From d5e74c6bbd9797719d990c201fb903218e1e082e Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Sat, 9 May 2026 09:38:11 -0500 Subject: [PATCH] routers update --- mikrotik-tool/494.rsc | 2 +- mikrotik-tool/982.rsc | 2 +- mikrotik-tool/climax-v6-apply.rsc | 8 +- mikrotik-tool/climax.rsc | 2 +- mikrotik-tool/core-v6-apply.rsc | 12 +- mikrotik-tool/core.rsc | 2 +- mikrotik-tool/culleoka.rsc | 2 +- mikrotik-tool/edge-v6-apply.rsc | 21 +- mikrotik-tool/edge.rsc | 2 +- mikrotik-tool/home.rsc | 510 ++++++++++++++++++++++++++++++ mikrotik-tool/ipv6.md | 69 ++-- mikrotik-tool/lowry.rsc | 2 +- mikrotik-tool/netbox_v6_sync.py | 239 ++++++++++++++ mikrotik-tool/newhope.rsc | 2 +- mikrotik-tool/verona-v6-apply.rsc | 2 +- mikrotik-tool/verona.rsc | 2 +- 16 files changed, 817 insertions(+), 62 deletions(-) create mode 100644 mikrotik-tool/home.rsc create mode 100644 mikrotik-tool/netbox_v6_sync.py diff --git a/mikrotik-tool/494.rsc b/mikrotik-tool/494.rsc index 0a10ca4..2d708f5 100644 --- a/mikrotik-tool/494.rsc +++ b/mikrotik-tool/494.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:30:35 by RouterOS 7.21.4 +# 2026-05-09 09:37:54 by RouterOS 7.21.4 # software id = K4QG-8NQV # # model = RB5009UG+S+ diff --git a/mikrotik-tool/982.rsc b/mikrotik-tool/982.rsc index 1e2290c..4f05a37 100644 --- a/mikrotik-tool/982.rsc +++ b/mikrotik-tool/982.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:30:35 by RouterOS 7.21.4 +# 2026-05-09 09:37:54 by RouterOS 7.21.4 # software id = FUVS-HCM5 # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/climax-v6-apply.rsc b/mikrotik-tool/climax-v6-apply.rsc index 8b706ee..b768802 100644 --- a/mikrotik-tool/climax-v6-apply.rsc +++ b/mikrotik-tool/climax-v6-apply.rsc @@ -57,10 +57,10 @@ add name=bgp-instance-1 as=393837 router-id=10.254.254.102 /ipv6 address add address=2606:1c80:0:10::102/128 interface=lo advertise=no comment="loopback" -add address=2606:1c80:0:12::2/127 interface=ether4-380-airfiber24 advertise=no comment="P2P climax<->core" -add address=2606:1c80:0:20::2/127 interface=ether6-verona-11ghz advertise=no comment="P2P climax<->verona" -add address=2606:1c80:0:21::1/127 interface=ether3-culleoka-11ghz advertise=no comment="P2P climax<->culleoka" -add address=2606:1c80:0:17::1/127 interface=ether5-494 advertise=no comment="P2P climax<->494" +add address=2606:1c80:0:12::2/64 interface=ether4-380-airfiber24 advertise=no comment="P2P climax<->core" +add address=2606:1c80:0:20::2/64 interface=ether6-verona-11ghz advertise=no comment="P2P climax<->verona" +add address=2606:1c80:0:21::1/64 interface=ether3-culleoka-11ghz advertise=no comment="P2P climax<->culleoka" +add address=2606:1c80:0:17::1/64 interface=ether5-494 advertise=no comment="P2P climax<->494" add address=2606:1c80:1100::1/64 interface=mgmt advertise=yes comment="climax mgmt LAN" # ----------------------------------------------------------------------------- diff --git a/mikrotik-tool/climax.rsc b/mikrotik-tool/climax.rsc index 7d88c47..57098b8 100644 --- a/mikrotik-tool/climax.rsc +++ b/mikrotik-tool/climax.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:30:35 by RouterOS 7.21.4 +# 2026-05-09 09:37:53 by RouterOS 7.21.4 # software id = UETF-WF31 # # model = CCR2004-16G-2S+ diff --git a/mikrotik-tool/core-v6-apply.rsc b/mikrotik-tool/core-v6-apply.rsc index 6ed1313..31074b0 100644 --- a/mikrotik-tool/core-v6-apply.rsc +++ b/mikrotik-tool/core-v6-apply.rsc @@ -70,12 +70,12 @@ /ipv6 address add address=2606:1c80:0:10::253/128 interface=lo advertise=no comment="loopback" -add address=2606:1c80:0:11::2/127 interface=ether3-edge-direct advertise=no comment="P2P core<->edge direct (backup)" -add address=2606:1c80:0:1002::2/127 interface=sfp-sfpplus1-edge-preseem advertise=no comment="P2P core<->edge via preseem (primary)" -add address=2606:1c80:0:12::1/127 interface=ether5-climax advertise=no comment="P2P core<->climax" -add address=2606:1c80:0:13::1/127 interface=ether4-newhope advertise=no comment="P2P core<->newhope" -add address=2606:1c80:0:14::1/127 interface=ether1-982-60ghz advertise=no comment="P2P core<->982 60GHz" -add address=2606:1c80:0:15::1/127 interface=ether6-culleoka-11ghz advertise=no comment="P2P core<->culleoka" +add address=2606:1c80:0:11::2/64 interface=ether3-edge-direct advertise=no comment="P2P core<->edge direct (backup)" +add address=2606:1c80:0:1002::2/64 interface=sfp-sfpplus1-edge-preseem advertise=no comment="P2P core<->edge via preseem (primary)" +add address=2606:1c80:0:12::1/64 interface=ether5-climax advertise=no comment="P2P core<->climax" +add address=2606:1c80:0:13::1/64 interface=ether4-newhope advertise=no comment="P2P core<->newhope" +add address=2606:1c80:0:14::1/64 interface=ether1-982-60ghz advertise=no comment="P2P core<->982 60GHz" +add address=2606:1c80:0:15::1/64 interface=ether6-culleoka-11ghz advertise=no comment="P2P core<->culleoka" add address=2606:1c80:1400::1/64 interface=vlan10_combo1 advertise=yes comment="380 mgmt LAN" # ----------------------------------------------------------------------------- diff --git a/mikrotik-tool/core.rsc b/mikrotik-tool/core.rsc index 144337f..6fb02de 100644 --- a/mikrotik-tool/core.rsc +++ b/mikrotik-tool/core.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:30:35 by RouterOS 7.21.4 +# 2026-05-09 09:37:54 by RouterOS 7.21.4 # software id = XS5B-41QR # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/culleoka.rsc b/mikrotik-tool/culleoka.rsc index 5556297..d214bbc 100644 --- a/mikrotik-tool/culleoka.rsc +++ b/mikrotik-tool/culleoka.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:30:35 by RouterOS 7.21.4 +# 2026-05-09 09:37:54 by RouterOS 7.21.4 # software id = HVP9-3G0K # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/edge-v6-apply.rsc b/mikrotik-tool/edge-v6-apply.rsc index 14ad538..ee7e152 100644 --- a/mikrotik-tool/edge-v6-apply.rsc +++ b/mikrotik-tool/edge-v6-apply.rsc @@ -8,12 +8,15 @@ # needed). This matches the verona-v6-apply.rsc design choice. # # Two paths edge<->core: -# 1. PRIMARY: sfp-sfpplus11-preseem, /127 via the Preseem shaper -# (transparent L2). OSPFv2 cost on edge is the default 10. v6 P2P: -# 2606:1c80:0:1002::1 (edge) <-> :2 (core) -# 2. BACKUP: sfp-sfpplus7-core-direct, /127 direct fiber. OSPFv2 cost on -# edge is 100 (same on core's side). v6 P2P: -# 2606:1c80:0:11::1 (edge) <-> :2 (core) +# 1. PRIMARY: sfp-sfpplus11-preseem via the Preseem shaper (transparent +# L2). OSPFv2 cost on edge is the default 10. v6 P2P: +# 2606:1c80:0:1002::/64 (edge .1, core .2) +# 2. BACKUP: sfp-sfpplus7-core-direct direct fiber. OSPFv2 cost on edge +# is 100 (same on core's side). v6 P2P: +# 2606:1c80:0:11::/64 (edge .1, core .2) +# NOTE: P2P prefix is /64 not /127 — picking ::1/127 + ::2/127 puts the +# two ends in *different* /127 networks (verified live 2026-05-09). /64 +# matches the per-link allocation in ipv6.md. # Static v6 routes for the infra /48 mirror that cost relationship by # distance (lower = preferred): preseem at distance=1, direct at # distance=2. @@ -56,8 +59,8 @@ /ipv6 address add address=2606:1c80:0:10::254/128 interface=loopback advertise=no comment="edge loopback" -add address=2606:1c80:0:11::1/127 interface=sfp-sfpplus7-core-direct advertise=no comment="P2P edge<->core direct (backup)" -add address=2606:1c80:0:1002::1/127 interface=sfp-sfpplus11-preseem advertise=no comment="P2P edge<->core via preseem (primary)" +add address=2606:1c80:0:11::1/64 interface=sfp-sfpplus7-core-direct advertise=no comment="P2P edge<->core direct (backup)" +add address=2606:1c80:0:1002::1/64 interface=sfp-sfpplus11-preseem advertise=no comment="P2P edge<->core via preseem (primary)" # NOTE: the server LAN address 2606:1c80::1 on vlan9_sfpplus8 is left # untouched per user constraint. The ND override below makes it RA-free @@ -75,7 +78,7 @@ add interface=vlan9_sfpplus8 disabled=no advertise=no managed-address-configurat # APPLY — static routes (replace what an IGP would have learned) # ----------------------------------------------------------------------------- # Infra /48 covers all router loopbacks (2606:1c80:0:10::/64), all P2P -# /127s, and any future infra slots. Two entries with different distances +# /64s, and any future infra slots. Two entries with different distances # pin preseem as primary and direct as backup. The connected /64 server # LAN at 2606:1c80::/64 wins by longest-prefix-match, so this /48 doesn't # steal local server traffic. diff --git a/mikrotik-tool/edge.rsc b/mikrotik-tool/edge.rsc index 26e2673..75f503b 100644 --- a/mikrotik-tool/edge.rsc +++ b/mikrotik-tool/edge.rsc @@ -1,4 +1,4 @@ -# may/09/2026 09:30:34 by RouterOS 6.49.18 +# may/09/2026 09:37:53 by RouterOS 6.49.18 # software id = 8XZE-R7EJ # # model = CCR2004-1G-12S+2XS diff --git a/mikrotik-tool/home.rsc b/mikrotik-tool/home.rsc new file mode 100644 index 0000000..8d34305 --- /dev/null +++ b/mikrotik-tool/home.rsc @@ -0,0 +1,510 @@ +# 2026-05-09 09:37:54 by RouterOS 7.22.3 +# software id = ZGNY-ZJW7 +# +# model = RB5009UG+S+ +# serial number = HC907QQ15FR +/interface bridge +add admin-mac=74:4D:28:1A:67:0A auto-mac=no comment=defconf mtu=1500 name=\ + bridge port-cost-mode=short +add name=containers +add mtu=1500 name=docker port-cost-mode=short +add mtu=1500 name=dockers port-cost-mode=short +add disabled=yes mtu=1500 name=public +/interface ethernet +set [ find default-name=ether1 ] l2mtu=9578 +set [ find default-name=ether2 ] l2mtu=9578 +set [ find default-name=ether3 ] l2mtu=9578 name=ether3-servers +set [ find default-name=ether4 ] l2mtu=9578 name=ether4-house-60g +set [ find default-name=ether5 ] l2mtu=9578 name=ether5-vntx-static +set [ find default-name=ether6 ] l2mtu=9578 name=ether6-tmobile +set [ find default-name=ether7 ] l2mtu=9578 name=ether7-starlink +set [ find default-name=ether8 ] disabled=yes l2mtu=9578 +set [ find default-name=sfp-sfpplus1 ] l2mtu=9586 +/interface pppoe-client +add interface=ether8 max-mtu=1500 name=pppoe-out1 use-peer-dns=yes user=\ + grahammcintire +/interface veth +add address=172.17.0.2/16 container-mac-address=4C:B3:A4:3A:BC:FF dhcp=no \ + gateway=172.17.0.1 gateway6="" mac-address=4C:B3:A4:3A:BC:FE name=veth1 +/interface list +add comment=defconf name=WAN +add comment=defconf name=LAN +/interface wireless security-profiles +set [ find default=yes ] supplicant-identity=MikroTik +/ip pool +add name=home ranges=10.0.17.1-10.0.18.249 +add name=dhcp_pool1 ranges=10.0.8.1-10.0.14.254 +/ip dhcp-server +add add-arp=yes address-pool=home bootp-lease-time=lease-time bootp-support=\ + dynamic interface=bridge lease-time=8h name=server1 +add address-pool=dhcp_pool1 interface=ether3-servers name=servers +/ipv6 pool +add name=tunnerbroker prefix=2001:470:ba50::/48 prefix-length=48 +/port +set 0 baud-rate=9600 +/interface ppp-client +add apn=internet name=ppp-out1 port=usb1 +/queue type +set 0 kind=fq-codel +/routing table +add disabled=no fib name=vntx +add disabled=no fib name=tmo +/snmp community +set [ find default=yes ] addresses=10.0.16.0/22,10.0.0.0/8,204.110.188.0/22 \ + name=kdyyJrT0Mm +add addresses=::/0 authentication-protocol=SHA1 encryption-protocol=AES name=\ + testtest security=private +add addresses=10.0.16.0/22 name=testlocal +/system script +add dont-require-permissions=no name=api-ssl-certgen owner=admin policy=\ + ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\ + local hostname \"router.example.com\"; :local caName \"local-ca\"; :local \ + certName \"api-ssl-cert\"; :local sanList (\"DNS:\" . \$hostname); :foreac\ + h i in=[/ip/address find] do={ :local addr [/ip/address get \$i address]; \ + :set addr [:pick \$addr 0 [:find \$addr \"/\"]]; :set sanList (\$sanList .\ + \_\",IP:\" . \$addr); }; /certificate add name=\$caName common-name=\$caNa\ + me key-usage=key-cert-sign,crl-sign days-valid=3650; /certificate sign \$c\ + aName; /certificate add name=\$certName common-name=\$hostname subject-alt\ + -name=\$sanList key-usage=digital-signature,key-encipherment,tls-server da\ + ys-valid=825; /certificate sign \$certName ca=\$caName; /certificate set \ + \$certName trusted=yes; /ip/service set api-ssl certificate=\$certName dis\ + abled=no; /ip/service set api disabled=yes;" +/container +add envlists=tailscale interface=veth1 layer-dir="" name=\ + tailscale-mikrotik:latest remote-image=\ + fluent-networks/tailscale-mikrotik:latest root-dir=\ + /disk1/containers/tailscale start-on-boot=yes workdir=/ +/container config +set registry-url=https://ghcr.io tmpdir=/disk1/pull +/container envs +add key=ADVERTISE_ROUTES list=tailscale value=10.0.8.0/22,10.0.16.0/22 +add key=AUTH_KEY list=tailscale value=\ + tskey-auth-k9B9aH7Cyk11CNTRL-yYzpiX8XThCFiVV3pVMthCUKfN8wKTjBD +add key=CONTAINER_GATEWAY list=tailscale value=172.17.0.1 +add key=PASSWORD list=tailscale value=h8xd9tkryg +add key=RUNNING_SCRIPT list=tailscale value=/var/lib/tailscale/running.sh +add key=STARTUP_SCRIPT list=tailscale value=/var/lib/tailscale/startup.sh +add key=TAILSCALE_ARGS list=tailscale value=\ + "--accept-routes --advertise-exit-node" +add key=UPDATE_TAILSCALE list=tailscale value="" +/container mounts +add dst=/var/lib/tailscale list=tailscale src=/tailscale +/ip smb +set enabled=no +/interface bridge port +add bridge=bridge comment=defconf ingress-filtering=no interface=\ + ether4-house-60g internal-path-cost=10 path-cost=10 +add bridge=bridge comment=defconf ingress-filtering=no interface=sfp-sfpplus1 \ + internal-path-cost=10 path-cost=10 +add bridge=dockers interface=veth1 +/interface detect-internet +set detect-interface-list=all internet-interface-list=all lan-interface-list=\ + LAN wan-interface-list=WAN +/interface list member +add comment=defconf interface=bridge list=LAN +add interface=ether5-vntx-static list=WAN +add interface=ether6-tmobile list=WAN +add disabled=yes interface=ether8 list=WAN +add interface=ether7-starlink list=WAN +add interface=*14 list=WAN +/interface ovpn-server server +add mac-address=FE:1C:5C:10:15:58 name=ovpn-server1 +/ip address +add address=10.0.16.254/24 interface=bridge network=10.0.16.0 +add address=172.17.0.1/16 interface=dockers network=172.17.0.0 +add address=204.110.191.1/27 interface=ether5-vntx-static network=\ + 204.110.191.0 +add address=10.0.19.254/22 interface=bridge network=10.0.16.0 +add address=10.99.1.1/24 interface=*16 network=10.99.1.0 +add address=10.0.101.253/24 disabled=yes interface=ether4-house-60g network=\ + 10.0.101.0 +add address=10.0.15.254/21 interface=ether3-servers network=10.0.8.0 +/ip dhcp-client +add add-default-route=no interface=ether6-tmobile name=client1 use-peer-dns=\ + no use-peer-ntp=no +add add-default-route=no interface=ether7-starlink name=client2 use-peer-dns=\ + no use-peer-ntp=no +/ip dhcp-server lease +add address=10.0.16.2 client-id=\ + ff:85:d2:82:8a:0:2:0:0:ab:11:cb:63:d8:6c:a1:65:c1:58 comment=unifi \ + mac-address=74:83:C2:1D:4C:51 server=server1 +add address=10.0.16.251 client-id=1:34:98:b5:ae:bc:e3 mac-address=\ + 34:98:B5:AE:BC:E3 server=server1 +add address=10.0.16.1 client-id=1:c8:7f:54:d0:4:2f mac-address=\ + C8:7F:54:D0:04:2F server=server1 +add address=10.0.19.250 client-id=\ + ff:11:94:ec:20:0:1:0:1:2d:e2:38:27:bc:24:11:94:ec:20 mac-address=\ + BC:24:11:94:EC:20 server=server1 +add address=10.0.16.4 client-id=\ + ff:d8:d6:53:a5:0:2:0:0:ab:11:d0:cc:22:d6:96:fe:cd:b1 comment=g.vntx.net \ + mac-address=8C:AE:4C:DD:84:92 server=server1 +add address=10.0.19.136 client-id=1:38:b4:d3:30:3f:4 comment=dishwasher \ + mac-address=38:B4:D3:30:3F:04 server=server1 +add address=10.0.18.4 client-id=1:48:da:35:6f:86:a3 comment=nanokvm \ + mac-address=48:DA:35:6F:86:A3 server=server1 +add address=10.0.18.228 client-id=1:e0:63:da:0:70:89 mac-address=\ + E0:63:DA:00:70:89 server=server1 +add address=10.0.17.189 client-id=1:c4:e7:ae:17:6d:d3 mac-address=\ + C4:E7:AE:17:6D:D3 server=server1 +add address=10.0.15.1 client-id=1:bc:24:11:9b:48:92 mac-address=\ + BC:24:11:9B:48:92 server=servers +add address=10.0.15.2 client-id=1:bc:24:11:62:7b:3f mac-address=\ + BC:24:11:62:7B:3F server=servers +add address=10.0.15.3 client-id=1:bc:24:11:d4:2f:ed mac-address=\ + BC:24:11:D4:2F:ED server=servers +add address=10.0.15.4 client-id=1:bc:24:11:43:3f:ff mac-address=\ + BC:24:11:43:3F:FF server=servers +add address=10.0.15.5 client-id=1:bc:24:11:62:c4:8f mac-address=\ + BC:24:11:62:C4:8F server=servers +add address=10.0.15.6 client-id=1:bc:24:11:3f:8e:1a mac-address=\ + BC:24:11:3F:8E:1A server=servers +add address=10.0.15.20 client-id=1:2c:cf:67:d:b9:4c mac-address=\ + 2C:CF:67:0D:B9:4C server=servers +add address=10.0.15.253 client-id=1:78:9a:18:3f:cb:fe mac-address=\ + 78:9A:18:3F:CB:FE server=servers +add address=10.0.19.241 client-id=1:f4:92:bf:91:8a:61 mac-address=\ + F4:92:BF:91:8A:61 server=server1 +add address=10.0.15.21 mac-address=BC:24:11:98:1C:19 server=servers +add address=10.0.17.185 client-id=1:74:4d:bd:c5:87:cc mac-address=\ + 74:4D:BD:C5:87:CC server=server1 +add address=10.0.17.17 client-id=1:f0:24:f9:55:b8:94 mac-address=\ + F0:24:F9:55:B8:94 server=server1 +add address=10.0.17.184 mac-address=50:02:91:38:EB:98 server=server1 +add address=10.0.16.3 client-id=1:52:54:0:5c:f7:36 mac-address=\ + 52:54:00:5C:F7:36 server=server1 +add address=10.0.17.25 client-id=1:20:f8:3b:9:49:cd mac-address=\ + 20:F8:3B:09:49:CD server=server1 +add address=10.0.17.51 mac-address=40:F5:20:C5:9B:EE server=server1 +add address=10.0.16.5 client-id=\ + ff:ef:a8:c2:c6:0:1:0:1:31:4c:1f:7:b0:dc:ef:a8:c2:c6 mac-address=\ + B0:DC:EF:A8:C2:C6 server=server1 +add address=10.0.17.22 mac-address=EC:94:CB:AA:56:A3 server=server1 +add address=10.0.15.24 client-id=\ + ff:23:7c:24:3e:0:2:0:0:ab:11:ad:b5:e:a0:e1:d9:51:1a mac-address=\ + F6:86:CC:17:A7:F9 server=servers +add address=10.0.17.42 mac-address=34:AB:95:12:8B:DB server=server1 +add address=10.0.15.7 comment=talos4 mac-address=7C:D3:0A:12:C8:7E server=\ + servers +add address=10.0.15.30 mac-address=94:C6:91:A4:19:80 server=servers +add address=10.0.15.31 client-id=\ + ff:a:12:17:11:0:1:0:1:31:8f:72:ff:7c:d3:a:12:17:11 mac-address=\ + 7C:D3:0A:12:17:11 server=servers +/ip dhcp-server network +add address=10.0.8.0/21 domain=mcintire.me gateway=10.0.15.254 +add address=10.0.16.0/22 dns-server=10.0.19.250,9.9.9.9 domain=w5isp.com \ + gateway=10.0.19.254 +/ip dns +set servers=9.9.9.9,149.112.112.112 +/ip dns static +add address=192.168.88.1 comment=defconf name=router.lan type=A +add address=10.0.16.31 comment=dhcp-lease-script_server1_lease-hostname name=\ + Lutron-01f3a316.w5isp.com ttl=15m type=A +add address=10.0.16.31 comment=dhcp-lease-script_server1_lease-hostname name=\ + Lutron-01f3a316 ttl=15m type=A +add address=10.0.16.3 comment=dhcp-lease-script_server1_lease-hostname name=\ + homeassistant.w5isp.com ttl=15m type=A +add address=10.0.16.3 comment=dhcp-lease-script_server1_lease-hostname name=\ + homeassistant ttl=15m type=A +add address=10.0.16.1 comment=dhcp-lease-script_server1_lease-hostname name=\ + Tower.w5isp.com ttl=15m type=A +add address=10.0.16.1 comment=dhcp-lease-script_server1_lease-hostname name=\ + Tower ttl=15m type=A +add address=10.0.16.252 comment=dhcp-lease-script_server1_lease-hostname \ + name=10g-switch-house.w5isp.com ttl=15m type=A +add address=10.0.16.252 comment=dhcp-lease-script_server1_lease-hostname \ + name=10g-switch-house ttl=15m type=A +add address=10.0.16.41 comment=dhcp-lease-script_server1_lease-hostname name=\ + Living-Room.w5isp.com ttl=15m type=A +add address=10.0.16.41 comment=dhcp-lease-script_server1_lease-hostname name=\ + Living-Room ttl=15m type=A +add address=10.0.16.253 comment=dhcp-lease-script_server1_lease-hostname \ + name="Office 2.5G Switch.w5isp.com" ttl=15m type=A +add address=10.0.16.253 comment=dhcp-lease-script_server1_lease-hostname \ + name="Office 2.5G Switch" ttl=15m type=A +add address=10.0.16.36 comment=dhcp-lease-script_server1_lease-hostname name=\ + HallwayAP.w5isp.com ttl=15m type=A +add address=10.0.16.38 comment=dhcp-lease-script_server1_lease-hostname name=\ + LivingRoom.w5isp.com ttl=15m type=A +add address=10.0.16.36 comment=dhcp-lease-script_server1_lease-hostname name=\ + HallwayAP ttl=15m type=A +add address=10.0.16.38 comment=dhcp-lease-script_server1_lease-hostname name=\ + LivingRoom ttl=15m type=A +add address=10.0.16.86 comment=dhcp-lease-script_server1_lease-hostname name=\ + OutsideNE.w5isp.com ttl=15m type=A +add address=10.0.16.86 comment=dhcp-lease-script_server1_lease-hostname name=\ + OutsideNE ttl=15m type=A +add address=10.0.16.43 comment=dhcp-lease-script_server1_lease-hostname name=\ + HousePoESwitch.w5isp.com ttl=15m type=A +add address=10.0.16.43 comment=dhcp-lease-script_server1_lease-hostname name=\ + HousePoESwitch ttl=15m type=A +add address=10.0.16.56 comment=dhcp-lease-script_server1_lease-hostname name=\ + driveway.w5isp.com ttl=15m type=A +add address=10.0.16.56 comment=dhcp-lease-script_server1_lease-hostname name=\ + driveway ttl=15m type=A +add address=10.0.16.44 comment=dhcp-lease-script_server1_lease-hostname name=\ + Garins-MBP.w5isp.com ttl=15m type=A +add address=10.0.16.44 comment=dhcp-lease-script_server1_lease-hostname name=\ + Garins-MBP ttl=15m type=A +add address=10.0.16.64 comment=dhcp-lease-script_server1_lease-hostname name=\ + Apple-Watch.w5isp.com ttl=15m type=A +add address=10.0.16.64 comment=dhcp-lease-script_server1_lease-hostname name=\ + Apple-Watch ttl=15m type=A +add address=10.0.16.37 comment=dhcp-lease-script_server1_lease-hostname name=\ + gmcparallels.w5isp.com ttl=15m type=A +add address=10.0.16.37 comment=dhcp-lease-script_server1_lease-hostname name=\ + gmcparallels ttl=15m type=A +add address=10.0.16.33 comment=dhcp-lease-script_server1_lease-hostname name=\ + mbp14.w5isp.com ttl=15m type=A +add address=10.0.16.33 comment=dhcp-lease-script_server1_lease-hostname name=\ + mbp14 ttl=15m type=A +add address=10.0.16.30 comment=dhcp-lease-script_server1_lease-hostname name=\ + Office.w5isp.com ttl=15m type=A +add address=10.0.16.30 comment=dhcp-lease-script_server1_lease-hostname name=\ + Office ttl=15m type=A +add address=10.0.16.49 comment=dhcp-lease-script_server1_lease-hostname name=\ + openspot2.w5isp.com ttl=15m type=A +add address=10.0.16.49 comment=dhcp-lease-script_server1_lease-hostname name=\ + openspot2 ttl=15m type=A +/ip firewall address-list +add address=10.0.16.0/22 list=local +add address=185.90.196.0/22 list=starlink +add address=10.0.16.78 disabled=yes list=iot-blocked +add address=10.0.16.80 disabled=yes list=iot-blocked +add address=81.171.92.0/23 list=nzb +add address=82.68.15.22 list=nzb +add address=85.12.62.0/24 list=nzb +add address=10.0.17.189 list=iot-blocked +add address=news.eweka.nl list=eweka-tmo +add address=185.90.196.0/22 comment="eweka range" list=eweka-tmo +add address=81.171.92.0/23 comment="eweka range" list=eweka-tmo +/ip firewall filter +add action=accept chain=input dst-address=0.0.0.0 protocol=udp src-address=\ + 104.238.146.79 +add action=accept chain=forward dst-port=25565 in-interface=\ + ether5-vntx-static log=yes protocol=tcp +add action=accept chain=forward dst-port=25565 in-interface=\ + ether5-vntx-static log=yes protocol=udp +add action=drop chain=forward out-interface=ether5-vntx-static \ + src-address-list=iot-blocked +add action=drop chain=forward out-interface=ether6-tmobile src-address-list=\ + iot-blocked +add action=drop chain=forward out-interface=all-ppp src-address-list=\ + iot-blocked +add action=drop chain=forward out-interface=ether7-starlink src-address-list=\ + iot-blocked +add action=accept chain=input comment=\ + "defconf: accept established,related,untracked" connection-state=\ + established,related,untracked +add action=drop chain=input comment="defconf: drop invalid" connection-state=\ + invalid +add action=reject chain=forward comment="Block roblox.com" disabled=yes \ + protocol=tcp reject-with=icmp-host-unreachable src-address-list=local \ + tls-host=*.roblox.com +add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp +add action=accept chain=input comment=\ + "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1 +add action=drop chain=input comment="defconf: drop all not coming from LAN" \ + in-interface-list=!LAN +add action=accept chain=forward comment="defconf: accept in ipsec policy" \ + ipsec-policy=in,ipsec +add action=accept chain=forward comment="defconf: accept out ipsec policy" \ + ipsec-policy=out,ipsec +add action=accept chain=forward comment="no fasttrack for eweka" \ + connection-mark=eweka-conn +add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \ + connection-state=established,related +add action=accept chain=forward comment=\ + "defconf: accept established,related, untracked" connection-state=\ + established,related,untracked +add action=drop chain=forward comment="defconf: drop invalid" \ + connection-state=invalid +add action=drop chain=forward comment=\ + "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \ + connection-state=new in-interface-list=WAN +add action=drop chain=input disabled=yes dst-port=53 in-interface=ether8 \ + protocol=udp src-address=!10.0.16.0/22 +/ip firewall mangle +add action=change-mss chain=forward comment="MSS clamp VNTX" new-mss=1400 \ + out-interface=ether5-vntx-static protocol=tcp tcp-flags=syn +add action=change-mss chain=forward comment="MSS clamp VNTX inbound" \ + in-interface=ether5-vntx-static new-mss=1400 protocol=tcp tcp-flags=syn +add action=change-mss chain=forward comment="MSS clamp TMO out" new-mss=1460 \ + out-interface=ether6-tmobile protocol=tcp tcp-flags=syn +add action=change-mss chain=forward comment="MSS clamp TMO in" in-interface=\ + ether6-tmobile new-mss=1460 protocol=tcp tcp-flags=syn +add action=change-mss chain=forward comment="MSS clamp Starlink out" new-mss=\ + 1460 out-interface=ether7-starlink protocol=tcp tcp-flags=syn +add action=change-mss chain=forward comment="MSS clamp Starlink in" \ + in-interface=ether7-starlink new-mss=1460 protocol=tcp tcp-flags=syn +add action=mark-connection chain=prerouting comment="eweka -> tmo (conn)" \ + dst-address-list=eweka-tmo new-connection-mark=eweka-conn +add action=mark-routing chain=prerouting comment="eweka -> tmo (route)" \ + connection-mark=eweka-conn new-routing-mark=tmo passthrough=no +/ip firewall nat +add action=src-nat chain=srcnat connection-mark=plex-out disabled=yes \ + out-interface=*14 src-address=10.0.16.1 to-addresses=204.110.191.1 +add action=src-nat chain=srcnat disabled=yes src-address=10.0.16.5 \ + to-addresses=204.110.191.1 +add action=src-nat chain=srcnat out-interface=ether5-vntx-static src-address=\ + 10.0.16.1 to-addresses=204.110.191.1 +add action=masquerade chain=srcnat disabled=yes out-interface=all-ppp \ + src-address=10.0.16.0/22 +add action=masquerade chain=srcnat out-interface=ether6-tmobile \ + src-address-list=!iot-blocked +add action=masquerade chain=srcnat out-interface=ether5-vntx-static \ + to-addresses=204.110.191.1 +add action=dst-nat chain=dstnat comment=channels dst-address=204.110.191.1 \ + dst-port=8089 in-interface=ether5-vntx-static protocol=tcp to-addresses=\ + 10.0.16.1 to-ports=8089 +add action=dst-nat chain=dstnat comment=plex dst-address=204.110.191.1 \ + dst-port=32400 in-interface=ether5-vntx-static protocol=tcp to-addresses=\ + 10.0.16.1 to-ports=32400 +add action=dst-nat chain=dstnat comment=plex dst-address=204.110.191.1 \ + dst-port=58732 in-interface=ether5-vntx-static protocol=tcp to-addresses=\ + 10.0.16.184 to-ports=58732 +add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \ + dst-port=8096 in-interface=*14 protocol=tcp to-addresses=10.0.16.1 \ + to-ports=8096 +add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \ + dst-port=25565 in-interface=ether5-vntx-static log=yes protocol=tcp \ + to-addresses=10.0.16.1 to-ports=25565 +add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \ + dst-port=25565 in-interface=ether5-vntx-static log=yes protocol=udp \ + to-addresses=10.0.16.1 to-ports=25565 +add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \ + dst-port=8920 in-interface=*14 protocol=tcp to-addresses=10.0.16.1 \ + to-ports=8920 +add action=masquerade chain=srcnat disabled=yes src-address=172.17.0.0/24 +add action=dst-nat chain=dstnat disabled=yes dst-address=10.0.19.254 \ + dst-port=8080 protocol=tcp to-addresses=172.17.0.2 to-ports=80 +add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \ + dst-port=51413 protocol=tcp to-addresses=10.0.16.1 to-ports=51413 +add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \ + dst-port=51413 protocol=udp to-addresses=10.0.16.1 to-ports=51413 +add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \ + dst-port=8096 protocol=tcp to-addresses=10.0.16.1 to-ports=8096 +add action=dst-nat chain=dstnat disabled=yes dst-address=204.110.191.1 \ + dst-port=8920 protocol=tcp to-addresses=10.0.16.1 to-ports=8920 +add action=masquerade chain=srcnat src-address=172.17.0.0/24 +add action=masquerade chain=srcnat out-interface=ether7-starlink +/ip proxy +set port=8198 src-address=10.0.19.254 +/ip route +add disabled=yes distance=1 dst-address=100.64.0.0/10 gateway=172.17.0.2 \ + pref-src="" routing-table=main scope=30 target-scope=10 +add comment="eweka > starlink" disabled=yes distance=1 dst-address=\ + 185.90.196.0/22 gateway=192.168.1.1 pref-src="" routing-table=main scope=\ + 30 target-scope=10 +add comment="eweka > tmo" disabled=yes distance=1 dst-address=81.171.92.0/23 \ + gateway=192.168.12.1 pref-src="" routing-table=main scope=30 \ + target-scope=10 +add comment="newshosting > tmo" disabled=no distance=1 dst-address=\ + 85.12.62.0/24 gateway=192.168.12.1 pref-src="" routing-table=main scope=\ + 30 target-scope=10 +add comment="eweka > tmo" disabled=yes distance=1 dst-address=185.90.196.0/22 \ + gateway=192.168.12.1 pref-src="" routing-table=main scope=30 \ + target-scope=10 +add disabled=no distance=1 dst-address=10.0.0.0/8 gateway=204.110.191.30 \ + pref-src="" routing-table=main scope=30 target-scope=10 +add disabled=yes distance=1 dst-address=204.110.188.0/22 gateway=\ + 204.110.191.30 routing-table=main scope=30 target-scope=10 +add disabled=yes distance=1 dst-address=10.0.0.0/8 gateway=204.110.191.30 \ + routing-table=main scope=30 target-scope=10 +add disabled=yes distance=1 dst-address=82.68.15.22/32 gateway=204.110.191.30 \ + routing-table=main scope=30 target-scope=10 +add disabled=yes distance=1 dst-address=34.174.59.248/32 gateway=\ + 204.110.191.30 routing-table=main scope=30 target-scope=10 +add disabled=no dst-address=204.110.188.0/22 gateway=204.110.191.30 \ + routing-table=main +add disabled=no dst-address=100.64.0.0/16 gateway=204.110.191.30 \ + routing-table=main +add disabled=no dst-address=10.43.0.0/16 gateway=204.110.191.2 routing-table=\ + main +add comment=wigle.net disabled=no distance=1 dst-address=54.70.85.50/32 \ + gateway=204.110.191.30 routing-table=main scope=30 target-scope=10 +add dst-address=100.64.0.0/10 gateway=172.17.0.2 +add comment="Default via TMO (primary)" disabled=no distance=1 dst-address=\ + 0.0.0.0/0 gateway=192.168.12.1 target-scope=11 +add comment="Default via VNTX (secondary)" disabled=no distance=2 \ + dst-address=0.0.0.0/0 gateway=204.110.191.30 target-scope=11 +add check-gateway=ping comment="Default via Starlink (last\ + \n resort)" distance=3 dst-address=0.0.0.0/0 gateway=4.2.2.3 \ + target-scope=11 +add comment="tmo table default" disabled=no dst-address=0.0.0.0/0 gateway=\ + 4.2.2.1 routing-table=tmo +add check-gateway=ping comment="TMO probe pin" distance=1 dst-address=\ + 4.2.2.1/32 gateway=192.168.12.1%ether6-tmobile scope=10 +add check-gateway=ping comment="VNTX probe pin" distance=1 dst-address=\ + 4.2.2.2/32 gateway=204.110.191.30%ether5-vntx-static scope=10 +add check-gateway=ping comment="Starlink probe pin" distance=1 dst-address=\ + 4.2.2.3/32 gateway=192.168.1.1%ether7-starlink scope=10 +/ipv6 route +add distance=1 dst-address=2000::/3 gateway=2001:470:1f0e:299::1 +/ip service +set ftp disabled=yes +set telnet disabled=yes +set www address=10.0.16.0/24 port=1080 +set api disabled=yes +set api-ssl address=10.0.16.0/22 certificate=api-ssl-cert +/ip smb shares +set [ find default=yes ] disabled=no +/ip upnp +set enabled=yes +/ip upnp interfaces +add disabled=yes interface=ether6-tmobile type=external +add interface=*14 type=external +add interface=bridge type=internal +/ipv6 address +add address=2001:470:1f0e:299::2 advertise=no disabled=yes interface=*10 +add address=2001:470:ba50::/48 advertise=no disabled=yes interface=bridge +add address=2001:470:1f0f:29a:: disabled=yes interface=bridge +/ipv6 dhcp-client +add disabled=yes interface=ether6-tmobile pool-name=tmo pool-prefix-length=64 \ + request=address +add interface=ether7-starlink pool-name=starlink pool-prefix-length=64 \ + request=address,prefix +/ipv6 nd +set [ find default=yes ] advertise-dns=yes +/routing rule +add action=lookup-only-in-table disabled=no dst-address=0.0.0.0/0 \ + src-address=10.0.16.1 table=*400 +/snmp +set contact="Graham McIntire" enabled=yes location=Verona +/system clock +set time-zone-name=America/Chicago +/system identity +set name=graham +/system ntp client +set enabled=yes +/system ntp client servers +add address=ntp.vntx.net +/system routerboard settings +# Firmware upgraded successfully, please reboot for changes to take effect! +set auto-upgrade=yes +/tool e-mail +set certificate-verification=no from=mikrotik@vntx.net port=2525 server=\ + mail.smtp2go.com tls=yes user=vntxmikrotik +/tool graphing interface +add allow-address=10.0.16.0/24 +/tool graphing queue +add allow-address=10.0.16.0/24 +/tool graphing resource +add allow-address=10.0.16.0/24 +/tool mac-server +set allowed-interface-list=LAN +/tool mac-server mac-winbox +set allowed-interface-list=LAN +/tool netwatch +add comment="TMO path" down-script="/ip route disable [find comment=\"Default \ + via TMO (primary)\"]; /ip route disable [find comment=\"tmo table default\ + \"]" host=4.2.2.1 interval=2s timeout=1s type=simple up-script="/ip route \ + enable [find comment=\"Default via TMO (primary)\"]; /ip route enable [fin\ + d comment=\"tmo table default\"]" +add comment="VNTX path" down-script=\ + "/ip route disable [find comment=\"Default via VNTX (secondary)\"]" host=\ + 4.2.2.2 interval=2s timeout=1s type=simple up-script=\ + "/ip route enable [find comment=\"Default via VNTX (secondary)\"]" +add comment="Starlink path" down-script=\ + "/ip route disable [find comment=\"Default via Starlink (last resort)\"]" \ + host=4.2.2.3 interval=2s timeout=1s type=simple up-script=\ + "/ip route enable [find comment=\"Default via Starlink (last resort)\"]" diff --git a/mikrotik-tool/ipv6.md b/mikrotik-tool/ipv6.md index ab6ed2e..d386a91 100644 --- a/mikrotik-tool/ipv6.md +++ b/mikrotik-tool/ipv6.md @@ -47,8 +47,8 @@ loopbacks and P2P links shift down to make room. | `2606:1c80::/64` | **Core servers** — DNS, NTP, monitoring, billing, internal services (static-only, no SLAAC). Lives at 380 (core); see below. | | `2606:1c80:0:1::/64` … `:F::/64` | reserved server expansion (DMZ, hypervisor mgmt, alt server VLANs) | | `2606:1c80:0:10::/64` | **Loopbacks** — one `/128` per router | -| `2606:1c80:0:11::/64` … `:1F::/64` | **Wired backbone P2P links** — one `/64` per link, addressed as `/127` | -| `2606:1c80:0:20::/64` … `:FF::/64` | **Wireless backhaul P2P links** — one `/64` per link, addressed as `/127` | +| `2606:1c80:0:11::/64` … `:1F::/64` | **Wired backbone P2P links** — one `/64` per link, both ends addressed `/64` | +| `2606:1c80:0:20::/64` … `:FF::/64` | **Wireless backhaul P2P links** — one `/64` per link, both ends addressed `/64` | | `2606:1c80:0:1000::/64` | Edge↔TWC transit (already `2605:6000:…` upstream; this slot is for future v6 transit/IX) | | `2606:1c80:0:1001::/64` | Edge↔Spectrum / secondary upstream | | `2606:1c80:0:1002::/64` | Edge↔Preseem (shaper) | @@ -103,12 +103,15 @@ Loopbacks announce into OSPFv3 only. ### Inter-router P2P links (`2606:1c80:0:11::/64` … `:FF::/64`) -One `/64` per physical/logical link, addressed as `/127` between the two +One `/64` per physical/logical link, with both ends addressed `/64` (avoid `/127` — +picking `::1/127` and `::2/127` puts the two ends in *different* /127 networks +since `::1` and `::2` straddle the /127 boundary; verified live 2026-05-09). The +two ends. Numbering follows the existing v4 `/29` transport scheme. Wired/fiber transport uses `:11::`–`:1F::`; wireless backhaul uses `:20::`+. (`:10::/64` is the loopback /64.) -| Link | v4 /29 | v6 /64 | Endpoints (`/127`) | +| Link | v4 /29 | v6 /64 | Endpoints (`/64`) | |----------------------------|---------------------|-------------------------|---------------------------------------------| | edge ↔ core (sfpplus7) | 204.110.191.180/30 | `2606:1c80:0:11::/64` | `…:11::1` edge / `…:11::2` core | | core ↔ climax (ether5) | 10.250.1.88/29 | `2606:1c80:0:12::/64` | `…:12::1` core / `…:12::2` climax | @@ -348,7 +351,7 @@ Apply tower-by-tower in the same order as the CGNAT renumber sequence ```rsc /ipv6 address add address=2606:1c80:0:10::254/128 interface=lo advertise=no -add address=2606:1c80:0:11::1/127 interface=sfp-sfpplus7-core-direct +add address=2606:1c80:0:11::1/64 interface=sfp-sfpplus7-core-direct add address=2606:1c80:0:1002::1/64 interface=sfp-sfpplus11-preseem add address=2606:1c80::1/64 interface=vlan9_sfpplus8 ;; server LAN ;; existing TWC peering address lives outside our /32 — leave it @@ -368,11 +371,11 @@ add network=2606:1c80::/64 synchronize=no ;; server LAN, advertised from edge ```rsc /ipv6 address add address=2606:1c80:0:10::253/128 interface=lo advertise=no -add address=2606:1c80:0:11::2/127 interface=ether3-edge-direct -add address=2606:1c80:0:12::1/127 interface=ether5-climax -add address=2606:1c80:0:13::1/127 interface=ether4-newhope -add address=2606:1c80:0:14::1/127 interface=ether1-982-60ghz -add address=2606:1c80:0:15::1/127 interface=ether6-culleoka-11ghz +add address=2606:1c80:0:11::2/64 interface=ether3-edge-direct +add address=2606:1c80:0:12::1/64 interface=ether5-climax +add address=2606:1c80:0:13::1/64 interface=ether4-newhope +add address=2606:1c80:0:14::1/64 interface=ether1-982-60ghz +add address=2606:1c80:0:15::1/64 interface=ether6-culleoka-11ghz add address=2606:1c80:1400::1/64 interface=vlan10_combo1 ;; 380 mgmt LAN /ipv6 pool @@ -387,7 +390,7 @@ add network=2606:1c80:1400::/44 synchronize=no ```rsc /ipv6 address add address=2606:1c80:0:10::101/128 interface=lo advertise=no -add address=2606:1c80:0:20::1/127 interface=ether3-climax-11ghz +add address=2606:1c80:0:20::1/64 interface=ether3-climax-11ghz add address=2606:1c80:1000::1/64 interface=verona ;; verona mgmt LAN add address=2606:1c80:1500::1/64 interface=ether6-switch ;; altoga mgmt LAN @@ -411,9 +414,9 @@ add network=2606:1c80:1500::/44 synchronize=no ```rsc /ipv6 address add address=2606:1c80:0:10::102/128 interface=lo advertise=no -add address=2606:1c80:0:20::2/127 interface=ether6-verona-11ghz -add address=2606:1c80:0:21::1/127 interface= -add address=2606:1c80:0:12::2/127 interface= +add address=2606:1c80:0:20::2/64 interface=ether6-verona-11ghz +add address=2606:1c80:0:21::1/64 interface= +add address=2606:1c80:0:12::2/64 interface= add address=2606:1c80:1100::1/64 interface=climax-bridge /ipv6 pool @@ -426,7 +429,7 @@ add network=2606:1c80:1100::/44 synchronize=no ### Other towers Same template — substitute loopback, /44, interface names from each -router's `.rsc`, and the matching P2P /127: +router's `.rsc`, and the matching P2P /64: | Router | Loopback | /44 | First customer pool prefix | Mgmt LAN /64 | |-----------|-----------------------|----------------------|----------------------------|------------------------| @@ -542,7 +545,7 @@ add name=default-v3 router-id= redistribute-connected=as-type-1 ```rsc /ipv6 address add address=2606:1c80:0:10::254/128 interface=lo advertise=no -add address=2606:1c80:0:11::1/127 interface=sfp-sfpplus7-core-direct +add address=2606:1c80:0:11::1/64 interface=sfp-sfpplus7-core-direct add address=2606:1c80:0:1002::1/64 interface=sfp-sfpplus11-preseem add address=2606:1c80::1/64 interface=vlan9_sfpplus8 ;; server LAN @@ -567,11 +570,11 @@ add network=2606:1c80::/64 synchronize=no comment="server LAN, originated by edg ```rsc /ipv6 address add address=2606:1c80:0:10::253/128 interface=lo advertise=no -add address=2606:1c80:0:11::2/127 interface=ether3-edge-direct -add address=2606:1c80:0:12::1/127 interface=ether5-climax -add address=2606:1c80:0:13::1/127 interface=ether4-newhope -add address=2606:1c80:0:14::1/127 interface=ether1-982-60ghz -add address=2606:1c80:0:15::1/127 interface=ether6-culleoka-11ghz +add address=2606:1c80:0:11::2/64 interface=ether3-edge-direct +add address=2606:1c80:0:12::1/64 interface=ether5-climax +add address=2606:1c80:0:13::1/64 interface=ether4-newhope +add address=2606:1c80:0:14::1/64 interface=ether1-982-60ghz +add address=2606:1c80:0:15::1/64 interface=ether6-culleoka-11ghz add address=2606:1c80:1400::1/64 interface=vlan10_combo1 ;; 380 mgmt LAN /ipv6 pool @@ -605,7 +608,7 @@ add network=2606:1c80:1400::/44 synchronize=no ```rsc /ipv6 address add address=2606:1c80:0:10::101/128 interface=lo advertise=no -add address=2606:1c80:0:20::1/127 interface=ether3-climax-11ghz +add address=2606:1c80:0:20::1/64 interface=ether3-climax-11ghz add address=2606:1c80:1000::1/64 interface=verona ;; verona mgmt LAN add address=2606:1c80:1500::1/64 interface=ether6-switch ;; altoga mgmt LAN @@ -640,10 +643,10 @@ add network=2606:1c80:1500::/44 synchronize=no ```rsc /ipv6 address add address=2606:1c80:0:10::102/128 interface=lo advertise=no -add address=2606:1c80:0:12::2/127 interface=ether4-380-airfiber24 -add address=2606:1c80:0:17::1/127 interface=ether5-494 -add address=2606:1c80:0:20::2/127 interface=ether6-verona-11ghz -add address=2606:1c80:0:21::1/127 interface=ether3-culleoka-11ghz +add address=2606:1c80:0:12::2/64 interface=ether4-380-airfiber24 +add address=2606:1c80:0:17::1/64 interface=ether5-494 +add address=2606:1c80:0:20::2/64 interface=ether6-verona-11ghz +add address=2606:1c80:0:21::1/64 interface=ether3-culleoka-11ghz add address=2606:1c80:1100::1/64 interface=climax-bridge /ipv6 pool @@ -676,7 +679,7 @@ add network=2606:1c80:1100::/44 synchronize=no ```rsc /ipv6 address add address=2606:1c80:0:10::111/128 interface=lo advertise=no -add address=2606:1c80:0:17::2/127 interface=ether2-climax +add address=2606:1c80:0:17::2/64 interface=ether2-climax add address=2606:1c80:1A00::1/64 interface=494 ;; 494 mgmt LAN /ipv6 pool @@ -706,7 +709,7 @@ add network=2606:1c80:1A00::/44 synchronize=no ```rsc /ipv6 address add address=2606:1c80:0:10::110/128 interface=lo advertise=no -add address=2606:1c80:0:14::2/127 interface=ether7-380 +add address=2606:1c80:0:14::2/64 interface=ether7-380 add address=2606:1c80:1300::1/64 interface=982 ;; 982 mgmt LAN /ipv6 pool @@ -736,8 +739,8 @@ add network=2606:1c80:1300::/44 synchronize=no ```rsc /ipv6 address add address=2606:1c80:0:10::104/128 interface=lo advertise=no -add address=2606:1c80:0:15::2/127 interface=ether6-380-11ghz -add address=2606:1c80:0:21::2/127 interface=ether1-climax-11ghz +add address=2606:1c80:0:15::2/64 interface=ether6-380-11ghz +add address=2606:1c80:0:21::2/64 interface=ether1-climax-11ghz add address=2606:1c80:1600::1/64 interface=mgmt ;; culleoka mgmt LAN /ipv6 pool @@ -768,8 +771,8 @@ add network=2606:1c80:1600::/44 synchronize=no ```rsc /ipv6 address add address=2606:1c80:0:10::108/128 interface=lo advertise=no -add address=2606:1c80:0:13::2/127 interface=ether2-380 -add address=2606:1c80:0:18::1/127 interface=ether6-lowrycrossing +add address=2606:1c80:0:13::2/64 interface=ether2-380 +add address=2606:1c80:0:18::1/64 interface=ether6-lowrycrossing add address=2606:1c80:1800::1/64 interface=newhope ;; newhope mgmt LAN /ipv6 pool @@ -800,7 +803,7 @@ add network=2606:1c80:1800::/44 synchronize=no ```rsc /ipv6 address add address=2606:1c80:0:10::109/128 interface=lo advertise=no -add address=2606:1c80:0:18::2/127 interface=ether1-newhope +add address=2606:1c80:0:18::2/64 interface=ether1-newhope add address=2606:1c80:1900::1/64 interface=lowrycrossing ;; lowry mgmt LAN /ipv6 pool diff --git a/mikrotik-tool/lowry.rsc b/mikrotik-tool/lowry.rsc index bb52aba..954bcef 100644 --- a/mikrotik-tool/lowry.rsc +++ b/mikrotik-tool/lowry.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:30:35 by RouterOS 7.21.4 +# 2026-05-09 09:37:54 by RouterOS 7.21.4 # software id = 2I9X-PQZP # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/netbox_v6_sync.py b/mikrotik-tool/netbox_v6_sync.py new file mode 100644 index 0000000..fb5b335 --- /dev/null +++ b/mikrotik-tool/netbox_v6_sync.py @@ -0,0 +1,239 @@ +#!/usr/bin/env python3 +""" +netbox_v6_sync.py — keep NetBox in sync with the live IPv6 state on the fleet. + +What it does: + 1. Updates prefix descriptions + statuses for known v6 prefixes (so + reading NetBox tells you what's actually live). + 2. For each router with v6 configured today (verona, climax, core), + pulls /ipv6/address/print over the router API and creates/updates + matching NetBox IPAM IP-address records, assigned to the correct + device + interface. + 3. Associates prefixes to sites where the link is wholly within one + site (mgmt LAN, customer PD), and leaves cross-site backbone P2Ps + unsited. + +It is idempotent — re-running it won't duplicate IPs; it'll just update +descriptions if anything has changed. Re-run after each new tower's v6 +apply. + +Usage: + python3 netbox_v6_sync.py [--dry-run] + +Auth: reads NETBOX_TOKEN (or NETBOX_KEY as fallback) from env. Needs the +RouterOS API creds in routers.yaml (uses the same `mikrotik-tool api` +binary in this directory). +""" + +import json +import os +import subprocess +import sys +import urllib.error +import urllib.request + +DRY_RUN = "--dry-run" in sys.argv +NETBOX = "https://netbox.vntx.net/api" +TOKEN = os.environ.get("NETBOX_TOKEN") or os.environ.get("NETBOX_KEY") \ + or "e50298f7fd20f7fd6f1931f635511b34f6e8cfde" + +# Routers that have v6 configured (extend as more towers come online). +# Each tuple: (router-name-in-routers.yaml, netbox-device-name, site-slug) +ROUTERS = [ + ("verona", "verona-router", "verona"), + ("climax", "climax-router", "climax"), + ("core", "380-core-router", "380"), +] + +# Prefix updates: (prefix, status, description) +PREFIX_UPDATES = [ + ("2606:1c80:0:10::/64", "active", + "Router loopbacks — one /128 per router (verona=:101, climax=:102, core=:253; others as towers come online)"), + ("2606:1c80:0:11::/64", "active", + "P2P edge↔core direct (sfp-sfpplus7-core-direct ↔ ether3-edge-direct); BACKUP path (v6 distance 2)"), + ("2606:1c80:0:12::/64", "active", + "P2P core↔climax (ether5-climax ↔ ether4-380-airfiber24); both ends /64"), + ("2606:1c80:0:20::/64", "active", + "P2P verona↔climax 11GHz (ether3-climax-11ghz ↔ ether6-verona-11ghz); both ends /64"), + ("2606:1c80:0:1002::/64", "active", + "P2P edge↔core via Preseem inline shaper (transparent L2); PRIMARY path (v6 distance 1). Preseem rate-limits customer traffic per plan tier"), + ("2606:1c80:1000::/64", "active", + "verona mgmt LAN (gateway 2606:1c80:1000::1 on bridge `verona`)"), + ("2606:1c80:1100::/64", "active", + "climax mgmt LAN (gateway 2606:1c80:1100::1 on bridge `mgmt`)"), + ("2606:1c80:1400::/64", "active", + "core/380 mgmt LAN (gateway 2606:1c80:1400::1 on vlan10_combo1)"), + ("2606:1c80:1500::/64", "active", + "altoga mgmt LAN, served from verona (gateway 2606:1c80:1500::1 on ether6-switch)"), + ("2606:1c80:1001::/48", "active", + "verona customer PD pool (256 × /56) — live in pool `verona-cust-pd-1`"), + ("2606:1c80:1101::/48", "active", + "climax customer PD pool (256 × /56) — live in pool `climax-cust-pd-1`"), + ("2606:1c80:1401::/48", "active", + "core/380 customer PD pool (256 × /56) — live in pool `core-cust-pd-1`"), + ("2606:1c80:1501::/48", "active", + "altoga customer PD pool (256 × /56) — live in pool `altoga-cust-pd-1` on verona"), +] + +# Site-attached prefixes (mgmt LAN + customer PD that map cleanly to one site) +PREFIX_SITES = { + "2606:1c80:1000::/64": "verona", + "2606:1c80:1001::/48": "verona", + "2606:1c80:1100::/64": "climax", + "2606:1c80:1101::/48": "climax", + "2606:1c80:1400::/64": "380", + "2606:1c80:1401::/48": "380", + "2606:1c80:1500::/64": "altoga", + "2606:1c80:1501::/48": "altoga", +} + + +def nb(method, path, payload=None): + headers = {"Authorization": f"Token {TOKEN}", "Accept": "application/json"} + data = None + if payload is not None: + headers["Content-Type"] = "application/json" + data = json.dumps(payload).encode() + req = urllib.request.Request(f"{NETBOX}{path}", data=data, method=method, + headers=headers) + try: + with urllib.request.urlopen(req, timeout=20) as r: + body = r.read() + return r.status, (json.loads(body) if body else None) + except urllib.error.HTTPError as e: + return e.code, json.loads(e.read() or b"null") + + +def find_prefix_id(prefix): + code, data = nb("GET", f"/ipam/prefixes/?prefix={prefix}") + if code != 200 or not data["results"]: + return None + return data["results"][0] + + +def find_site_id(slug): + code, data = nb("GET", f"/dcim/sites/?slug={slug}") + if code != 200 or not data["results"]: + return None + return data["results"][0]["id"] + + +def find_interface_id(device_name, interface_name): + code, data = nb("GET", + f"/dcim/interfaces/?device={device_name}&name={interface_name}") + if code != 200 or not data["results"]: + return None + return data["results"][0]["id"] + + +def find_device_id(device_name): + code, data = nb("GET", f"/dcim/devices/?name={device_name}") + if code != 200 or not data["results"]: + return None + return data["results"][0]["id"] + + +def upsert_ip(address, device_name, interface_name, description): + """Create or update a NetBox IP-address record assigned to the given + device+interface. address is in CIDR form (e.g. 2606:1c80:0:10::101/128). + """ + code, data = nb("GET", f"/ipam/ip-addresses/?address={address}") + if code != 200: + return f"GET failed: {code}" + iface_id = find_interface_id(device_name, interface_name) + if iface_id is None: + # Try to find the interface even if the device has no interface entry + # for it (sometimes NetBox doesn't have all interfaces declared) + return f"interface {device_name}:{interface_name} not in NetBox — skipped" + payload = { + "address": address, + "status": "active", + "assigned_object_type": "dcim.interface", + "assigned_object_id": iface_id, + "description": description, + } + if data["results"]: + existing = data["results"][0] + if DRY_RUN: + return f"would PATCH id={existing['id']}" + c, _ = nb("PATCH", f"/ipam/ip-addresses/{existing['id']}/", payload) + return f"PATCH id={existing['id']} -> {c}" + if DRY_RUN: + return "would CREATE" + c, body = nb("POST", "/ipam/ip-addresses/", payload) + return f"CREATE -> {c}" + (f" err={body}" if c >= 400 else "") + + +def update_prefix(prefix, pstatus, description, site_slug=None): + p = find_prefix_id(prefix) + if not p: + return f"prefix {prefix} not in NetBox" + payload = {"status": pstatus, "description": description} + if site_slug: + site_id = find_site_id(site_slug) + if site_id: + payload["site"] = site_id + if DRY_RUN: + return f"would PATCH id={p['id']} status={pstatus} site={site_slug}" + c, _ = nb("PATCH", f"/ipam/prefixes/{p['id']}/", payload) + return f"PATCH id={p['id']} -> {c}" + + +def get_router_v6_addresses(router_name): + """Returns list of (address-cidr, interface-name, comment) tuples.""" + cmd = ["./mikrotik-tool", "api", router_name, + "/ipv6/address/print", "?dynamic=false"] + out = subprocess.run(cmd, capture_output=True, text=True, timeout=15) + if out.returncode != 0: + return [] + rows = [] + for line in out.stdout.strip().split("\n"): + if not line.strip(): + continue + kv = {} + for part in line.split(" "): + if "=" in part: + k, _, v = part.partition("=") + kv[k.strip()] = v.strip() + addr = kv.get("address", "") + iface = kv.get("interface", "") + comment = kv.get("comment", "") + if addr and iface: + rows.append((addr, iface, comment)) + return rows + + +def main(): + print(f"netbox_v6_sync.py — {'DRY RUN' if DRY_RUN else 'LIVE'}") + print() + + # 1. Prefix updates + print("== updating prefix descriptions/statuses ==") + for prefix, pstatus, desc in PREFIX_UPDATES: + site_slug = PREFIX_SITES.get(prefix) + result = update_prefix(prefix, pstatus, desc, site_slug) + print(f" {prefix:32s} {result}") + print() + + # 2. Per-router IP-address sync + for router_name, device_name, _site in ROUTERS: + print(f"== syncing IPv6 addresses for {router_name} ==") + if find_device_id(device_name) is None: + print(f" device {device_name} not in NetBox — skipping") + continue + addrs = get_router_v6_addresses(router_name) + if not addrs: + print(" no v6 addresses (or API failed)") + continue + for cidr, iface, comment in addrs: + # Skip auto-assigned link-local (auto-link-local=true) + if cidr.lower().startswith("fe80:"): + continue + desc = comment or f"{router_name} {iface}" + result = upsert_ip(cidr, device_name, iface, desc) + print(f" {cidr:42s} -> {iface:32s} {result}") + print() + + +if __name__ == "__main__": + main() diff --git a/mikrotik-tool/newhope.rsc b/mikrotik-tool/newhope.rsc index 57d58ff..b90d68a 100644 --- a/mikrotik-tool/newhope.rsc +++ b/mikrotik-tool/newhope.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:30:35 by RouterOS 7.21.4 +# 2026-05-09 09:37:54 by RouterOS 7.21.4 # software id = 5HTF-YFWV # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/verona-v6-apply.rsc b/mikrotik-tool/verona-v6-apply.rsc index 109eb80..cfe19fc 100644 --- a/mikrotik-tool/verona-v6-apply.rsc +++ b/mikrotik-tool/verona-v6-apply.rsc @@ -50,7 +50,7 @@ /ipv6 address add address=2606:1c80:0:10::101/128 interface=lo advertise=no comment="loopback" -add address=2606:1c80:0:20::1/127 interface=ether3-climax-11ghz advertise=no comment="P2P verona<->climax" +add address=2606:1c80:0:20::1/64 interface=ether3-climax-11ghz advertise=no comment="P2P verona<->climax" add address=2606:1c80:1000::1/64 interface=verona advertise=yes comment="verona mgmt LAN" add address=2606:1c80:1500::1/64 interface=ether6-switch advertise=yes comment="altoga mgmt LAN" diff --git a/mikrotik-tool/verona.rsc b/mikrotik-tool/verona.rsc index 909ad1a..c4fa974 100644 --- a/mikrotik-tool/verona.rsc +++ b/mikrotik-tool/verona.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:30:35 by RouterOS 7.21.4 +# 2026-05-09 09:37:54 by RouterOS 7.21.4 # software id = Y1CT-1WB1 # # model = CCR2004-16G-2S+