From d709aabe50aa770dab303cadc75141613cc0eb1e Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Thu, 14 May 2026 09:29:10 -0500 Subject: [PATCH] routers update --- CLAUDE.md | 27 +++++++++++++++++++++++++++ mikrotik-tool/494.rsc | 8 ++++---- mikrotik-tool/982.rsc | 8 ++++---- mikrotik-tool/climax.rsc | 12 ++++++------ mikrotik-tool/core.rsc | 11 ++++++----- mikrotik-tool/culleoka.rsc | 8 ++++---- mikrotik-tool/edge.rsc | 2 +- mikrotik-tool/home.rsc | 26 +++++++++++++++----------- mikrotik-tool/lowry.rsc | 8 ++++---- mikrotik-tool/mikrotik-tool | Bin 9501282 -> 9501282 bytes mikrotik-tool/newhope.rsc | 8 ++++---- mikrotik-tool/verona.rsc | 19 ++++++++++--------- 12 files changed, 85 insertions(+), 52 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index aab9928..03ea0e7 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -246,6 +246,33 @@ Per-tower /44s + central server LAN at `2606:1c80::/64` on edge. Full allocation plan in `mikrotik-tool/ipv6.md`. NetBox has these as IPAM prefixes. +### graham's home network — IPv6 +Home (`RB5009`, identity `graham`, `10.0.19.254`) takes a **`/56`** from +verona via DHCPv6-PD on `ether5-vntx-static` (verona's `verona-wired-pd` +dhcp-server on `vlan9_sfpplus1`, drawing from `verona-cust-pd-1`). +Currently `2606:1c80:1001:e00::/56`. Key config on home: +- `/ipv6 dhcp-client` on `ether5-vntx-static`: `request=prefix`, + `pool-name=home-pd-vntx`, **`pool-prefix-length=64`** (must be 64, not + 56, so the pool yields /64s — changing this only takes effect on a + client disable/enable, not live), `default-route-tables=v6-verona`. +- `/ipv6 address` with `from-pool=home-pd-vntx address=::1 advertise=yes` + on `bridge` (→ `:e00::1/64`) and `ether3-servers` (→ `:e01::1/64`). + Remaining 254 /64s of the /56 stay in the pool for internal use. +- Egress policy: `/routing rule` `src-address=2606:1c80::/32 + action=lookup-only-in-table table=v6-verona` — the verona /56 is + single-homed, so traffic sourced from it must egress via verona only + (T-Mobile/Starlink would BCP38-drop it). No v6 WAN failover for the + internal /56, by design. The PD client's default lands in the + `v6-verona` table, not `main`. +- Stateless DHCPv6 servers (`home-bridge-stateless`, + `home-servers-stateless`) carry the `v6-dns` option (Cloudflare). +- Stale `tunnerbroker` `/ipv6 pool` (HE.net `2001:470:ba50::/48`) is + unused — leave or remove. +- The `mikrotik-tool script` SSH path can't handle bare ROS verbs like + `release`/`disable`/`enable` or `:delay` (flattenRSC only knows + add/set/remove/print/get) — use `set [find] disabled=yes/no` instead, + and sequence delays from the shell side. + ## Claude Assistant Guidelines - Any time Claude learns something new, automatically add it to CLAUDE.md diff --git a/mikrotik-tool/494.rsc b/mikrotik-tool/494.rsc index 57dae6a..4fefb7d 100644 --- a/mikrotik-tool/494.rsc +++ b/mikrotik-tool/494.rsc @@ -1,4 +1,4 @@ -# 2026-05-14 08:38:20 by RouterOS 7.21.4 +# 2026-05-14 09:28:51 by RouterOS 7.21.4 # software id = K4QG-8NQV # # model = RB5009UG+S+ @@ -218,7 +218,7 @@ add add-arp=yes address-pool=mgmt interface=management lease-script="{\ /ip smb users set [ find default=yes ] disabled=yes /ipv6 dhcp-server option -add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'" +add code=23 name=v6-dns value="'2606:1c80::240''2606:1c80::250'" /ipv6 pool add name=494-cust-pd-1 prefix=2606:1c80:1a01::/48 prefix-length=56 /ppp profile @@ -412,7 +412,7 @@ add address=10.10.160.0/20 dns-server=204.110.191.240,204.110.191.20 domain=\ add address=100.64.160.0/20 dns-server=204.110.191.240,204.110.191.20 domain=\ vntx.net gateway=100.64.175.254 ntp-server=204.110.191.19 /ip dns -set servers=9.9.9.9,1.1.1.1 +set servers=9.9.9.9,1.1.1.1,2606:1c80::240,2606:1c80::250 /ip firewall address-list add address=154.66.115.255 list=CPF add address=10.0.0.0/8 list=CPF @@ -467,7 +467,7 @@ add address=2606:1c80:0:17::2 advertise=no comment="P2P 494<->climax" \ interface=ether2-climax add address=2606:1c80:1a00::1 comment="494 mgmt LAN" interface=management /ipv6 dhcp-server -add interface=management name=494-mgmt-stateless +add dhcp-option=v6-dns interface=management name=494-mgmt-stateless /ipv6 firewall filter add action=accept chain=input comment=established connection-state=\ established,related diff --git a/mikrotik-tool/982.rsc b/mikrotik-tool/982.rsc index 5e3f49a..b61a263 100644 --- a/mikrotik-tool/982.rsc +++ b/mikrotik-tool/982.rsc @@ -1,4 +1,4 @@ -# 2026-05-14 08:38:20 by RouterOS 7.21.4 +# 2026-05-14 09:28:52 by RouterOS 7.21.4 # software id = FUVS-HCM5 # # model = CCR1009-7G-1C-1S+ @@ -121,7 +121,7 @@ add address-pool=mgmt interface=mgmt lease-script="{\ /ip smb users set [ find default=yes ] disabled=yes /ipv6 dhcp-server option -add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'" +add code=23 name=v6-dns value="'2606:1c80::240''2606:1c80::250'" /ipv6 pool add name=982-cust-pd-1 prefix=2606:1c80:1301::/48 prefix-length=56 /ppp profile @@ -325,7 +325,7 @@ add address=10.10.48.0/20 dns-server=204.110.191.240,204.110.191.20 domain=\ add address=100.64.28.0/22 dns-server=204.110.191.240,204.110.191.20 domain=\ vntx.net gateway=100.64.31.254 ntp-server=204.110.191.19 /ip dns -set servers=9.9.9.9,1.1.1.1 +set servers=9.9.9.9,1.1.1.1,2606:1c80::240,2606:1c80::250 /ip firewall address-list add address=100.64.35.199 comment="Scott Anderson (2203)" list=BusinessUltra add address=100.64.35.199 comment="Scott Anderson (2203)" list=Active @@ -413,7 +413,7 @@ add address=2606:1c80:0:14::2 advertise=no comment="P2P 982<->core (60GHz)" \ interface=ether7-380 add address=2606:1c80:1300::1 comment="982 mgmt LAN" interface=mgmt /ipv6 dhcp-server -add interface=mgmt name=982-mgmt-stateless +add dhcp-option=v6-dns interface=mgmt name=982-mgmt-stateless /ipv6 firewall filter add action=accept chain=input comment=established connection-state=\ established,related diff --git a/mikrotik-tool/climax.rsc b/mikrotik-tool/climax.rsc index 1f722ea..7dcd81c 100644 --- a/mikrotik-tool/climax.rsc +++ b/mikrotik-tool/climax.rsc @@ -1,4 +1,4 @@ -# 2026-05-14 08:38:19 by RouterOS 7.21.4 +# 2026-05-14 09:28:51 by RouterOS 7.21.4 # software id = UETF-WF31 # # model = CCR2004-16G-2S+ @@ -134,7 +134,7 @@ add address-pool=climax-mgmt interface=mgmt lease-script="{\ \n}\ \n" name=climax-mgmt /ipv6 dhcp-server option -add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'" +add code=23 name=v6-dns value="'2606:1c80::240''2606:1c80::250'" /ipv6 pool add name=climax-cust-pd-1 prefix=2606:1c80:1101::/48 prefix-length=56 /ppp profile @@ -333,7 +333,7 @@ add address=100.64.4.0/22 dns-server=204.110.191.240,204.110.191.20 domain=\ add address=204.110.188.32/27 dns-server=204.110.191.240,204.110.191.20 \ domain=vntx.net gateway=204.110.188.62 ntp-server=204.110.191.19 /ip dns -set servers=9.9.9.9,1.1.1.1 +set servers=9.9.9.9,1.1.1.1,2606:1c80::240,2606:1c80::250 /ip firewall filter add action=accept chain=forward comment=\ "bypass fasttrack for MPLS spine (out)" out-interface=ether5-494 @@ -431,9 +431,9 @@ add address=2606:1c80:1100:1::1 comment="climax customer LAN (PPPoE+DHCP)" \ /ipv6 dhcp-relay option set client_mac value="0x0001\$(CLIENT_MAC)" /ipv6 dhcp-server -add interface=mgmt name=climax-mgmt-stateless -add address-pool=climax-cust-pd-1 interface=climax-bridge name=\ - climax-cust-pd-server +add dhcp-option=v6-dns interface=mgmt name=climax-mgmt-stateless +add address-pool=climax-cust-pd-1 dhcp-option=v6-dns interface=climax-bridge \ + name=climax-cust-pd-server /ipv6 firewall filter add action=accept chain=input comment=established connection-state=\ established,related diff --git a/mikrotik-tool/core.rsc b/mikrotik-tool/core.rsc index 299b00c..ec6e51d 100644 --- a/mikrotik-tool/core.rsc +++ b/mikrotik-tool/core.rsc @@ -1,4 +1,4 @@ -# 2026-05-14 08:38:20 by RouterOS 7.21.4 +# 2026-05-14 09:28:52 by RouterOS 7.21.4 # software id = XS5B-41QR # # model = CCR1009-7G-1C-1S+ @@ -221,7 +221,7 @@ add address-pool=380-mgmt interface=vlan10_combo1 lease-script="{\ /ip smb users set [ find default=yes ] disabled=yes /ipv6 dhcp-server option -add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'" +add code=23 name=v6-dns value="'2606:1c80::240''2606:1c80::250'" /ipv6 pool add name=core-cust-pd-1 prefix=2606:1c80:1401::/48 prefix-length=56 /ppp profile @@ -410,7 +410,7 @@ add address=10.10.64.0/20 dns-server=204.110.191.240,204.110.191.20 domain=\ add address=100.64.8.0/22 dns-server=204.110.191.240,204.110.191.20 domain=\ vntx.net gateway=100.64.11.254 ntp-server=204.110.191.19 /ip dns -set servers=9.9.9.9,1.1.1.1 +set servers=9.9.9.9,1.1.1.1,2606:1c80::240,2606:1c80::250 /ip firewall filter add action=accept chain=forward comment=\ "bypass fasttrack for MPLS spine (out)" out-interface=ether1-982-60ghz @@ -534,8 +534,9 @@ add address=2606:1c80:1400::1 comment="380 mgmt LAN" interface=vlan10_combo1 add address=2606:1c80:1400:1::1 comment="380 customer LAN (PPPoE+DHCP)" \ interface=combo1-380 /ipv6 dhcp-server -add interface=vlan10_combo1 name=core-mgmt-stateless -add address-pool=core-cust-pd-1 interface=combo1-380 name=core-cust-pd-server +add dhcp-option=v6-dns interface=vlan10_combo1 name=core-mgmt-stateless +add address-pool=core-cust-pd-1 dhcp-option=v6-dns interface=combo1-380 name=\ + core-cust-pd-server /ipv6 firewall filter add action=accept chain=input comment=established connection-state=\ established,related diff --git a/mikrotik-tool/culleoka.rsc b/mikrotik-tool/culleoka.rsc index ebcd1f0..d07e559 100644 --- a/mikrotik-tool/culleoka.rsc +++ b/mikrotik-tool/culleoka.rsc @@ -1,4 +1,4 @@ -# 2026-05-14 08:38:20 by RouterOS 7.21.4 +# 2026-05-14 09:28:52 by RouterOS 7.21.4 # software id = HVP9-3G0K # # model = CCR1009-7G-1C-1S+ @@ -213,7 +213,7 @@ add address-pool=clayton disabled=yes interface=vlan_30_clayton lease-time=\ /ip smb users set [ find default=yes ] disabled=yes /ipv6 dhcp-server option -add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'" +add code=23 name=v6-dns value="'2606:1c80::240''2606:1c80::250'" /ipv6 pool add name=culleoka-cust-pd-1 prefix=2606:1c80:1601::/48 prefix-length=56 /ppp profile @@ -536,7 +536,7 @@ add address=204.110.188.128/27 dns-server=204.110.191.240,204.110.191.20 \ /ip dhcp-server option sets add name=vntx options=*1 /ip dns -set servers=9.9.9.9,1.1.1.1 +set servers=9.9.9.9,1.1.1.1,2606:1c80::240,2606:1c80::250 /ip firewall address-list add address=10.254.254.104 disabled=yes list=bgp-networks add address=10.10.96.0/20 disabled=yes list=bgp-networks @@ -617,7 +617,7 @@ add address=2606:1c80:0:21::2 advertise=no comment=\ "P2P culleoka<->climax (radio DOWN)" interface=ether1-climax-11ghz add address=2606:1c80:1600::1 comment="culleoka mgmt LAN" interface=mgmt /ipv6 dhcp-server -add interface=mgmt name=culleoka-mgmt-stateless +add dhcp-option=v6-dns interface=mgmt name=culleoka-mgmt-stateless /ipv6 firewall filter add action=accept chain=input comment=established connection-state=\ established,related diff --git a/mikrotik-tool/edge.rsc b/mikrotik-tool/edge.rsc index 7d26c03..f7d1784 100644 --- a/mikrotik-tool/edge.rsc +++ b/mikrotik-tool/edge.rsc @@ -1,4 +1,4 @@ -# may/14/2026 08:38:19 by RouterOS 6.49.18 +# may/14/2026 09:28:51 by RouterOS 6.49.18 # software id = 8XZE-R7EJ # # model = CCR2004-1G-12S+2XS diff --git a/mikrotik-tool/home.rsc b/mikrotik-tool/home.rsc index 321bdce..d3bc6d2 100644 --- a/mikrotik-tool/home.rsc +++ b/mikrotik-tool/home.rsc @@ -1,4 +1,4 @@ -# 2026-05-14 08:38:20 by RouterOS 7.22.3 +# 2026-05-14 09:28:51 by RouterOS 7.22.3 # software id = ZGNY-ZJW7 # # model = RB5009UG+S+ @@ -51,6 +51,7 @@ set 0 kind=fq-codel /routing table add disabled=no fib name=vntx add disabled=no fib name=tmo +add comment="vntx v6 /56 egress via verona" disabled=no fib name=v6-verona /snmp community set [ find default=yes ] addresses=10.0.16.0/22,10.0.0.0/8,204.110.188.0/22 \ name=kdyyJrT0Mm @@ -455,18 +456,19 @@ set enabled=yes add disabled=yes interface=ether6-tmobile type=external add interface=*14 type=external add interface=bridge type=internal +/ipv6 address +add address=::1 comment="home LAN (verona PD /64)" from-pool=home-pd-vntx \ + interface=bridge +add address=::1:0:0:0:1 comment="servers LAN (verona PD /64)" from-pool=\ + home-pd-vntx interface=ether3-servers /ipv6 dhcp-client -add add-default-route=yes comment=\ - "DHCPv6-PD from TMHI (disabled - TMHI runs SLAAC only, no PD server)" \ - disabled=yes interface=ether6-tmobile pool-name=home-pd \ - pool-prefix-length=64 prefix-hint=::/56 request=address,prefix -add add-default-route=yes comment=\ - "DHCPv6-PD from verona (disabled, fallback)" default-route-distance=2 \ - interface=ether5-vntx-static pool-name=home-pd-vntx pool-prefix-length=56 \ - request=prefix +add add-default-route=yes comment="DHCPv6-PD /56 from verona" \ + default-route-distance=2 default-route-tables=v6-verona interface=\ + ether5-vntx-static pool-name=home-pd-vntx pool-prefix-length=64 request=\ + prefix /ipv6 dhcp-server -add interface=bridge name=home-bridge-stateless -add interface=ether3-servers name=home-servers-stateless +add dhcp-option=v6-dns interface=bridge name=home-bridge-stateless +add dhcp-option=v6-dns interface=ether3-servers name=home-servers-stateless /ipv6 firewall filter add action=accept chain=input comment=established connection-state=\ established,related @@ -494,6 +496,8 @@ add advertise-dns=yes interface=ether3-servers other-configuration=yes /routing rule add action=lookup-only-in-table disabled=no dst-address=0.0.0.0/0 \ src-address=10.0.16.1 table=*400 +add action=lookup-only-in-table comment="vntx /56 egress via verona only" \ + src-address=2606:1c80::/32 table=v6-verona /snmp set contact="Graham McIntire" enabled=yes location=Verona /system clock diff --git a/mikrotik-tool/lowry.rsc b/mikrotik-tool/lowry.rsc index 0d1a2fb..92e6f94 100644 --- a/mikrotik-tool/lowry.rsc +++ b/mikrotik-tool/lowry.rsc @@ -1,4 +1,4 @@ -# 2026-05-14 08:38:20 by RouterOS 7.21.4 +# 2026-05-14 09:28:52 by RouterOS 7.21.4 # software id = 2I9X-PQZP # # model = CCR1009-7G-1C-1S+ @@ -144,7 +144,7 @@ add address-pool=mgmt interface=management lease-script="{\ /ip smb users set [ find default=yes ] disabled=yes /ipv6 dhcp-server option -add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'" +add code=23 name=v6-dns value="'2606:1c80::240''2606:1c80::250'" /ipv6 pool add name=lowry-cust-pd-1 prefix=2606:1c80:1901::/48 prefix-length=56 /ppp profile @@ -503,7 +503,7 @@ add address=204.110.188.192/27 dns-server=204.110.191.240,204.110.191.20 \ /ip dhcp-server option sets add name=vntx options=*1 /ip dns -set servers=9.9.9.9,1.1.1.1 +set servers=9.9.9.9,1.1.1.1,2606:1c80::240,2606:1c80::250 /ip firewall address-list add address=204.110.191.229 list=whitelist add address=portal.vntx.net list=whitelist @@ -1288,7 +1288,7 @@ add address=2606:1c80:0:18::2 advertise=no comment="P2P lowry<->newhope" \ interface=ether1-newhope add address=2606:1c80:1900::1 comment="lowry mgmt LAN" interface=management /ipv6 dhcp-server -add interface=management name=lowry-mgmt-stateless +add dhcp-option=v6-dns interface=management name=lowry-mgmt-stateless /ipv6 firewall filter add action=accept chain=input comment=established connection-state=\ established,related diff --git a/mikrotik-tool/mikrotik-tool b/mikrotik-tool/mikrotik-tool index 8ab4b43fde7db99913dd12b30f865f8e84c824fc..b659c31e1257902fcb6fd2b1e4d9d07410d3f8f7 100755 GIT binary patch delta 972 zcmbWy$4^rM0Dy6A!2yDxh`13Ps6gMN8waaaDuos(+9IpG0u`|e6mTOV)PZ2s#ES>w zjB$^o2jhrbFoqZoh|w4g5g}@#A?k%_{P-6<{Epw@8~WK3Foe5rg2Fx;wD0V_NoQYP zx^w+n>pJg)(V)1%d|j!g!Q^Ntuv^MSvsbIPnq4^xk4G?M>9huSfjT=Y!KiiAIW-DP zZhd2h+FM(0x2UU4X;r(c+%ARK)L_ZTR^`}?Vr^mRrle9=ovKv|^GRWoA%h$N2*eaj z#WYMu5P~rSAqd4xO!VQHh1rO}97JL+qA(Bhu>cFP2#c`<(O8NY#9|qiV+B?s4y&*l zYy47J{Pf3hf=Vwc1#P9yRVle7y;=}OwbG?=N;;j+sdDO_l2oA)Dk{&X$cv(aMU_od zCM$KxO1;nD7moxaLID9HlAweNYG|N^4ijB6)?yvjV*^ry{Ux7$qo08JsAG1Q#k$i7L3U z9o5)@8tjAzyRaLzs6#!xXh0*Hum^jw5BqTd2XP3^IE)q?K`V};4ejvZ7>?rvPND;+ z(CP1%cgY4*+g3bl8T{^fbjvCg*AFY>mBY1#&9BBrNBZvzy@z6oBW3TRzApOGKe*Vu z{>h`v$lKTcmOShTy_7iV_dt@>6YL*)+m-5we*G$9-1zIq&GD5rBf^V&SKDQ(i+_c4 zAx}GHH*ERe#{B83(`6;m;g|n}esaHm;oWt?*KF%umgk85D1J8O4wo2GuMG5j@IOCu Hy1VKh9;T2a delta 972 zcmbWy?=RE=0LSriRDPsOib_SPDCgX{JBPUQ+v)s1A;R7FemLa!?@EeXQdn!FCezk) zRu690TE=FUsc8L}2W@#!)_Tx`o;22a`xkofdiMD|c(47Qb6vyKXAiONPvu5vcig~t ziD*&(Wd70fb&n9Y{1jViOS-MLR;}-7&8jNW=j5f>rOCQNQ+ah}K~__3Mq^Y%n<_V{ zUYecT)S9GhZZH*PE30$~wt8EoSz2T0Q0M3sY4(Jwmd2)RdwZtB(j$l+f_OVzAc8C0 zumd}>3-0iMC%mv5-q?e!|6cfDAAGSN2jB;P9K<0UMgWfBD2^czK{$>R2*ydA!fAvc z6lZYODTu?|UxrvrMnz;~v|4Sns#S8qY*wfRl~raj34+NYkFXjQLWEHjZ5+{vO8q?} zq75=tj9eBYk8(Jd!XQC7q=Os!)v@Tt+SGP>%*Qq6y7tK`YwOjt+F<3a;WBx^NxcxPhDKK`(Bh4-VW$Kki@v zcX1Dc&I!?w%O|aM@#y5o)jmo4)74_rU(H~K;$cpT+RwaH^KP5h_{wO|xB2B4HBml^ z<6~Os@R!Mj(r`yfmu>8|R#O){T0HGsTOHCC2TFYH?i)XPr#yRHX98xMUm4aDyBaq? z1jnrOFUTLif8b113|Eu|YU%{pVC&bC41>