptOverSSH(r Router, sshPort int, script []byte) ([]byte, error) {
client, err := dialSSH(r, sshPort) client, err := dialSSH(r, sshPort)
if err != nil { if err != nil {
@ -267,7 +358,7 @@ func runScriptOverSSH(r Router, sshPort int, script []byte) ([]byte, error) {
session.Stdout = &stdout session.Stdout = &stdout
session.Stderr = &stderr session.Stderr = &stderr
body := append([]byte{}, script...) body := flattenRSC(script)
if len(body) == 0 || body[len(body)-1] != '\n' { if len(body) == 0 || body[len(body)-1] != '\n' {
body = append(body, '\n') body = append(body, '\n')
} }
@ -279,11 +370,15 @@ func runScriptOverSSH(r Router, sshPort int, script []byte) ([]byte, error) {
} }
if err := session.Wait(); err != nil { if err := session.Wait(); err != nil {
// Wait returns *ssh.ExitMissingError if the server didn't send an // ROS shells exit with status 1 on /quit (they don't distinguish
// exit status — common for ROS shells that close the channel // "session ended normally" from "command failed"), and sometimes
// without one. Treat as success if we got output. // close the channel without any exit status at all. Both look
// like errors to ssh.Session.Wait(); treat them as success.
// Real per-line failures show up in the captured stdout where
// the user can see them.
var exitErr *ssh.ExitError
var exitMissing *ssh.ExitMissingError var exitMissing *ssh.ExitMissingError
if !errors.As(err, &exitMissing) { if !errors.As(err, &exitErr) && !errors.As(err, &exitMissing) {
return stdout.Bytes(), fmt.Errorf("ssh wait: %w (stderr: %s)", err, stderr.String()) return stdout.Bytes(), fmt.Errorf("ssh wait: %w (stderr: %s)", err, stderr.String())
} }
} }
@ -568,7 +663,10 @@ commands:
(e.g. mikrotik-tool api verona /ip/route/print) (e.g. mikrotik-tool api verona /ip/route/print)
schema show parameter names accepted under an API path on one router, schema show parameter names accepted under an API path on one router,
plus matching examples from local .rsc exports plus matching examples from local .rsc exports
(e.g. mikrotik-tool schema verona /routing/bgp/connection)`) (e.g. mikrotik-tool schema verona /routing/bgp/connection)
script push a local .rsc file to one router and run it via SSH; output
from the router (errors, /export prints, etc.) is mirrored to
stdout (e.g. mikrotik-tool script 494 494-v6-apply.rsc)`)
os.Exit(2) os.Exit(2)
} }
@ -623,6 +721,12 @@ func main() {
os.Exit(2) os.Exit(2)
} }
runSchema(cfg, args[1], args[2]) runSchema(cfg, args[1], args[2])
case "script":
if len(args) < 3 {
fmt.Fprintln(os.Stderr, "usage: mikrotik-tool script <router> <file.rsc>")
os.Exit(2)
}
runScript(cfg, args[1], args[2])
default: default:
fmt.Fprintf(os.Stderr, "unknown command: %s\n", args[0]) fmt.Fprintf(os.Stderr, "unknown command: %s\n", args[0])
usage() usage()

BIN
mikrotik-tool/mikrotik-tool
View file

Binary file not shown.

27
mikrotik-tool/newhope-v6-apply.rsc
View file

@ -24,23 +24,25 @@
/ipv6 dhcp-server option remove [find] /ipv6 dhcp-server option remove [find]
/ipv6 dhcp-client remove [find] /ipv6 dhcp-client remove [find]
/ipv6 nd prefix remove [find] /ipv6 nd prefix remove [find]
/ipv6 nd remove [find !default] /ipv6 nd remove [find default=no]
/ipv6 pool remove [find] /ipv6 pool remove [find]
/ipv6 route remove [find !dynamic] /ipv6 route remove [find dynamic=no]
/ipv6 firewall filter remove [find] /ipv6 firewall filter remove [find]
/ipv6 firewall mangle remove [find] /ipv6 firewall mangle remove [find]
/ipv6 firewall raw remove [find] /ipv6 firewall raw remove [find]
/ipv6 address remove [find !dynamic] /ipv6 address remove [find dynamic=no]
/routing ospf interface-template remove [find area=backbone-v3] /routing ospf interface-template remove [find area=backbone-v3]
/routing ospf area remove [find name=backbone-v3] /routing ospf area remove [find name=backbone-v3]
/routing ospf instance remove [find name=default-v3] /routing ospf instance remove [find name=default-v3]
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"] /routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
# APPLY — BGP instance # APPLY — BGP instance
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
/routing bgp template set [find name=default] disabled=no
/routing bgp instance /routing bgp instance
add name=bgp-instance-1 as=393837 router-id=10.254.254.108 add name=bgp-instance-1 as=393837 router-id=10.254.254.108
@ -53,7 +55,7 @@ add name=bgp-instance-1 as=393837 router-id=10.254.254.108
add address=2606:1c80:0:10::108/128 interface=lo advertise=no comment="loopback" add address=2606:1c80:0:10::108/128 interface=lo advertise=no comment="loopback"
add address=2606:1c80:0:13::2/64 interface=ether2-380 advertise=no comment="P2P newhope<->core" add address=2606:1c80:0:13::2/64 interface=ether2-380 advertise=no comment="P2P newhope<->core"
add address=2606:1c80:0:18::1/64 interface=ether6-lowrycrossing advertise=no comment="P2P newhope<->lowry" add address=2606:1c80:0:18::1/64 interface=ether6-lowrycrossing advertise=no comment="P2P newhope<->lowry"
add address=2606:1c80:1800::1/64 interface=mgmt advertise=yes comment="newhope mgmt LAN" add address=2606:1c80:1800::1/64 interface=bridge_cpe_mgmt advertise=yes comment="newhope mgmt LAN"
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
# APPLY — static routes # APPLY — static routes
@ -62,19 +64,26 @@ add address=2606:1c80:1800::1/64 interface=mgmt advertise
add dst-address=::/0 gateway=2606:1c80:0:13::1 distance=1 comment="default via core" add dst-address=::/0 gateway=2606:1c80:0:13::1 distance=1 comment="default via core"
add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:13::1 distance=1 comment="core loopback (iBGP bootstrap)" add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:13::1 distance=1 comment="core loopback (iBGP bootstrap)"
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:13::1 distance=1 comment="edge loopback via core" add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:13::1 distance=1 comment="edge loopback via core"
# Lowry sits one hop further out via the newhope<->lowry P2P. newhope is
# the only neighbour that can deliver to lowry's loopback, so we hold a
# static for it; without this, traffic for :10::109 from core/edge loops
# at newhope until iBGP fully converges.
add dst-address=2606:1c80:0:10::109/128 gateway=2606:1c80:0:18::2 distance=1 comment="lowry loopback via P2P"
add dst-address=2606:1c80:1800::/44 blackhole distance=200 comment="newhope /44 aggregate (iBGP origin)" add dst-address=2606:1c80:1800::/44 blackhole distance=200 comment="newhope /44 aggregate (iBGP origin)"
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
# APPLY — neighbour discovery on the mgmt LAN # APPLY — neighbour discovery on the mgmt LAN
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
/ipv6 nd /ipv6 nd
add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes add interface=bridge_cpe_mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
/ipv6 nd prefix /ipv6 nd prefix
add interface=mgmt prefix=2606:1c80:1800::/64 autonomous=yes on-link=yes add interface=bridge_cpe_mgmt prefix=2606:1c80:1800::/64 autonomous=yes on-link=yes
/ipv6 dhcp-server /ipv6 dhcp-server
add interface=mgmt name=newhope-mgmt-stateless address-pool=static-only add interface=bridge_cpe_mgmt name=newhope-mgmt-stateless address-pool=static-only
/ipv6 dhcp-server option /ipv6 dhcp-server option
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
@ -86,7 +95,7 @@ add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
add name=newhope-cust-pd-1 prefix=2606:1c80:1801::/48 prefix-length=56 add name=newhope-cust-pd-1 prefix=2606:1c80:1801::/48 prefix-length=56
/ppp profile /ppp profile
set [find name=pppoe] remote-ipv6-prefix-pool=newhope-cust-pd-1 dhcpv6-pd-pool=newhope-cust-pd-1 set [find name=newhope] remote-ipv6-prefix-pool=newhope-cust-pd-1 dhcpv6-pd-pool=newhope-cust-pd-1
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
# APPLY — firewall # APPLY — firewall

87
mikrotik-tool/newhope.rsc
View file

@ -1,4 +1,4 @@
# 2026-05-09 11:21:08 by RouterOS 7.21.4 # 2026-05-09 12:15:11 by RouterOS 7.21.4
# software id = 5HTF-YFWV # software id = 5HTF-YFWV
# #
# model = CCR1009-7G-1C-1S+ # model = CCR1009-7G-1C-1S+
@ -150,12 +150,15 @@ add address-pool=dhcp_pool6 interface=ether7-tower lease-time=1h name=\
newhope-tower newhope-tower
/ip smb users /ip smb users
set [ find default=yes ] disabled=yes set [ find default=yes ] disabled=yes
/ipv6 dhcp-server option
add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
/ipv6 pool /ipv6 pool
add name=newhope-v6 prefix=2606:1c80:1:5000::/52 prefix-length=64 add name=newhope-cust-pd-1 prefix=2606:1c80:1801::/48 prefix-length=56
/ppp profile /ppp profile
set *0 remote-address=dhcp_pool3 set *0 remote-address=dhcp_pool3
add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \ add change-tcp-mss=yes dhcpv6-pd-pool=newhope-cust-pd-1 dns-server=\
local-address=100.64.19.253 name=newhope on-down="{\ 204.110.191.240,204.110.191.20 local-address=100.64.19.253 name=newhope \
on-down="{\
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\ \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\ uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
7f4443-fc8a-4fe0-807c-f535d2aa1865\"\ 7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
@ -263,7 +266,8 @@ add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \
\n }\ \n }\
\n} while ( \$attempts < \$max )\ \n} while ( \$attempts < \$max )\
\n}\ \n}\
\n" remote-address=cgnat use-upnp=no \n" remote-address=cgnat remote-ipv6-prefix-pool=newhope-cust-pd-1 \
use-upnp=no
/queue type /queue type
add kind=pcq name=delinquent_download pcq-classifier=dst-address \ add kind=pcq name=delinquent_download pcq-classifier=dst-address \
pcq-dst-address6-mask=64 pcq-rate=64k pcq-src-address6-mask=64 \ pcq-dst-address6-mask=64 pcq-rate=64k pcq-src-address6-mask=64 \
@ -282,19 +286,18 @@ set ether5-switch queue=fq-codel
set ether6-lowrycrossing queue=fq-codel set ether6-lowrycrossing queue=fq-codel
set ether7-tower queue=fq-codel set ether7-tower queue=fq-codel
set sfp-sfpplus1-edgepoint queue=fq-codel set sfp-sfpplus1-edgepoint queue=fq-codel
/routing bgp instance
add as=393837 name=bgp-instance-1 router-id=10.254.254.108
/routing bgp template /routing bgp template
set default as=393837 disabled=yes output.network=bgp-networks .redistribute=\ set default as=393837 disabled=no output.network=bgp-networks .redistribute=\
connected connected
/routing id /routing id
add disabled=no id=10.254.254.108 name=id-1 select-dynamic-id="" add disabled=no id=10.254.254.108 name=id-1 select-dynamic-id=""
/routing ospf instance /routing ospf instance
add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\ add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\
ospf-out redistribute=connected,rip router-id=id-1 ospf-out redistribute=connected,rip router-id=id-1
add disabled=no in-filter-chain=ospf-in name=default-v3 out-filter-chain=\
ospf-out router-id=id-1 version=3
/routing ospf area /routing ospf area
add disabled=no instance=default-v2 name=backbone-v2 add disabled=no instance=default-v2 name=backbone-v2
add disabled=no instance=default-v3 name=backbone-v3
/snmp community /snmp community
set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\ set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
kdyyJrT0Mm kdyyJrT0Mm
@ -311,12 +314,17 @@ add bridge=newhope ingress-filtering=no interface=combo1 internal-path-cost=\
add bridge=newhope interface=ether5-switch add bridge=newhope interface=ether5-switch
add bridge=newhope interface=sfp-sfpplus1-edgepoint add bridge=newhope interface=sfp-sfpplus1-edgepoint
/ip firewall connection tracking /ip firewall connection tracking
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \ set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \ tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \ tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
tcp-time-wait-timeout=2m udp-stream-timeout=2m tcp-time-wait-timeout=2m udp-stream-timeout=2m
/ip settings /ip settings
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
set tcp-syncookies=yes set tcp-syncookies=yes
/ipv6 settings
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
set accept-router-advertisements=no
/interface pppoe-server server /interface pppoe-server server
add authentication=mschap2 default-profile=newhope disabled=no interface=\ add authentication=mschap2 default-profile=newhope disabled=no interface=\
newhope max-mru=1492 max-mtu=1492 one-session-per-host=yes service-name=\ newhope max-mru=1492 max-mtu=1492 one-session-per-host=yes service-name=\
@ -506,6 +514,17 @@ add disabled=no dst-address=100.64.20.0/22 gateway=10.250.1.105 \
routing-table=main routing-table=main
add disabled=no dst-address=10.10.144.0/20 gateway=10.250.1.105 \ add disabled=no dst-address=10.10.144.0/20 gateway=10.250.1.105 \
routing-table=main routing-table=main
/ipv6 route
add comment="default via core" distance=1 dst-address=::/0 gateway=\
2606:1c80:0:13::1
add comment="core loopback (iBGP bootstrap)" distance=1 dst-address=\
2606:1c80:0:10::253/128 gateway=2606:1c80:0:13::1
add comment="edge loopback via core" distance=1 dst-address=\
2606:1c80:0:10::254/128 gateway=2606:1c80:0:13::1
add blackhole comment="newhope /44 aggregate (iBGP origin)" distance=200 \
dst-address=2606:1c80:1800::/44
add comment="lowry loopback via P2P" distance=1 dst-address=\
2606:1c80:0:10::109/128 gateway=2606:1c80:0:18::2
/ip service /ip service
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
@ -520,10 +539,40 @@ set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
/ip traffic-flow /ip traffic-flow
set cache-entries=256k enabled=yes set cache-entries=256k enabled=yes
/ipv6 address /ipv6 address
add address=2606:1c80:0:1001::2 interface=ether2-380 add address=2606:1c80:0:10::108/128 advertise=no comment=loopback interface=\
lo
add address=2606:1c80:0:13::2 advertise=no comment="P2P newhope<->core" \
interface=ether2-380
add address=2606:1c80:0:18::1 advertise=no comment="P2P newhope<->lowry" \
interface=ether6-lowrycrossing
add address=2606:1c80:1800::1 comment="newhope mgmt LAN" interface=\
bridge_cpe_mgmt
/ipv6 dhcp-server /ipv6 dhcp-server
add disabled=yes interface=sfp-sfpplus1-edgepoint name=server1 prefix-pool=\ add interface=bridge_cpe_mgmt name=newhope-mgmt-stateless
newhope-v6 /ipv6 firewall filter
add action=accept chain=input comment=established connection-state=\
established,related
add action=drop chain=input comment=invalid connection-state=invalid
add action=accept chain=input comment=icmpv6 protocol=icmpv6
add action=accept chain=input comment=link-local src-address=fe80::/10
add action=accept chain=input comment=internal src-address=2606:1c80::/32
add action=drop chain=input comment="default deny"
add action=accept chain=forward comment=established connection-state=\
established,related
add action=drop chain=forward comment=invalid connection-state=invalid
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
icmpv6
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
add action=accept chain=forward comment=internal-to-internal dst-address=\
2606:1c80::/32 src-address=2606:1c80::/32
add action=accept chain=forward comment="v6 outbound from newhope customers" \
src-address=2606:1c80:1800::/44
add action=accept chain=forward comment=\
"v6 outbound from lowry customers (transit)" src-address=\
2606:1c80:1900::/44
add action=drop chain=forward comment="default deny"
/ipv6 nd
add advertise-dns=yes interface=bridge_cpe_mgmt other-configuration=yes
/mpls interface /mpls interface
add interface=ether2-380 mpls-mtu=1508 add interface=ether2-380 mpls-mtu=1508
add interface=ether6-lowrycrossing mpls-mtu=1508 add interface=ether6-lowrycrossing mpls-mtu=1508
@ -546,11 +595,20 @@ add accounting-backup=yes address=45.76.56.5 require-message-auth=no service=\
set accept=yes set accept=yes
/routing bfd configuration /routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5 add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/routing bgp connection
add afi=ip,ipv6 comment="iBGP to core (v6 RR), v6 transport" instance=\
bgp-instance-1 local.address=2606:1c80:0:10::108 .role=ibgp multihop=yes \
name=ibgp-rr-core nexthop-choice=force-self output.filter-chain=\
v6-ibgp-out .redistribute=connected,static remote.address=\
2606:1c80:0:10::253 .as=393837 templates=default
/routing filter rule /routing filter rule
add chain=ospf-in disabled=no rule="accept;" add chain=ospf-in disabled=no rule="accept;"
add chain=ospf-out disabled=no rule="accept;" add chain=ospf-out disabled=no rule="accept;"
add chain=bgp-in disabled=no rule="accept;" add chain=bgp-in disabled=no rule="accept;"
add chain=bgp-out disabled=no rule="accept;" add chain=bgp-out disabled=no rule="accept;"
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1800::/44 || dst==2\
606:1c80:0:10::108/128 || (dst-len==64 && (dst==2606:1c80:0:13::/64 || dst\
==2606:1c80:0:18::/64))) { accept; } else { reject; }"
/routing ospf interface-template /routing ospf interface-template
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\ add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
ether4 priority=1 type=ptp use-bfd=yes ether4 priority=1 type=ptp use-bfd=yes
@ -558,12 +616,7 @@ add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
ether6-lowrycrossing priority=1 type=ptp use-bfd=yes ether6-lowrycrossing priority=1 type=ptp use-bfd=yes
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\ add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
ether2-380 priority=1 type=ptp use-bfd=yes ether2-380 priority=1 type=ptp use-bfd=yes
add area=backbone-v3 cost=10 disabled=no priority=1 use-bfd=no
add area=backbone-v2 disabled=no passive add area=backbone-v2 disabled=no passive
add area=backbone-v3 auth=sha512 auth-id=1 disabled=yes interfaces=ether4 \
type=ptp
add area=backbone-v3 auth=sha512 auth-id=1 disabled=yes interfaces=ether2-380 \
type=ptp
/routing rip static-neighbor /routing rip static-neighbor
add address="" disabled=no instance=*1 add address="" disabled=no instance=*1
/snmp /snmp

8
mikrotik-tool/verona-v6-apply.rsc
View file

@ -27,13 +27,13 @@
/ipv6 dhcp-server option remove [find] /ipv6 dhcp-server option remove [find]
/ipv6 dhcp-client remove [find] /ipv6 dhcp-client remove [find]
/ipv6 nd prefix remove [find] /ipv6 nd prefix remove [find]
/ipv6 nd remove [find !default] /ipv6 nd remove [find default=no]
/ipv6 pool remove [find] /ipv6 pool remove [find]
/ipv6 route remove [find !dynamic] /ipv6 route remove [find dynamic=no]
/ipv6 firewall filter remove [find] /ipv6 firewall filter remove [find]
/ipv6 firewall mangle remove [find] /ipv6 firewall mangle remove [find]
/ipv6 firewall raw remove [find] /ipv6 firewall raw remove [find]
/ipv6 address remove [find !dynamic] /ipv6 address remove [find dynamic=no]
# OSPFv3 — remove the v3 instance, area, interface-template entry, leave v2 alone. # OSPFv3 — remove the v3 instance, area, interface-template entry, leave v2 alone.
/routing ospf interface-template remove [find area=backbone-v3] /routing ospf interface-template remove [find area=backbone-v3]
@ -41,7 +41,7 @@
/routing ospf instance remove [find name=default-v3] /routing ospf instance remove [find name=default-v3]
# Any leftover v6 BGP — wipe internal-only, never touch upstream peers. # Any leftover v6 BGP — wipe internal-only, never touch upstream peers.
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"] /routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
# APPLY — addresses # APPLY — addresses

2
mikrotik-tool/verona.rsc
View file

@ -1,4 +1,4 @@
# 2026-05-09 11:21:08 by RouterOS 7.21.4 # 2026-05-09 12:15:10 by RouterOS 7.21.4
# software id = Y1CT-1WB1 # software id = Y1CT-1WB1
# #
# model = CCR2004-16G-2S+ # model = CCR2004-16G-2S+