routers update
This commit is contained in:
parent
d5e74c6bbd
commit
eba433988a
23 changed files with 1889 additions and 121 deletions
117
mikrotik-tool/494-v6-apply.rsc
Normal file
117
mikrotik-tool/494-v6-apply.rsc
Normal file
|
|
@ -0,0 +1,117 @@
|
|||
# =============================================================================
|
||||
# 494 — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
|
||||
# =============================================================================
|
||||
#
|
||||
# 494 is a leaf tower. Single backbone P2P:
|
||||
# * climax (north) — ether2-climax (AF11), v6 P2P 2606:1c80:0:17::/64 (494 .2)
|
||||
# Default upstream toward climax via :17::1 — climax forwards to core.
|
||||
#
|
||||
# Loopback: 2606:1c80:0:10::111/128
|
||||
# /44 customer aggregate: 2606:1c80:1A00::/44
|
||||
# Mgmt LAN: 2606:1c80:1A00::1/64 (assumes `mgmt` bridge — verify name first).
|
||||
# PPPoE profile assumed `pppoe`. Customer interface-list assumed `customer`.
|
||||
# =============================================================================
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# WIPE
|
||||
# -----------------------------------------------------------------------------
|
||||
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
|
||||
/ipv6 dhcp-server remove [find]
|
||||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find !default]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find !dynamic]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find !dynamic]
|
||||
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — BGP instance
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing bgp instance
|
||||
add name=bgp-instance-1 as=393837 router-id=10.254.254.111
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — addresses
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:10::111/128 interface=lo advertise=no comment="loopback"
|
||||
add address=2606:1c80:0:17::2/64 interface=ether2-climax advertise=no comment="P2P 494<->climax"
|
||||
add address=2606:1c80:1A00::1/64 interface=mgmt advertise=yes comment="494 mgmt LAN"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — static routes
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 route
|
||||
add dst-address=::/0 gateway=2606:1c80:0:17::1 distance=1 comment="default via climax"
|
||||
add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:17::1 distance=1 comment="core loopback (iBGP bootstrap, via climax)"
|
||||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:17::1 distance=1 comment="edge loopback (via climax)"
|
||||
add dst-address=2606:1c80:1A00::/44 blackhole distance=200 comment="494 /44 aggregate (iBGP origin)"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — neighbour discovery on the mgmt LAN
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 nd
|
||||
add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
/ipv6 nd prefix
|
||||
add interface=mgmt prefix=2606:1c80:1A00::/64 autonomous=yes on-link=yes
|
||||
|
||||
/ipv6 dhcp-server
|
||||
add interface=mgmt name=494-mgmt-stateless address-pool=static-only
|
||||
|
||||
/ipv6 dhcp-server option
|
||||
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — customer PD pool + bind to PPPoE profile
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 pool
|
||||
add name=494-cust-pd-1 prefix=2606:1c80:1A01::/48 prefix-length=56
|
||||
|
||||
/ppp profile
|
||||
set [find name=pppoe] remote-ipv6-prefix-pool=494-cust-pd-1 dhcpv6-pd-pool=494-cust-pd-1
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 firewall filter
|
||||
add chain=input action=accept connection-state=established,related comment="established"
|
||||
add chain=input action=drop connection-state=invalid comment="invalid"
|
||||
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
||||
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
|
||||
add chain=input action=drop comment="default deny"
|
||||
|
||||
add chain=forward action=accept connection-state=established,related comment="established"
|
||||
add chain=forward action=drop connection-state=invalid comment="invalid"
|
||||
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
||||
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
|
||||
add chain=forward action=accept src-address=2606:1c80:1A00::/44 comment="v6 outbound from 494 customers"
|
||||
add chain=forward action=drop comment="default deny"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP to core (v6 RR)
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing filter rule
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1A00::/44 || dst==2606:1c80:0:10::111/128 || (dst-len==64 && dst==2606:1c80:0:17::/64)) { accept; } else { reject; }"
|
||||
|
||||
/routing bgp connection
|
||||
add name=ibgp-rr-core instance=bgp-instance-1 templates=default \
|
||||
afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::111 \
|
||||
remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \
|
||||
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
output.redistribute=connected,static \
|
||||
comment="iBGP to core (v6 RR), v6 transport"
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 09:37:54 by RouterOS 7.21.4
|
||||
# 2026-05-09 11:21:08 by RouterOS 7.21.4
|
||||
# software id = K4QG-8NQV
|
||||
#
|
||||
# model = RB5009UG+S+
|
||||
|
|
@ -354,7 +354,7 @@ add disabled=no instance=ospf-instance-1 name=ospf-area-1
|
|||
set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
|
||||
kdyyJrT0Mm
|
||||
/system logging action
|
||||
add name=netsvr remote=204.110.191.229 remote-port=1514 target=remote
|
||||
add name=logs remote=204.110.191.229 target=remote
|
||||
/interface bridge port
|
||||
add bridge=494 interface=ether8 internal-path-cost=10 path-cost=10
|
||||
add bridge=494 interface=ether7 internal-path-cost=10 path-cost=10
|
||||
|
|
@ -480,10 +480,10 @@ set time-zone-name=America/Chicago
|
|||
/system identity
|
||||
set name=494
|
||||
/system logging
|
||||
add action=netsvr prefix=test1 topics=system,info
|
||||
add action=netsvr prefix=test1 topics=warning
|
||||
add action=netsvr prefix=test1 topics=critical
|
||||
add action=netsvr prefix=test1 topics=error,!ospf,!route
|
||||
add action=logs prefix=test1 topics=system,info
|
||||
add action=logs prefix=test1 topics=warning
|
||||
add action=logs prefix=test1 topics=critical
|
||||
add action=logs prefix=test1 topics=error,!ospf,!route
|
||||
/system ntp client
|
||||
set enabled=yes
|
||||
/system ntp client servers
|
||||
|
|
|
|||
117
mikrotik-tool/982-v6-apply.rsc
Normal file
117
mikrotik-tool/982-v6-apply.rsc
Normal file
|
|
@ -0,0 +1,117 @@
|
|||
# =============================================================================
|
||||
# 982 — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
|
||||
# =============================================================================
|
||||
#
|
||||
# 982 is a leaf tower. Single backbone P2P:
|
||||
# * core (north) — ether7-380 (60 GHz), v6 P2P 2606:1c80:0:14::/64 (982 .2)
|
||||
# Default upstream toward core via :14::1.
|
||||
#
|
||||
# Loopback: 2606:1c80:0:10::110/128
|
||||
# /44 customer aggregate: 2606:1c80:1300::/44
|
||||
# Mgmt LAN: 2606:1c80:1300::1/64 (assumes `mgmt` bridge — verify name first).
|
||||
# PPPoE profile assumed `pppoe`. Customer interface-list assumed `customer`.
|
||||
# =============================================================================
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# WIPE
|
||||
# -----------------------------------------------------------------------------
|
||||
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
|
||||
/ipv6 dhcp-server remove [find]
|
||||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find !default]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find !dynamic]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find !dynamic]
|
||||
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — BGP instance
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing bgp instance
|
||||
add name=bgp-instance-1 as=393837 router-id=10.254.254.110
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — addresses
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:10::110/128 interface=lo advertise=no comment="loopback"
|
||||
add address=2606:1c80:0:14::2/64 interface=ether7-380 advertise=no comment="P2P 982<->core (60GHz)"
|
||||
add address=2606:1c80:1300::1/64 interface=mgmt advertise=yes comment="982 mgmt LAN"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — static routes
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 route
|
||||
add dst-address=::/0 gateway=2606:1c80:0:14::1 distance=1 comment="default via core"
|
||||
add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:14::1 distance=1 comment="core loopback (iBGP bootstrap)"
|
||||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:14::1 distance=1 comment="edge loopback via core"
|
||||
add dst-address=2606:1c80:1300::/44 blackhole distance=200 comment="982 /44 aggregate (iBGP origin)"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — neighbour discovery on the mgmt LAN
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 nd
|
||||
add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
/ipv6 nd prefix
|
||||
add interface=mgmt prefix=2606:1c80:1300::/64 autonomous=yes on-link=yes
|
||||
|
||||
/ipv6 dhcp-server
|
||||
add interface=mgmt name=982-mgmt-stateless address-pool=static-only
|
||||
|
||||
/ipv6 dhcp-server option
|
||||
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — customer PD pool + bind to PPPoE profile
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 pool
|
||||
add name=982-cust-pd-1 prefix=2606:1c80:1301::/48 prefix-length=56
|
||||
|
||||
/ppp profile
|
||||
set [find name=pppoe] remote-ipv6-prefix-pool=982-cust-pd-1 dhcpv6-pd-pool=982-cust-pd-1
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 firewall filter
|
||||
add chain=input action=accept connection-state=established,related comment="established"
|
||||
add chain=input action=drop connection-state=invalid comment="invalid"
|
||||
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
||||
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
|
||||
add chain=input action=drop comment="default deny"
|
||||
|
||||
add chain=forward action=accept connection-state=established,related comment="established"
|
||||
add chain=forward action=drop connection-state=invalid comment="invalid"
|
||||
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
||||
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
|
||||
add chain=forward action=accept src-address=2606:1c80:1300::/44 comment="v6 outbound from 982 customers"
|
||||
add chain=forward action=drop comment="default deny"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP to core (v6 RR)
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing filter rule
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1300::/44 || dst==2606:1c80:0:10::110/128 || (dst-len==64 && dst==2606:1c80:0:14::/64)) { accept; } else { reject; }"
|
||||
|
||||
/routing bgp connection
|
||||
add name=ibgp-rr-core instance=bgp-instance-1 templates=default \
|
||||
afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::110 \
|
||||
remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \
|
||||
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
output.redistribute=connected,static \
|
||||
comment="iBGP to core (v6 RR), v6 transport"
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 09:37:54 by RouterOS 7.21.4
|
||||
# 2026-05-09 11:21:08 by RouterOS 7.21.4
|
||||
# software id = FUVS-HCM5
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
@ -257,8 +257,7 @@ add disabled=no instance=default-v3 name=backbone-v3
|
|||
set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
|
||||
kdyyJrT0Mm
|
||||
/system logging action
|
||||
add name=logs remote=204.110.191.229 remote-port=1514 src-address=\
|
||||
10.254.254.110 target=remote
|
||||
add name=logs remote=204.110.191.229 src-address=10.254.254.110 target=remote
|
||||
/interface bridge port
|
||||
add bridge=982 ingress-filtering=no interface=ether1 internal-path-cost=10 \
|
||||
path-cost=10
|
||||
|
|
@ -425,6 +424,7 @@ set time-zone-name=America/Chicago
|
|||
set name=982
|
||||
/system logging
|
||||
add action=remote topics=info
|
||||
add action=logs topics=info
|
||||
/system ntp client
|
||||
set enabled=yes
|
||||
/system ntp client servers
|
||||
|
|
|
|||
|
|
@ -124,15 +124,23 @@ add chain=forward action=drop
|
|||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP to edge (v4 transport / v6 NLRI)
|
||||
# -----------------------------------------------------------------------------
|
||||
# Output filter: advertise climax's own routes — /44 customer aggregate,
|
||||
# loopback /128, and connected /64 P2Ps toward verona, core, culleoka, 494.
|
||||
# Core (v6 RR) reflects these to every other client.
|
||||
/routing filter rule
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1100::/44) { accept; } else { reject; }"
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1100::/44 || dst==2606:1c80:0:10::102/128 || (dst-len==64 && (dst==2606:1c80:0:12::/64 || dst==2606:1c80:0:17::/64 || dst==2606:1c80:0:20::/64 || dst==2606:1c80:0:21::/64))) { accept; } else { reject; }"
|
||||
|
||||
# Single iBGP session to CORE (which is the v6 route reflector for the fleet).
|
||||
# v6 transport (loopback-to-loopback). output.redistribute=connected,static
|
||||
# picks up the loopback /128 (connected) and the /44 blackhole aggregate
|
||||
# (static); the filter chain narrows the set.
|
||||
/routing bgp connection
|
||||
add name=ibgp-edge-v6 instance=bgp-instance-1 templates=default \
|
||||
afi=ip,ipv6 local.role=ibgp local.address=10.254.254.102 \
|
||||
remote.address=10.254.254.254 remote.as=393837 multihop=yes \
|
||||
add name=ibgp-rr-core instance=bgp-instance-1 templates=default \
|
||||
afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::102 \
|
||||
remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \
|
||||
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
comment="iBGP to edge, v4 transport / v6 NLRI"
|
||||
output.redistribute=connected,static \
|
||||
comment="iBGP to core (v6 RR), v6 transport"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# VERIFY (paste after apply)
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 09:37:53 by RouterOS 7.21.4
|
||||
# 2026-05-09 11:21:08 by RouterOS 7.21.4
|
||||
# software id = UETF-WF31
|
||||
#
|
||||
# model = CCR2004-16G-2S+
|
||||
|
|
@ -399,10 +399,12 @@ add disabled=no dst-address=10.254.254.101/32 gateway=10.250.1.25 \
|
|||
/ipv6 route
|
||||
add comment="default via core" distance=1 dst-address=::/0 gateway=\
|
||||
2606:1c80:0:12::1
|
||||
add comment="edge loopback via core" distance=1 dst-address=\
|
||||
2606:1c80:0:10::254/128 gateway=2606:1c80:0:12::1
|
||||
add blackhole comment="climax /44 aggregate (iBGP origin)" distance=200 \
|
||||
dst-address=2606:1c80:1100::/44
|
||||
add comment="core loopback via core P2P" dst-address=2606:1c80:0:10::253/128 \
|
||||
gateway=2606:1c80:0:12::1
|
||||
add comment="verona loopback (bootstrap, beats stale BGP)" distance=1 \
|
||||
dst-address=2606:1c80:0:10::101/128 gateway=2606:1c80:0:20::1
|
||||
/ip service
|
||||
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||
|
|
@ -426,10 +428,14 @@ add address=2606:1c80:0:21::1 advertise=no comment="P2P climax<->culleoka" \
|
|||
add address=2606:1c80:0:17::1 advertise=no comment="P2P climax<->494" \
|
||||
interface=ether5-494
|
||||
add address=2606:1c80:1100::1 comment="climax mgmt LAN" interface=mgmt
|
||||
add address=2606:1c80:1100:1::1 comment="climax customer LAN (PPPoE+DHCP)" \
|
||||
interface=climax-bridge
|
||||
/ipv6 dhcp-relay option
|
||||
set client_mac value="0x0001\$(CLIENT_MAC)"
|
||||
/ipv6 dhcp-server
|
||||
add interface=mgmt name=climax-mgmt-stateless
|
||||
add address-pool=climax-cust-pd-1 interface=climax-bridge name=\
|
||||
climax-cust-pd-server
|
||||
/ipv6 firewall filter
|
||||
add action=accept chain=input comment=established connection-state=\
|
||||
established,related
|
||||
|
|
@ -453,6 +459,7 @@ add action=drop chain=forward comment="default deny"
|
|||
/ipv6 nd
|
||||
set [ find default=yes ] advertise-dns=yes
|
||||
add advertise-dns=yes interface=mgmt other-configuration=yes
|
||||
add advertise-dns=yes interface=climax-bridge other-configuration=yes
|
||||
/mpls interface
|
||||
add interface=ether6-verona-11ghz mpls-mtu=1508
|
||||
add interface=ether4-380-airfiber24 mpls-mtu=1508
|
||||
|
|
@ -478,14 +485,17 @@ add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5 vrf=\
|
|||
main
|
||||
/routing bgp connection
|
||||
add afi=ip,ipv6 comment="iBGP to edge, v4 transport / v6 NLRI" instance=\
|
||||
bgp-instance-1 local.address=10.254.254.102 .role=ibgp multihop=yes name=\
|
||||
ibgp-edge-v6 nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
remote.address=10.254.254.254 .as=393837 templates=default
|
||||
bgp-instance-1 local.address=2606:1c80:0:10::102 .role=ibgp multihop=yes \
|
||||
name=ibgp-rr-core nexthop-choice=force-self output.filter-chain=\
|
||||
v6-ibgp-out .redistribute=connected,static remote.address=\
|
||||
2606:1c80:0:10::253 .as=393837 templates=default
|
||||
/routing filter rule
|
||||
add chain=ospf-in disabled=no rule=accept
|
||||
add chain=ospf-out disabled=no rule=accept
|
||||
add chain=v6-ibgp-out disabled=no rule=\
|
||||
"if (dst==2606:1c80:1100::/44) { accept; } else { reject; }"
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1100::/44 || dst==2\
|
||||
606:1c80:0:10::102/128 || (dst-len==64 && (dst==2606:1c80:0:12::/64 || dst\
|
||||
==2606:1c80:0:17::/64 || dst==2606:1c80:0:20::/64 || dst==2606:1c80:0:21::\
|
||||
/64))) { accept; } else { reject; }"
|
||||
/routing ospf interface-template
|
||||
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
||||
ether6-verona-11ghz priority=1 type=ptp use-bfd=no
|
||||
|
|
@ -504,6 +514,8 @@ set contact=graham@vntx.net enabled=yes location="33.187291, -96.448119"
|
|||
set time-zone-autodetect=no time-zone-name=CST6CDT
|
||||
/system identity
|
||||
set name=Climax
|
||||
/system logging
|
||||
add action=logs topics=info
|
||||
/system ntp client
|
||||
set enabled=yes
|
||||
/system ntp client servers
|
||||
|
|
|
|||
|
|
@ -138,17 +138,57 @@ add chain=forward action=accept in-interface-list=customer
|
|||
add chain=forward action=drop comment="default deny"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP to edge (v4 transport / v6 NLRI)
|
||||
# APPLY — iBGP route reflector (core is RR; edge + every tower are RR clients)
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing filter rule
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1400::/44) { accept; } else { reject; }"
|
||||
# Why core (not edge) is the RR: ROS 6.49 on edge does not properly reflect v6
|
||||
# NLRI even with all RR settings (cluster-id, route-reflect, multihop, correct
|
||||
# in/out filters). ROS7 on core does. So core takes the RR role and edge is
|
||||
# just another iBGP client — it learns tower /44s + /128 loopbacks reflected
|
||||
# from core, and supplies the v6 default that core reflects back to towers.
|
||||
#
|
||||
# cluster-id on the bgp-instance turns this router into a route reflector.
|
||||
# It must be set BEFORE adding the client connections.
|
||||
/routing bgp instance set [find name=bgp-instance-1] cluster-id=10.254.254.253
|
||||
|
||||
# Filter for RR-reflected traffic (in & out): allow ::/0, any /44 (customer
|
||||
# aggregates), any /64 (P2P backbone links + per-tower customer LANs), any
|
||||
# /128 (router loopbacks). Reject everything else (defense in depth — keeps
|
||||
# random connected /80 etc. from leaking).
|
||||
# NOTE on syntax: ROS 7.21 routing-filter language doesn't accept range
|
||||
# matchers like `dst-in <prefix>` or `dst > <addr>` — only `dst==<exact>`
|
||||
# and length comparisons. So we match by length-class, not by sub-range.
|
||||
# The /48 covering customer-vs-infra distinction is enforced by the
|
||||
# ORIGINATING router's own narrower filter (v6-ibgp-out below).
|
||||
/routing filter rule
|
||||
add chain=v6-rr-out disabled=no rule="if (dst==::/0 || dst-len==44 || dst-len==64 || dst-len==128) { accept; } else { reject; }"
|
||||
add chain=v6-rr-in disabled=no rule="if (dst==::/0 || dst-len==44 || dst-len==64 || dst-len==128) { accept; } else { reject; }"
|
||||
|
||||
# Filter for advertising CORE'S OWN connected/static routes outbound (this
|
||||
# filter runs on each connection's output.filter-chain — what core ORIGINATES
|
||||
# rather than what it REFLECTS). Narrow by exact prefix so only core's /44
|
||||
# customer aggregate, /128 loopback, and /64 P2P links toward each neighbour
|
||||
# escape into iBGP.
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1400::/44 || dst==2606:1c80:0:10::253/128 || (dst-len==64 && (dst==2606:1c80:0:11::/64 || dst==2606:1c80:0:12::/64 || dst==2606:1c80:0:13::/64 || dst==2606:1c80:0:14::/64 || dst==2606:1c80:0:15::/64 || dst==2606:1c80:0:1002::/64))) { accept; } else { reject; }"
|
||||
|
||||
# All client connections share these settings:
|
||||
# templates=default inherits keepalive/holdtime/timers
|
||||
# afi=ip,ipv6 carry both v4 and v6 NLRI (v4 unused on these but harmless)
|
||||
# local.role=ibgp same-AS = iBGP
|
||||
# multihop=yes loopback-to-loopback (more than one hop)
|
||||
# nexthop-choice=force-self pin next-hop to core's v6 loopback
|
||||
# cluster=yes marks the peer as an RR client
|
||||
# input.filter=v6-rr-in limit what we accept
|
||||
# output.filter-chain=v6-rr-out limit what we send (covers reflected + originated)
|
||||
# output.redistribute=connected,static pick up our own /44 + /128
|
||||
/routing bgp connection
|
||||
add name=ibgp-edge-v6 instance=bgp-instance-1 templates=default \
|
||||
afi=ip,ipv6 local.role=ibgp local.address=10.254.254.253 \
|
||||
remote.address=10.254.254.254 remote.as=393837 multihop=yes \
|
||||
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
comment="iBGP to edge, v4 transport / v6 NLRI"
|
||||
add name=ibgp-rr-edge instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::254 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: edge"
|
||||
add name=ibgp-rr-verona instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::101 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: verona"
|
||||
add name=ibgp-rr-climax instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::102 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: climax"
|
||||
add name=ibgp-rr-culleoka instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::104 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: culleoka"
|
||||
add name=ibgp-rr-newhope instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::108 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: newhope"
|
||||
add name=ibgp-rr-lowry instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::109 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: lowry"
|
||||
add name=ibgp-rr-982 instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::110 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: 982"
|
||||
add name=ibgp-rr-494 instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::111 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: 494"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# VERIFY (paste after apply)
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 09:37:54 by RouterOS 7.21.4
|
||||
# 2026-05-09 11:21:08 by RouterOS 7.21.4
|
||||
# software id = XS5B-41QR
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
@ -351,7 +351,8 @@ set ether6-culleoka-11ghz queue=FQ_Codel
|
|||
set ether7-380tower queue=FQ_Codel
|
||||
set sfp-sfpplus1-edge-preseem queue=FQ_Codel
|
||||
/routing bgp instance
|
||||
add as=393837 name=bgp-instance-1 router-id=10.254.254.253
|
||||
add as=393837 cluster-id=10.254.254.253 name=bgp-instance-1 router-id=\
|
||||
10.254.254.253
|
||||
/routing bgp template
|
||||
set default as=65530 disabled=no
|
||||
/routing id
|
||||
|
|
@ -367,8 +368,7 @@ add fib name=testnat
|
|||
set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
|
||||
kdyyJrT0Mm
|
||||
/system logging action
|
||||
add name=logs remote=204.110.191.229 remote-port=1514 src-address=\
|
||||
10.254.254.253 target=remote
|
||||
add name=logs remote=204.110.191.229 src-address=10.254.254.253 target=remote
|
||||
/ip smb
|
||||
set enabled=no
|
||||
/ip firewall connection tracking
|
||||
|
|
@ -484,6 +484,10 @@ add comment="edge loopback via direct" distance=2 dst-address=\
|
|||
2606:1c80:0:10::254/128 gateway=2606:1c80:0:11::1
|
||||
add blackhole comment="core /44 aggregate (iBGP origin)" distance=200 \
|
||||
dst-address=2606:1c80:1400::/44
|
||||
add comment="verona loopback via climax" dst-address=2606:1c80:0:10::101/128 \
|
||||
gateway=2606:1c80:0:12::2
|
||||
add comment="climax loopback via climax P2P" dst-address=\
|
||||
2606:1c80:0:10::102/128 gateway=2606:1c80:0:12::2
|
||||
/ip service
|
||||
set ftp disabled=yes
|
||||
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||
|
|
@ -511,8 +515,11 @@ add address=2606:1c80:0:14::1 advertise=no comment="P2P core<->982 60GHz" \
|
|||
add address=2606:1c80:0:15::1 advertise=no comment="P2P core<->culleoka" \
|
||||
interface=ether6-culleoka-11ghz
|
||||
add address=2606:1c80:1400::1 comment="380 mgmt LAN" interface=vlan10_combo1
|
||||
add address=2606:1c80:1400:1::1 comment="380 customer LAN (PPPoE+DHCP)" \
|
||||
interface=combo1-380
|
||||
/ipv6 dhcp-server
|
||||
add interface=vlan10_combo1 name=core-mgmt-stateless
|
||||
add address-pool=core-cust-pd-1 interface=combo1-380 name=core-cust-pd-server
|
||||
/ipv6 firewall filter
|
||||
add action=accept chain=input comment=established connection-state=\
|
||||
established,related
|
||||
|
|
@ -535,6 +542,7 @@ add action=drop chain=forward comment="default deny"
|
|||
/ipv6 nd
|
||||
set [ find default=yes ] advertise-dns=yes
|
||||
add advertise-dns=yes interface=vlan10_combo1 other-configuration=yes
|
||||
add advertise-dns=yes interface=combo1-380 other-configuration=yes
|
||||
/mpls interface
|
||||
add interface=ether5-climax mpls-mtu=1508
|
||||
add interface=ether6-culleoka-11ghz mpls-mtu=1508
|
||||
|
|
@ -560,15 +568,59 @@ add accounting-backup=yes address=45.76.56.5 require-message-auth=no service=\
|
|||
/routing bfd configuration
|
||||
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
|
||||
/routing bgp connection
|
||||
add afi=ip,ipv6 comment="iBGP to edge, v4 transport / v6 NLRI" instance=\
|
||||
bgp-instance-1 local.address=10.254.254.253 .role=ibgp multihop=yes name=\
|
||||
ibgp-edge-v6 nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
remote.address=10.254.254.254 .as=393837 templates=default
|
||||
add afi=ip,ipv6 as=393837 comment="iBGP to edge, v4 transport / v6 NLRI" \
|
||||
input.filter=v6-rr-in instance=bgp-instance-1 local.address=\
|
||||
2606:1c80:0:10::253 .role=ibgp-rr multihop=yes name=ibgp-rr-edge \
|
||||
nexthop-choice=default output.filter-chain=v6-rr-out .redistribute=\
|
||||
connected,static remote.address=2606:1c80:0:10::254 .as=393837 templates=\
|
||||
default
|
||||
add afi=ip,ipv6 as=393837 comment="RR client: climax" input.filter=v6-rr-in \
|
||||
instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \
|
||||
multihop=yes name=ibgp-rr-climax nexthop-choice=default \
|
||||
output.filter-chain=v6-rr-out .redistribute=connected,static \
|
||||
remote.address=2606:1c80:0:10::102 .as=393837 templates=default
|
||||
add afi=ip,ipv6 as=393837 comment="RR client: culleoka" input.filter=v6-rr-in \
|
||||
instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \
|
||||
multihop=yes name=ibgp-rr-culleoka nexthop-choice=default \
|
||||
output.filter-chain=v6-rr-out .redistribute=connected,static \
|
||||
remote.address=2606:1c80:0:10::104 .as=393837 templates=default
|
||||
add afi=ip,ipv6 as=393837 comment="RR client: newhope" input.filter=v6-rr-in \
|
||||
instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \
|
||||
multihop=yes name=ibgp-rr-newhope nexthop-choice=default \
|
||||
output.filter-chain=v6-rr-out .redistribute=connected,static \
|
||||
remote.address=2606:1c80:0:10::108 .as=393837 templates=default
|
||||
add afi=ip,ipv6 as=393837 comment="RR client: lowry" input.filter=v6-rr-in \
|
||||
instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \
|
||||
multihop=yes name=ibgp-rr-lowry nexthop-choice=default \
|
||||
output.filter-chain=v6-rr-out .redistribute=connected,static \
|
||||
remote.address=2606:1c80:0:10::109 .as=393837 templates=default
|
||||
add afi=ip,ipv6 as=393837 comment="RR client: 982" input.filter=v6-rr-in \
|
||||
instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \
|
||||
multihop=yes name=ibgp-rr-982 nexthop-choice=default output.filter-chain=\
|
||||
v6-rr-out .redistribute=connected,static remote.address=\
|
||||
2606:1c80:0:10::110 .as=393837 templates=default
|
||||
add afi=ip,ipv6 as=393837 comment="RR client: 494" input.filter=v6-rr-in \
|
||||
instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \
|
||||
multihop=yes name=ibgp-rr-494 nexthop-choice=default output.filter-chain=\
|
||||
v6-rr-out .redistribute=connected,static remote.address=\
|
||||
2606:1c80:0:10::111 .as=393837 templates=default
|
||||
add afi=ip,ipv6 as=393837 comment="RR client: verona" input.filter=v6-rr-in \
|
||||
instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \
|
||||
multihop=yes name=ibgp-rr-verona nexthop-choice=default \
|
||||
output.filter-chain=v6-rr-out .redistribute=connected,static \
|
||||
remote.address=2606:1c80:0:10::101 .as=393837 templates=default
|
||||
/routing filter rule
|
||||
add chain=ospf-in disabled=no rule="accept;"
|
||||
add chain=ospf-out disabled=no rule="accept;"
|
||||
add chain=v6-ibgp-out disabled=no rule=\
|
||||
"if (dst==2606:1c80:1400::/44) { accept; } else { reject; }"
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1400::/44 || dst==2\
|
||||
606:1c80:0:10::253/128 || (dst-len==64 && (dst==2606:1c80:0:11::/64 || dst\
|
||||
==2606:1c80:0:12::/64 || dst==2606:1c80:0:13::/64 || dst==2606:1c80:0:14::\
|
||||
/64 || dst==2606:1c80:0:15::/64 || dst==2606:1c80:0:1002::/64))) { accept;\
|
||||
\_} else { reject; }"
|
||||
add chain=v6-rr-out disabled=no rule="if (dst==::/0 || dst-len==44 || dst-len=\
|
||||
=64 || dst-len==128) { accept; } else { reject; }"
|
||||
add chain=v6-rr-in disabled=no rule="if (dst==::/0 || dst-len==44 || dst-len==\
|
||||
64 || dst-len==128) { accept; } else { reject; }"
|
||||
/routing ospf interface-template
|
||||
add area=backbone-v2 auth-id=1 cost=10 disabled=no interfaces=\
|
||||
sfp-sfpplus1-edge-preseem priority=1 type=ptp use-bfd=yes
|
||||
|
|
|
|||
147
mikrotik-tool/culleoka-v6-apply.rsc
Normal file
147
mikrotik-tool/culleoka-v6-apply.rsc
Normal file
|
|
@ -0,0 +1,147 @@
|
|||
# =============================================================================
|
||||
# culleoka — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
|
||||
# =============================================================================
|
||||
#
|
||||
# Culleoka has two upstream paths:
|
||||
# * core (primary) — ether6-380-11ghz, v6 P2P 2606:1c80:0:15::/64
|
||||
# * climax (backup) — ether1-climax-11ghz, v6 P2P 2606:1c80:0:21::/64
|
||||
# The climax-↔-culleoka 11 GHz radio link is currently DOWN at the radio
|
||||
# (power injector unplugged); the v6 P2P is configured but inactive until
|
||||
# the radio comes back up. v4 transit currently goes via core.
|
||||
#
|
||||
# Loopback: 2606:1c80:0:10::104/128
|
||||
# /44 customer aggregate: 2606:1c80:1600::/44
|
||||
# Mgmt LAN: 2606:1c80:1600::1/64 — assumes a `mgmt` bridge similar to
|
||||
# climax. If culleoka uses a different name (e.g. `bridge1`, `lan`),
|
||||
# substitute on apply. PPPoE profile assumed `pppoe` — verify with
|
||||
# /ppp profile print before applying.
|
||||
#
|
||||
# Customer interface-list assumed `customer` (same as climax).
|
||||
# =============================================================================
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# WIPE — drop OSPFv3 + stale internal v6
|
||||
# -----------------------------------------------------------------------------
|
||||
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
|
||||
/ipv6 dhcp-server remove [find]
|
||||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find !default]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find !dynamic]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find !dynamic]
|
||||
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — BGP instance
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing bgp instance
|
||||
add name=bgp-instance-1 as=393837 router-id=10.254.254.104
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — addresses
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:10::104/128 interface=lo advertise=no comment="loopback"
|
||||
add address=2606:1c80:0:15::2/64 interface=ether6-380-11ghz advertise=no comment="P2P culleoka<->core"
|
||||
add address=2606:1c80:0:21::2/64 interface=ether1-climax-11ghz advertise=no comment="P2P culleoka<->climax (radio DOWN)"
|
||||
add address=2606:1c80:1600::1/64 interface=mgmt advertise=yes comment="culleoka mgmt LAN"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — static routes
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 route
|
||||
# Default upstream toward core (climax path stays as a higher-distance backup
|
||||
# that becomes active automatically when the climax 11 GHz radio is brought
|
||||
# back up — same shape as v4 OSPF cost relationship in CLAUDE.md).
|
||||
add dst-address=::/0 gateway=2606:1c80:0:15::1 distance=1 comment="default via core (primary)"
|
||||
add dst-address=::/0 gateway=2606:1c80:0:21::1 distance=100 comment="default via climax (backup, radio down)"
|
||||
|
||||
# Bootstrap: reach core's v6 loopback before iBGP comes up. Distance=1 wins
|
||||
# over the BGP-learned /128 (distance=200) once the session is up; both
|
||||
# routes have the same forwarding outcome.
|
||||
add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:15::1 distance=1 comment="core loopback (iBGP bootstrap)"
|
||||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:15::1 distance=1 comment="edge loopback via core"
|
||||
|
||||
# Blackhole the /44 so output.redistribute=static picks it up for iBGP.
|
||||
add dst-address=2606:1c80:1600::/44 blackhole distance=200 comment="culleoka /44 aggregate (iBGP origin)"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — neighbour discovery on the mgmt LAN (SLAAC + RDNSS)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 nd
|
||||
add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
/ipv6 nd prefix
|
||||
add interface=mgmt prefix=2606:1c80:1600::/64 autonomous=yes on-link=yes
|
||||
|
||||
/ipv6 dhcp-server
|
||||
add interface=mgmt name=culleoka-mgmt-stateless address-pool=static-only
|
||||
|
||||
/ipv6 dhcp-server option
|
||||
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — customer PD pool + bind to PPPoE profile
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 pool
|
||||
add name=culleoka-cust-pd-1 prefix=2606:1c80:1601::/48 prefix-length=56
|
||||
|
||||
/ppp profile
|
||||
set [find name=pppoe] remote-ipv6-prefix-pool=culleoka-cust-pd-1 dhcpv6-pd-pool=culleoka-cust-pd-1
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 firewall filter
|
||||
add chain=input action=accept connection-state=established,related comment="established"
|
||||
add chain=input action=drop connection-state=invalid comment="invalid"
|
||||
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
||||
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
|
||||
add chain=input action=drop comment="default deny"
|
||||
|
||||
add chain=forward action=accept connection-state=established,related comment="established"
|
||||
add chain=forward action=drop connection-state=invalid comment="invalid"
|
||||
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
||||
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
|
||||
add chain=forward action=accept src-address=2606:1c80:1600::/44 comment="v6 outbound from culleoka customers"
|
||||
add chain=forward action=drop comment="default deny"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP to core (v6 RR)
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing filter rule
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1600::/44 || dst==2606:1c80:0:10::104/128 || (dst-len==64 && (dst==2606:1c80:0:15::/64 || dst==2606:1c80:0:21::/64))) { accept; } else { reject; }"
|
||||
|
||||
/routing bgp connection
|
||||
add name=ibgp-rr-core instance=bgp-instance-1 templates=default \
|
||||
afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::104 \
|
||||
remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \
|
||||
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
output.redistribute=connected,static \
|
||||
comment="iBGP to core (v6 RR), v6 transport"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# VERIFY (paste after apply)
|
||||
# -----------------------------------------------------------------------------
|
||||
# /ipv6 address print
|
||||
# /ipv6 route print where active
|
||||
# /routing bgp session print ;; ibgp-rr-core should be Established
|
||||
#
|
||||
# After session is up:
|
||||
# /ping 2606:1c80:0:10::253 count=3 ;; core loopback
|
||||
# /ping 2606:1c80:0:10::254 count=3 ;; edge loopback (via core)
|
||||
# /ping 2606:4700:4700::1111 count=3 ;; cloudflare (needs working TWC v6)
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 09:37:54 by RouterOS 7.21.4
|
||||
# 2026-05-09 11:21:08 by RouterOS 7.21.4
|
||||
# software id = HVP9-3G0K
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
|
|||
|
|
@ -111,38 +111,40 @@ add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80
|
|||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP route filters (v6)
|
||||
# -----------------------------------------------------------------------------
|
||||
# in-filter: accept any /44 inside the tower allocation block 2606:1c80:1000::/36.
|
||||
# Anything else from a tower iBGP peer is rejected (defense in depth — we
|
||||
# don't want a tower advertising the world to us).
|
||||
# Edge has ONE iBGP v6 peer: core, which is the v6 RR for the fleet. Edge is
|
||||
# an RR client of core (no `route-reflect=yes` — that flag would mark the
|
||||
# OTHER side as a client, but edge has no clients). Edge sends ::/0 to core
|
||||
# (which reflects it to towers) and learns tower /44s + /128 loopbacks from
|
||||
# core (reflected from each tower).
|
||||
#
|
||||
# in-filter: accept any infra/customer prefix that core (v6 RR) reflects to
|
||||
# us. Length 44 = customer aggregates, 64 = backbone P2Ps + per-tower LAN /64s,
|
||||
# 128 = router loopbacks. Anything else within 2606:1c80::/32 is rejected
|
||||
# (defense in depth — keeps random connected /80 etc. from leaking).
|
||||
/routing filter
|
||||
add chain=ibgp-tower-in-v6 prefix=2606:1c80:1000::/36 prefix-length=44 action=accept comment="tower /44 customer aggregate"
|
||||
add chain=ibgp-tower-in-v6 prefix=2606:1c80:0:10::/64 prefix-length=128 action=accept comment="tower v6 loopback"
|
||||
add chain=ibgp-tower-in-v6 action=discard comment="default deny"
|
||||
add chain=ibgp-rr-in prefix=2606:1c80::/32 prefix-length=44-128 action=accept comment="any reflected infra/customer prefix"
|
||||
add chain=ibgp-rr-in action=discard comment="default deny"
|
||||
|
||||
# out-filter: edge sends ONLY the v6 default to towers. Towers don't need
|
||||
# anything else from edge — they reach customers via their own routes and
|
||||
# transit upstream via the default.
|
||||
add chain=ibgp-tower-out-v6 prefix=::/0 prefix-length=0 action=accept comment="default route to tower"
|
||||
add chain=ibgp-tower-out-v6 action=discard comment="default deny"
|
||||
# out-filter: edge sends only the v6 default to core (which the RR fans
|
||||
# out to every tower). Anything else stays inside edge.
|
||||
add chain=ibgp-rr-out prefix=::/0 prefix-length=0 action=accept comment="default route"
|
||||
add chain=ibgp-rr-out action=discard comment="default deny"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP peer to verona (over v4 transport, carrying v6 NLRI)
|
||||
# APPLY — iBGP peer to core (v6 transport, carrying v6 NLRI)
|
||||
# -----------------------------------------------------------------------------
|
||||
# ROS6 syntax: address-families=ipv6 with a v4 remote-address gives
|
||||
# MP-BGP v6-NLRI-over-v4-TCP. update-source=loopback ensures the TCP
|
||||
# session sources from the v4 loopback (10.254.254.254).
|
||||
# nexthop-choice=force-self pins the v6 next-hop edge advertises to
|
||||
# its own v6 loopback (2606:1c80:0:10::254), reachable from verona once
|
||||
# climax has its v6 apply.
|
||||
# v6 transport (loopback-to-loopback over 2606:1c80:0:10::254 ↔ ::253) avoids
|
||||
# the v4-mapped-next-hop bug we hit with v4 transport carrying v6 NLRI. Core
|
||||
# (ROS7) is the route reflector — edge is an RR client and, importantly, NOT
|
||||
# a reflector itself (ROS 6.49 does not properly reflect v6 NLRI even with
|
||||
# all RR settings; that's the entire reason core has the role).
|
||||
# update-source=loopback sources the TCP session from edge's loopback iface
|
||||
# (which holds both 10.254.254.254 and 2606:1c80:0:10::254).
|
||||
# nexthop-choice=force-self pins the next-hop edge advertises (::/0) to
|
||||
# edge's own v6 loopback so towers can resolve it via the RR-reflected
|
||||
# /128 path.
|
||||
/routing bgp peer
|
||||
add name=ibgp-verona-v6 \
|
||||
remote-address=10.254.254.101 remote-as=393837 \
|
||||
update-source=loopback \
|
||||
address-families=ipv6 \
|
||||
nexthop-choice=force-self \
|
||||
in-filter=ibgp-tower-in-v6 out-filter=ibgp-tower-out-v6 \
|
||||
default-originate=always \
|
||||
comment="iBGP to verona, v4 transport / v6 NLRI"
|
||||
add name=ibgp-rr-core remote-address=2606:1c80:0:10::253 remote-as=393837 update-source=loopback address-families=ipv6 nexthop-choice=force-self ttl=255 in-filter=ibgp-rr-in out-filter=ibgp-rr-out default-originate=always comment="iBGP to core (v6 RR), v6 transport"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# VERIFY (paste after apply)
|
||||
|
|
|
|||
720
mikrotik-tool/edge-working.rsc
Normal file
720
mikrotik-tool/edge-working.rsc
Normal file
|
|
@ -0,0 +1,720 @@
|
|||
# may/09/2026 09:37:53 by RouterOS 6.49.18
|
||||
# software id = 8XZE-R7EJ
|
||||
#
|
||||
# model = CCR2004-1G-12S+2XS
|
||||
# serial number = C8A70C55A930
|
||||
/interface bridge
|
||||
add name=cgnat
|
||||
add fast-forward=no name=loopback
|
||||
/interface ethernet
|
||||
set [ find default-name=ether1 ] rx-flow-control=auto tx-flow-control=auto
|
||||
set [ find default-name=sfp-sfpplus7 ] auto-negotiation=no name=\
|
||||
sfp-sfpplus7-core-direct
|
||||
set [ find default-name=sfp-sfpplus8 ] name=sfp-sfpplus8-server-switch \
|
||||
rx-flow-control=auto tx-flow-control=auto
|
||||
set [ find default-name=sfp-sfpplus10 ] rx-flow-control=auto tx-flow-control=\
|
||||
auto
|
||||
set [ find default-name=sfp-sfpplus11 ] name=sfp-sfpplus11-preseem \
|
||||
rx-flow-control=auto tx-flow-control=auto
|
||||
set [ find default-name=sfp-sfpplus12 ] l2mtu=1500 name=\
|
||||
sfp-sfpplus12-spectrum rx-flow-control=auto tx-flow-control=auto
|
||||
/interface vlan
|
||||
add interface=sfp-sfpplus8-server-switch name=vlan9_sfpplus8 vlan-id=9
|
||||
/interface wireless security-profiles
|
||||
set [ find default=yes ] supplicant-identity=MikroTik
|
||||
/ip dhcp-server
|
||||
add disabled=no interface=vlan9_sfpplus8 name=servers-public
|
||||
/ip pool
|
||||
add name=380building ranges=10.0.0.150-10.0.0.239
|
||||
add name=servers-public ranges=204.110.191.193-204.110.191.217
|
||||
/ip dhcp-server
|
||||
add address-pool=380building disabled=no interface=sfp-sfpplus8-server-switch \
|
||||
name=380-building
|
||||
/ppp profile
|
||||
add name=RWB_sstp_profile
|
||||
/queue simple
|
||||
add burst-limit=1M/1M burst-threshold=1M/1M burst-time=1s/1s disabled=yes \
|
||||
limit-at=1M/1M max-limit=1M/1M name=Delinquent packet-marks=Delenquent \
|
||||
priority=2/2 target=""
|
||||
add burst-limit=1/1 burst-threshold=1/1 burst-time=1s/1s disabled=yes \
|
||||
limit-at=1/1 max-limit=1/1 name=Inactive packet-marks=Inactive priority=\
|
||||
2/2 target=""
|
||||
/routing bgp instance
|
||||
set default as=393837 out-filter=twc-out router-id=204.110.191.190
|
||||
/routing ospf instance
|
||||
set [ find default=yes ] distribute-default=always-as-type-1 router-id=\
|
||||
10.254.254.254
|
||||
/routing ospf-v3 instance
|
||||
set [ find default=yes ] distribute-default=always-as-type-1 \
|
||||
redistribute-connected=as-type-1 router-id=10.254.254.254
|
||||
/snmp community
|
||||
set [ find default=yes ] name=onehuargd4a8974y79a497yi
|
||||
add addresses=204.110.188.0/22,10.0.0.0/8 name=kdyyJrT0Mm
|
||||
/system logging action
|
||||
add name=logs remote=204.110.191.229 remote-port=1514 src-address=\
|
||||
10.254.254.254 target=remote
|
||||
/user group
|
||||
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\
|
||||
sword,web,sniff,sensitive,api,romon,dude,tikapp"
|
||||
/ip firewall connection tracking
|
||||
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
|
||||
tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
|
||||
tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
|
||||
tcp-time-wait-timeout=2m udp-stream-timeout=2m udp-timeout=30s
|
||||
/ip neighbor discovery-settings
|
||||
set discover-interface-list=!dynamic
|
||||
/ip settings
|
||||
set rp-filter=strict tcp-syncookies=yes
|
||||
/ipv6 settings
|
||||
set accept-router-advertisements=no
|
||||
/ip address
|
||||
add address=71.41.226.118/30 interface=sfp-sfpplus12-spectrum network=\
|
||||
71.41.226.116
|
||||
add address=204.110.191.186/30 interface=sfp-sfpplus11-preseem network=\
|
||||
204.110.191.184
|
||||
add address=204.110.191.254/26 interface=vlan9_sfpplus8 network=\
|
||||
204.110.191.192
|
||||
add address=10.254.254.254 interface=loopback network=10.254.254.254
|
||||
add address=204.110.191.182/30 interface=sfp-sfpplus7-core-direct network=\
|
||||
204.110.191.180
|
||||
add address=10.0.0.254/24 interface=sfp-sfpplus8-server-switch network=\
|
||||
10.0.0.0
|
||||
add address=204.110.190.129/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.130/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.131/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.132/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.133/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.134/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.135/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.136/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.137/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.138/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.139/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.140/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.141/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.142/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.143/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.144/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.145/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.146/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.147/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.148/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.149/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.150/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.151/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.152/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.153/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.154/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.155/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.156/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.157/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.158/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.159/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.160/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.161/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.162/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.163/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.164/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.165/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.166/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.167/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.168/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.169/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.170/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.171/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.172/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.173/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.174/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.175/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.176/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.177/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.178/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.179/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.180/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.181/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.182/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.183/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.184/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.185/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.186/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.187/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.188/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.189/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.190/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.191/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.192/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.193/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.194/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.195/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.196/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.197/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.198/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.199/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.200/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.201/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.202/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.203/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.204/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.205/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.206/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.207/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.208/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.209/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.210/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.211/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.212/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.213/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.214/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.215/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.216/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.217/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.218/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.219/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.220/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.221/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.222/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.223/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.224/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.225/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.226/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.227/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.228/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.229/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.230/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.231/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.232/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.233/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.234/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.235/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.236/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.237/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.238/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.239/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.240/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.241/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.242/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.243/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.244/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.245/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.246/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.247/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.248/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.249/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.250/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.251/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.252/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.253/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.254/25 interface=cgnat network=204.110.190.128
|
||||
/ip dhcp-server lease
|
||||
add address=10.0.0.249 client-id=1:0:21:9b:91:5c:b6 mac-address=\
|
||||
00:21:9B:91:5C:B6 server=380-building
|
||||
add address=204.110.191.205 mac-address=BC:24:11:8B:C0:9C
|
||||
add address=10.0.0.250 client-id=1:48:a9:8a:38:3b:2d mac-address=\
|
||||
48:A9:8A:38:3B:2D server=380-building
|
||||
add address=10.0.0.253 client-id=\
|
||||
ff:ca:53:9:5a:0:2:0:0:ab:11:2c:53:dd:b2:c1:50:9a:35 comment=truenas \
|
||||
mac-address=BC:24:11:29:2B:5A server=380-building
|
||||
add address=10.0.0.252 client-id=1:bc:24:11:f5:81:d6 mac-address=\
|
||||
BC:24:11:F5:81:D6 server=380-building
|
||||
add address=10.0.0.251 client-id=1:bc:24:11:6b:73:53 mac-address=\
|
||||
BC:24:11:6B:73:53 server=380-building
|
||||
/ip dhcp-server network
|
||||
add address=10.0.0.0/24 dns-server=9.9.9.9,1.1.1.1 domain=vntx.net gateway=\
|
||||
10.0.0.254 ntp-server=23.150.41.122
|
||||
add address=204.110.191.192/26 dns-server=\
|
||||
204.110.191.240,204.110.191.250,1.1.1.1 gateway=204.110.191.254
|
||||
/ip dns
|
||||
set servers=204.110.191.240,204.110.191.250
|
||||
/ip firewall address-list
|
||||
add address=204.110.188.0/22 list=trusted
|
||||
add address=100.64.0.0/10 list=trusted
|
||||
add address=10.0.0.0/8 list=trusted
|
||||
add address=35.197.73.77 list=preseem
|
||||
add address=35.199.29.237 list=preseem
|
||||
add address=98.97.82.0/24 comment=starlink list=trusted
|
||||
add address=129.222.72.0/24 comment=starlink list=trusted
|
||||
add address=129.222.73.0/24 comment=starlink list=trusted
|
||||
add address=129.222.74.0/24 comment=starlink list=trusted
|
||||
add address=129.222.75.0/24 comment=starlink list=trusted
|
||||
add address=129.222.76.0/24 comment=starlink list=trusted
|
||||
add address=129.222.77.0/24 comment=starlink list=trusted
|
||||
add address=129.222.78.0/24 comment=starlink list=trusted
|
||||
add address=129.222.79.0/24 comment=starlink list=trusted
|
||||
add address=98.97.80.0/24 comment=starlink list=trusted
|
||||
add address=98.97.81.0/24 comment=starlink list=trusted
|
||||
add address=98.97.83.0/24 comment=starlink list=trusted
|
||||
add address=98.97.84.0/24 comment=starlink list=trusted
|
||||
add address=98.97.85.0/24 comment=starlink list=trusted
|
||||
add address=98.97.86.0/24 comment=starlink list=trusted
|
||||
add address=98.97.87.0/24 comment=starlink list=trusted
|
||||
add address=98.97.88.0/24 comment=starlink list=trusted
|
||||
add address=98.97.89.0/24 comment=starlink list=trusted
|
||||
add address=98.97.90.0/24 comment=starlink list=trusted
|
||||
add address=98.97.91.0/24 comment=starlink list=trusted
|
||||
add address=98.97.92.0/24 comment=starlink list=trusted
|
||||
add address=98.97.93.0/24 comment=starlink list=trusted
|
||||
add address=98.97.94.0/24 comment=starlink list=trusted
|
||||
add address=98.97.95.0/24 comment=starlink list=trusted
|
||||
add address=52.158.209.86 list=trusted
|
||||
add address=3.210.85.72 list=gaiia
|
||||
add address=3.81.237.51 list=gaiia
|
||||
add address=3.215.70.188 list=gaiia
|
||||
add address=3.228.90.246 list=gaiia
|
||||
add address=47.147.43.145 list=trusted
|
||||
add address=71.41.226.117 comment=TWC list=BGP-NEIGHBORS
|
||||
add address=204.110.191.185 comment=Preseem list=BGP-NEIGHBORS
|
||||
add address=204.110.191.252 comment="Virtual RouterOS" list=BGP-NEIGHBORS
|
||||
add address=204.110.188.0/22 list=bgp-networks
|
||||
add address=151.243.11.0/24 list=abusive
|
||||
add address=172.245.56.83 list=trusted
|
||||
/ip firewall filter
|
||||
add action=accept chain=input comment="BGP Input" dst-port=179 protocol=tcp
|
||||
add action=accept chain=output comment="BGP Output" protocol=tcp src-port=179
|
||||
add action=accept chain=forward comment="BGP Forward" dst-port=179 protocol=\
|
||||
tcp
|
||||
add action=accept chain=forward comment="BGP Forward Reply" protocol=tcp \
|
||||
src-port=179
|
||||
add action=accept chain=input comment="OSPF Input" protocol=ospf
|
||||
add action=accept chain=output comment="OSPF Output" protocol=ospf
|
||||
add action=accept chain=forward comment="OSPF Forward" protocol=ospf
|
||||
add action=accept chain=input comment="Established Input" connection-state=\
|
||||
established,related
|
||||
add action=accept chain=forward comment="Established Forward" \
|
||||
connection-state=established,related
|
||||
add action=accept chain=input comment="Allow Remote Winbox" disabled=yes \
|
||||
in-interface=*18
|
||||
add action=fasttrack-connection chain=forward comment=\
|
||||
"fasttrack established/related" connection-state=established,related
|
||||
add action=accept chain=forward comment="accept established/related" \
|
||||
connection-state=established,related
|
||||
add action=drop chain=forward dst-address=91.190.98.0/24 log=yes
|
||||
add action=accept chain=forward dst-port=23 protocol=tcp src-address=\
|
||||
204.110.190.208
|
||||
add action=accept chain=forward dst-address=204.110.191.219
|
||||
add action=accept chain=forward dst-address=204.110.191.222
|
||||
add action=accept chain=forward dst-address=204.110.191.252
|
||||
add action=accept chain=forward dst-address=204.110.191.8
|
||||
add action=accept chain=forward dst-address=204.110.191.192/26 src-address=\
|
||||
52.158.209.86
|
||||
add action=accept chain=forward dst-address=204.110.191.210
|
||||
add action=accept chain=forward disabled=yes dst-address=204.110.191.248 \
|
||||
dst-port=3306 log=yes protocol=tcp
|
||||
add action=accept chain=forward dst-address=204.110.191.248 dst-port=3306 \
|
||||
protocol=tcp src-address-list=gaiia
|
||||
add action=accept chain=forward disabled=yes dst-address=204.110.191.248
|
||||
add action=accept chain=forward dst-address=204.110.191.231
|
||||
add action=accept chain=forward dst-address=204.110.191.232 in-interface=\
|
||||
sfp-sfpplus12-spectrum
|
||||
add action=tarpit chain=input protocol=tcp src-address-list=abusive
|
||||
add action=drop chain=forward src-address-list=abusive
|
||||
add action=accept chain=forward connection-state=established,related \
|
||||
disabled=yes
|
||||
add action=accept chain=input connection-state=established,related,untracked \
|
||||
disabled=yes
|
||||
add action=drop chain=forward disabled=yes dst-port=3389 in-interface=\
|
||||
sfp-sfpplus12-spectrum protocol=tcp
|
||||
add action=drop chain=forward disabled=yes dst-port=3389 in-interface=\
|
||||
sfp-sfpplus12-spectrum protocol=udp
|
||||
add action=drop chain=forward comment="Drop anyone in Black List (SSH)." \
|
||||
in-interface=sfp-sfpplus12-spectrum log-prefix="BL_Black List (SSH)" \
|
||||
src-address-list="Black List (SSH)"
|
||||
add action=drop chain=forward comment="block incoming ftp" disabled=yes \
|
||||
dst-port=21 in-interface=sfp-sfpplus12-spectrum protocol=tcp
|
||||
add action=drop chain=forward comment="block incoming telnet" dst-port=23 \
|
||||
in-interface=sfp-sfpplus12-spectrum protocol=tcp
|
||||
add action=drop chain=input comment="Drop all packets from public internet whi\
|
||||
ch should not exist in public network" in-interface=\
|
||||
sfp-sfpplus12-spectrum src-address-list=NotPublic
|
||||
add action=drop chain=input disabled=yes dst-port=3784 in-interface=\
|
||||
sfp-sfpplus12-spectrum log=yes protocol=udp
|
||||
add action=drop chain=forward comment=bfd dst-port=3784 in-interface=\
|
||||
sfp-sfpplus12-spectrum protocol=udp
|
||||
add action=drop chain=input comment=bfd dst-port=3784 in-interface=\
|
||||
sfp-sfpplus12-spectrum protocol=udp
|
||||
add action=drop chain=input comment="Drop Invalid connections" \
|
||||
connection-state=invalid
|
||||
add action=add-src-to-address-list address-list=winbox_blacklist \
|
||||
address-list-timeout=4w3d chain=input connection-state=new disabled=yes \
|
||||
dst-port=8291 log=yes protocol=tcp src-address-list=winbox_stage3
|
||||
add action=add-src-to-address-list address-list=winbox_stage3 \
|
||||
address-list-timeout=1m chain=input connection-state=new disabled=yes \
|
||||
dst-port=8291 protocol=tcp src-address-list=winbox_stage2
|
||||
add action=add-src-to-address-list address-list=winbox_stage2 \
|
||||
address-list-timeout=1m chain=input connection-state=new disabled=yes \
|
||||
dst-port=8291 protocol=tcp src-address-list=winbox_stage1
|
||||
add action=add-src-to-address-list address-list=winbox_stage1 \
|
||||
address-list-timeout=1m chain=input connection-state=new disabled=yes \
|
||||
dst-port=8291 protocol=tcp src-address-list=!vntx
|
||||
add action=drop chain=forward comment="drop winbox brute downstream" \
|
||||
disabled=yes dst-port=8291 protocol=tcp src-address-list=winbox_blacklist
|
||||
add action=accept chain=input comment="BGP Neighbors" dst-port=179 protocol=\
|
||||
tcp src-address-list=BGP-NEIGHBORS
|
||||
add action=drop chain=input comment="Drop anyone in Black List (SSH)." \
|
||||
disabled=yes in-interface=sfp-sfpplus12-spectrum log-prefix=\
|
||||
"BL_Black List (SSH)" src-address-list="Black List (SSH)"
|
||||
add action=jump chain=input comment="Jump to Black List (SSH) chain." \
|
||||
dst-port=22 in-interface=sfp-sfpplus12-spectrum jump-target=\
|
||||
"Black List (SSH) Chain" protocol=tcp
|
||||
add action=drop chain=input comment=. dst-port=23 in-interface=\
|
||||
sfp-sfpplus12-spectrum protocol=tcp
|
||||
add action=drop chain=forward comment=. dst-port=23 in-interface=\
|
||||
sfp-sfpplus12-spectrum protocol=tcp
|
||||
add action=jump chain=forward comment="Jump to Black List (SSH) chain." \
|
||||
dst-port=22 in-interface=sfp-sfpplus12-spectrum jump-target=\
|
||||
"Black List (SSH) Chain" protocol=tcp
|
||||
add action=add-src-to-address-list address-list="Black List (SSH)" \
|
||||
address-list-timeout=4w2d chain="Black List (SSH) Chain" comment="Transfer\
|
||||
\_repeated attempts from Black List (SSH) Stage 3 to Black List (SSH)." \
|
||||
connection-state=new in-interface=sfp-sfpplus12-spectrum log-prefix=\
|
||||
"Add_Black List (SSH)" src-address-list="Black List (SSH) Stage 3"
|
||||
add action=add-src-to-address-list address-list="Black List (SSH) Stage 3" \
|
||||
address-list-timeout=1m chain="Black List (SSH) Chain" comment=\
|
||||
"Add successive attempts to Black List (SSH) Stage 3." connection-state=\
|
||||
new in-interface=sfp-sfpplus12-spectrum log-prefix=\
|
||||
"Add_Black List (SSH) S3" src-address-list="Black List (SSH) Stage 2"
|
||||
add action=add-src-to-address-list address-list="Black List (SSH) Stage 2" \
|
||||
address-list-timeout=1m chain="Black List (SSH) Chain" comment=\
|
||||
"Add successive attempts to Black List (SSH) Stage 2." connection-state=\
|
||||
new in-interface=sfp-sfpplus12-spectrum log-prefix=\
|
||||
"Add_Black List (SSH) S2" src-address-list="Black List (SSH) Stage 1"
|
||||
add action=add-src-to-address-list address-list="Black List (SSH) Stage 1" \
|
||||
address-list-timeout=1m chain="Black List (SSH) Chain" comment=\
|
||||
"Add initial attempt to Black List (SSH) Stage 1." connection-state=new \
|
||||
in-interface=sfp-sfpplus12-spectrum log-prefix="Add_Black List (SSH) S1" \
|
||||
src-address-list=!trusted
|
||||
add action=return chain="Black List (SSH) Chain" comment=\
|
||||
"Return From Black List (SSH) chain."
|
||||
add action=accept chain=forward disabled=yes dst-address=204.110.191.192/26 \
|
||||
dst-port=3306 log=yes protocol=tcp src-address=162.243.131.32
|
||||
add action=accept chain=forward dst-address=204.110.191.197
|
||||
add action=accept chain=forward comment=micromirror dst-address=\
|
||||
204.110.191.235
|
||||
add action=accept chain=forward dst-address=204.110.191.219
|
||||
add action=accept chain=forward dst-address=204.110.191.8
|
||||
add action=accept chain=forward dst-address=204.110.191.192/26 protocol=icmp
|
||||
add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=80 \
|
||||
protocol=tcp
|
||||
add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=443 \
|
||||
protocol=tcp
|
||||
add action=accept chain=forward dst-address=204.110.191.232 dst-port=14580 \
|
||||
protocol=tcp
|
||||
add action=accept chain=forward dst-address=204.110.191.232 dst-port=14501 \
|
||||
protocol=tcp
|
||||
add action=accept chain=forward comment=wireguard dst-address=204.110.191.247 \
|
||||
dst-port=51820 protocol=udp
|
||||
add action=accept chain=forward dst-address=204.110.191.247 dst-port=22 \
|
||||
protocol=tcp
|
||||
add action=drop chain=forward disabled=yes dst-address=204.110.191.192/26 \
|
||||
dst-port=3306 log=yes protocol=tcp
|
||||
add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=53 \
|
||||
protocol=udp src-address-list=trusted
|
||||
add action=accept chain=forward comment=ns2 dst-address=204.110.191.239 \
|
||||
dst-port=53 protocol=udp
|
||||
add action=accept chain=forward comment=ns1 dst-address=204.110.191.249 \
|
||||
dst-port=53 protocol=udp
|
||||
add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=22 \
|
||||
protocol=tcp src-address-list=trusted
|
||||
add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=22 \
|
||||
protocol=tcp src-address-list=preseem
|
||||
add action=accept chain=forward dst-address=204.110.191.192/26 \
|
||||
src-address-list=trusted
|
||||
add action=drop chain=forward dst-address=204.110.191.192/26 \
|
||||
src-address-list=!trusted
|
||||
add action=drop chain=input dst-port=8921 protocol=tcp src-address-list=\
|
||||
!trusted
|
||||
add action=drop chain=forward dst-port=8921 protocol=tcp src-address-list=\
|
||||
!trusted
|
||||
add action=drop chain=input disabled=yes in-interface=sfp-sfpplus12-spectrum \
|
||||
src-address=100.64.0.0/10
|
||||
add action=drop chain=output disabled=yes dst-address=100.64.0.0/10 \
|
||||
out-interface=sfp-sfpplus12-spectrum
|
||||
add action=drop chain=forward disabled=yes in-interface=\
|
||||
sfp-sfpplus12-spectrum src-address=100.64.0.0/10
|
||||
add action=drop chain=forward disabled=yes out-interface=\
|
||||
sfp-sfpplus12-spectrum src-address=100.64.0.0/10
|
||||
add action=drop chain=forward disabled=yes dst-address=100.64.0.0/10 \
|
||||
out-interface=sfp-sfpplus12-spectrum
|
||||
add action=accept chain=input comment="Established Input" connection-state=\
|
||||
established,related
|
||||
add action=accept chain=forward comment="Established Forward" \
|
||||
connection-state=established,related
|
||||
add action=accept chain=input comment=BGP dst-port=179 protocol=tcp
|
||||
add action=accept chain=output comment=BGP protocol=tcp src-port=179
|
||||
add action=accept chain=forward comment=BGP dst-port=179 protocol=tcp
|
||||
add action=accept chain=forward comment=BGP protocol=tcp src-port=179
|
||||
add action=accept chain=input comment=OSPF protocol=ospf
|
||||
add action=accept chain=output comment=OSPF protocol=ospf
|
||||
add action=accept chain=forward comment=OSPF protocol=ospf
|
||||
add action=drop chain=forward dst-port=23 log-prefix=TELNET protocol=tcp
|
||||
/ip firewall mangle
|
||||
add action=mark-packet chain=prerouting disabled=yes new-packet-mark=Inactive \
|
||||
passthrough=no src-address-list=Inactive
|
||||
add action=mark-packet chain=prerouting disabled=yes dst-address-list=\
|
||||
Inactive new-packet-mark=Inactive passthrough=no
|
||||
add action=accept chain=postrouting disabled=yes protocol=tcp tcp-flags=ack
|
||||
/ip firewall nat
|
||||
add action=src-nat chain=srcnat comment="Internal NAT catch-all" \
|
||||
out-interface=sfp-sfpplus12-spectrum src-address=10.0.0.0/8 to-addresses=\
|
||||
204.110.191.190
|
||||
add action=src-nat chain=srcnat out-interface=sfp-sfpplus12-spectrum \
|
||||
src-address=10.0.0.0/24 to-addresses=204.110.190.254
|
||||
add action=src-nat chain=srcnat comment="Loopback NAT" out-interface=\
|
||||
sfp-sfpplus12-spectrum src-address=10.254.254.0/24 to-addresses=\
|
||||
204.110.191.190
|
||||
add action=src-nat chain=srcnat comment="Loopback NAT" out-interface=\
|
||||
sfp-sfpplus12-spectrum src-address=10.254.254.0/24 to-addresses=\
|
||||
204.110.191.190
|
||||
add action=src-nat chain=srcnat out-interface=sfp-sfpplus12-spectrum \
|
||||
src-address=10.0.0.0/8 to-addresses=204.110.191.190
|
||||
add action=src-nat chain=srcnat comment="Internal Network NAT" out-interface=\
|
||||
sfp-sfpplus12-spectrum src-address=10.250.1.0/24 to-addresses=\
|
||||
204.110.191.190
|
||||
add action=src-nat chain=srcnat comment="Internal Network NAT" out-interface=\
|
||||
sfp-sfpplus12-spectrum src-address=10.250.1.0/24 to-addresses=\
|
||||
204.110.191.190
|
||||
add action=src-nat chain=srcnat comment="fallthrough CGNAT" disabled=yes \
|
||||
out-interface=sfp-sfpplus12-spectrum src-address=100.64.0.0/10 \
|
||||
to-addresses=204.110.190.254
|
||||
add action=netmap chain=srcnat ipsec-policy=out,none out-interface=\
|
||||
sfp-sfpplus12-spectrum src-address=100.64.0.0/10 to-addresses=\
|
||||
204.110.190.128/25
|
||||
add action=netmap chain=dstmap comment=\
|
||||
"Port Forwarding Solution for CGNAT (TCP)" dst-address=204.110.190.128/25 \
|
||||
dst-port=1024-65535 protocol=tcp to-addresses=100.64.0.0/10
|
||||
add action=netmap chain=dstmap comment=\
|
||||
"Port Forwarding Solution for CGNAT (UDP)" dst-address=204.110.190.128/25 \
|
||||
dst-port=1024-65535 protocol=udp to-addresses=100.64.0.0/10
|
||||
/ip firewall raw
|
||||
add action=drop chain=prerouting src-address-list="Black List (SSH)"
|
||||
add action=drop chain=prerouting disabled=yes src-address-list=abusive
|
||||
add action=drop chain=prerouting disabled=yes src-address-list=\
|
||||
winbox_blacklist
|
||||
/ip proxy
|
||||
set port=23435
|
||||
/ip proxy access
|
||||
add src-address=204.110.188.0/22
|
||||
/ip route
|
||||
add distance=1 gateway=71.41.226.117
|
||||
add distance=1 dst-address=10.10.0.0/20 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.10.16.0/20 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.8/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.8/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.24/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.64/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.64/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.88/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.88/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.254.254.101/32 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.254.254.102/32 gateway=204.110.191.185
|
||||
add distance=1 dst-address=100.64.0.0/10 gateway=204.110.191.185
|
||||
add distance=1 dst-address=100.64.0.0/22 gateway=204.110.191.185
|
||||
add distance=1 dst-address=100.64.4.0/22 gateway=204.110.191.185
|
||||
add distance=1 dst-address=100.64.4.0/22 gateway=204.110.191.185
|
||||
add distance=1 dst-address=100.64.12.0/22 gateway=204.110.191.185
|
||||
add distance=1 dst-address=172.63.0.0/20 gateway=204.110.191.253
|
||||
add distance=1 dst-address=204.110.188.0/22 gateway=204.110.191.181
|
||||
add distance=1 dst-address=204.110.188.0/27 gateway=204.110.191.253
|
||||
add distance=1 dst-address=204.110.188.32/27 gateway=204.110.191.185
|
||||
add distance=1 dst-address=204.110.188.32/27 gateway=204.110.191.185
|
||||
add distance=1 dst-address=204.110.188.224/27 gateway=204.110.191.185
|
||||
add distance=1 dst-address=204.110.191.0/27 gateway=204.110.191.185
|
||||
/ip service
|
||||
set telnet disabled=yes
|
||||
set ftp disabled=yes
|
||||
set www address=204.110.188.0/22 port=2080
|
||||
set ssh address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10 port=1022
|
||||
set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10
|
||||
set api-ssl address=0.0.0.0/0 certificate=server
|
||||
/ip ssh
|
||||
set always-allow-password-login=yes forwarding-enabled=remote strong-crypto=\
|
||||
yes
|
||||
/ipv6 address
|
||||
add address=2605:6000:0:8::f:373/127 advertise=no interface=\
|
||||
sfp-sfpplus12-spectrum
|
||||
add address=2606:1c80::1 interface=vlan9_sfpplus8
|
||||
add address=2606:1c80:0:10::254/128 advertise=no comment="edge loopback" \
|
||||
interface=loopback
|
||||
add address=2606:1c80:0:11::1/127 advertise=no comment=\
|
||||
"P2P edge<->core direct (backup)" interface=sfp-sfpplus7-core-direct
|
||||
add address=2606:1c80:0:1002::1/127 advertise=no comment=\
|
||||
"P2P edge<->core via preseem (primary)" interface=sfp-sfpplus11-preseem
|
||||
/ipv6 firewall address-list
|
||||
add address=2606:1c80::/32 list=bgp-networks
|
||||
/ipv6 firewall filter
|
||||
add action=accept chain=input comment="IPv6 BGP Input" dst-port=179 protocol=\
|
||||
tcp
|
||||
add action=accept chain=output comment="IPv6 BGP Output" protocol=tcp \
|
||||
src-port=179
|
||||
add action=accept chain=forward comment="IPv6 BGP Forward" dst-port=179 \
|
||||
protocol=tcp
|
||||
add action=accept chain=forward comment="IPv6 BGP Forward Reply" protocol=tcp \
|
||||
src-port=179
|
||||
add action=accept chain=input comment="IPv6 Established Input" \
|
||||
connection-state=established,related
|
||||
add action=accept chain=forward comment="IPv6 Established Forward" \
|
||||
connection-state=established,related
|
||||
add action=accept chain=input comment="icmpv6 input" protocol=icmpv6
|
||||
add action=accept chain=input comment="link-local input" src-address=\
|
||||
fe80::/10
|
||||
add action=accept chain=input comment="internal input" src-address=\
|
||||
2606:1c80::/32
|
||||
add action=accept chain=forward comment="PMTUD forward" hop-limit=equal:1 \
|
||||
protocol=icmpv6
|
||||
add action=accept chain=forward comment="icmpv6 forward" protocol=icmpv6
|
||||
add action=accept chain=forward comment=internal<->internal dst-address=\
|
||||
2606:1c80::/32 src-address=2606:1c80::/32
|
||||
/ipv6 route
|
||||
add comment="infra: via preseem (primary)" distance=1 dst-address=\
|
||||
2606:1c80::/48 gateway=2606:1c80:0:1002::2
|
||||
add comment="infra: via direct (backup)" distance=2 dst-address=\
|
||||
2606:1c80::/48 gateway=2606:1c80:0:11::2
|
||||
/mpls interface
|
||||
set [ find default=yes ] mpls-mtu=1530
|
||||
add interface=sfp-sfpplus8-server-switch mpls-mtu=1530
|
||||
/mpls ldp
|
||||
set distribute-for-default-route=yes enabled=yes loop-detect=yes lsr-id=\
|
||||
10.254.254.254 transport-address=10.254.254.254
|
||||
/mpls ldp accept-filter
|
||||
add
|
||||
/mpls ldp advertise-filter
|
||||
add
|
||||
/mpls ldp interface
|
||||
add disabled=yes interface=ether1
|
||||
add disabled=yes interface=sfp-sfpplus11-preseem transport-address=\
|
||||
10.254.254.254
|
||||
add disabled=yes interface=vlan9_sfpplus8 transport-address=10.254.254.254
|
||||
add interface=sfp-sfpplus8-server-switch
|
||||
/routing bfd interface
|
||||
set [ find default=yes ] disabled=yes
|
||||
add interface=sfp-sfpplus7-core-direct
|
||||
add interface=sfp-sfpplus11-preseem
|
||||
/routing bgp network
|
||||
add network=204.110.188.0/22 synchronize=no
|
||||
add network=2606:1c80::/32 synchronize=no
|
||||
/routing bgp peer
|
||||
add in-filter=twc-in name=twc out-filter=twc-out remote-address=71.41.226.117 \
|
||||
remote-as=11427 ttl=default
|
||||
add address-families=ipv6 in-filter=twc-in name=twc-v6 out-filter=twc-out \
|
||||
remote-address=2605:6000:0:8::f:372 remote-as=11427 ttl=default
|
||||
add comment="TEAM-CYMRU BOGON Server #1" disabled=yes in-filter=\
|
||||
BOGON-SERVER-IN max-prefix-limit=50 multihop=yes name=CYMRU-1 out-filter=\
|
||||
BGP-DROP remote-address=38.229.6.20 remote-as=65332 tcp-md5-key=\
|
||||
mC9LaaOi0P
|
||||
add comment="TEAM-CYMRU BOGON Server #2" disabled=yes in-filter=\
|
||||
BOGON-SERVER-IN max-prefix-limit=50 multihop=yes name=CYMRU-1 out-filter=\
|
||||
BGP-DROP remote-address=38.229.46.20 remote-as=65332 tcp-md5-key=\
|
||||
mC9LaaOi0P
|
||||
add address-families=ip,ipv6 default-originate=always disabled=yes name=\
|
||||
edge_core_preseem nexthop-choice=propagate out-filter=bgp-default-only \
|
||||
remote-address=204.110.191.185 remote-as=393837
|
||||
add address-families=ipv6 comment="iBGP to verona, v4 transport / v6 NLRI" \
|
||||
default-originate=always in-filter=ibgp-tower-in-v6 name=ibgp-verona-v6 \
|
||||
nexthop-choice=force-self out-filter=ibgp-tower-out-v6 remote-address=\
|
||||
10.254.254.101 remote-as=393837 update-source=loopback
|
||||
/routing filter
|
||||
add action=accept chain=twc-out comment=blackhole disabled=yes prefix=\
|
||||
204.110.188.197 prefix-length=32 set-bgp-communities=7486:666
|
||||
add action=accept chain=twc-in prefix=0.0.0.0/0
|
||||
add action=accept chain=twc-in prefix=0.0.0.0/0 prefix-length=0
|
||||
add action=discard chain=twc-in disabled=yes prefix=0.0.0.0 prefix-length=\
|
||||
0-32 protocol=""
|
||||
add action=accept chain=twc-out prefix=204.110.188.0/22
|
||||
add action=accept chain=twc-out prefix=2606:1c80::/32
|
||||
add action=discard chain=twc-out
|
||||
add action=discard chain=BGP-DROP
|
||||
add action=accept bgp-communities=65333:888 chain=BOGON-SERVER-IN disabled=\
|
||||
yes set-type=blackhole
|
||||
add action=discard chain=BOGON-SERVER-IN disabled=yes
|
||||
add action=discard chain=BGP-DROP
|
||||
add action=accept chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \
|
||||
prefix-length=0
|
||||
add action=discard chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \
|
||||
prefix-length=0-32
|
||||
add action=accept chain=ibgp-tower-in-v6 comment=\
|
||||
"tower /44 customer aggregate" prefix=2606:1c80:1000::/36 prefix-length=\
|
||||
44
|
||||
add action=accept chain=ibgp-tower-in-v6 comment="tower v6 loopback" prefix=\
|
||||
2606:1c80:0:10::/64 prefix-length=128
|
||||
add action=discard chain=ibgp-tower-in-v6 comment="default deny"
|
||||
add action=accept chain=ibgp-tower-out-v6 comment="default route to tower" \
|
||||
prefix=::/0 prefix-length=0
|
||||
add action=discard chain=ibgp-tower-out-v6 comment="default deny"
|
||||
/routing ospf interface
|
||||
add interface=sfp-sfpplus12-spectrum network-type=broadcast passive=yes
|
||||
add interface=sfp-sfpplus11-preseem network-type=point-to-point use-bfd=yes
|
||||
add cost=20 interface=sfp-sfpplus9 network-type=nbma use-bfd=yes
|
||||
add interface=sfp-sfpplus10 network-type=nbma passive=yes
|
||||
add cost=20 interface=ether1 network-type=broadcast
|
||||
add interface=sfp-sfpplus8-server-switch network-type=broadcast
|
||||
add cost=100 interface=sfp-sfpplus7-core-direct network-type=point-to-point \
|
||||
use-bfd=yes
|
||||
add interface=vlan9_sfpplus8 network-type=nbma
|
||||
/routing ospf nbma-neighbor
|
||||
add address=204.110.191.189 poll-interval=10s
|
||||
add address=10.250.1.94
|
||||
add address=10.250.1.57
|
||||
add address=10.250.1.201
|
||||
add address=10.250.2.1
|
||||
add address=204.110.191.185 poll-interval=10s
|
||||
add address=204.110.191.252 poll-interval=10s
|
||||
/routing ospf network
|
||||
add area=backbone
|
||||
/routing rip
|
||||
set distribute-default=always redistribute-connected=yes redistribute-ospf=\
|
||||
yes
|
||||
/routing rip interface
|
||||
add interface=sfp-sfpplus11-preseem
|
||||
add interface=sfp-sfpplus7-core-direct
|
||||
add interface=sfp-sfpplus8-server-switch
|
||||
/routing rip network
|
||||
add
|
||||
/snmp
|
||||
set contact="Verona Networks" enabled=yes location="Verona Networks"
|
||||
/system clock
|
||||
set time-zone-name=America/Chicago
|
||||
/system identity
|
||||
set name=edge
|
||||
/system logging
|
||||
add action=logs topics=info
|
||||
/system note
|
||||
set note="__ __\
|
||||
\n\\ \\ / /__ _ __ ___ _ __ __ _\
|
||||
\n \\ \\ / / _ \\ '__/ _ \\| '_ \\ / _` |\
|
||||
\n \\ V / __/ | | (_) | | | | (_| |\
|
||||
\n \\_/ \\___|_| \\___/|_| |_|\\__,_|\
|
||||
\n _ _ _ _\
|
||||
\n| \\ | | ___| |___ _____ _ __| | _____\
|
||||
\n| \\| |/ _ \\ __\\ \\ /\\ / / _ \\| '__| |/ / __|\
|
||||
\n| |\\ | __/ |_ \\ V V / (_) | | | <\\__ \\\
|
||||
\n|_| \\_|\\___|\\__| \\_/\\_/ \\___/|_| |_|\\_\\___/\
|
||||
\n\
|
||||
\n###############################################################\
|
||||
\n# Welcome to Verona Networks #\
|
||||
\n# All connections are monitored and recorded #\
|
||||
\n# Disconnect IMMEDIATELY if you are not an authorized user! #\
|
||||
\n###############################################################\
|
||||
\n\
|
||||
\n" show-at-login=no
|
||||
/system ntp client
|
||||
set enabled=yes primary-ntp=162.159.200.1 secondary-ntp=45.79.1.70
|
||||
/system routerboard settings
|
||||
set auto-upgrade=yes
|
||||
/system scheduler
|
||||
add name=reboot on-event="/system reboot\r\
|
||||
\n" policy=\
|
||||
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
|
||||
start-date=jun/14/2023 start-time=03:00:00
|
||||
add comment=RWB_IP_RESOLVER interval=5m name=RWB_IP_RESOLVER on-event=\
|
||||
RWB_IP_RESOLVER policy=\
|
||||
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
|
||||
start-date=oct/13/2022 start-time=22:59:02
|
||||
/tool graphing interface
|
||||
add allow-address=204.110.188.0/22
|
||||
/tool graphing queue
|
||||
add allow-address=204.110.188.0/22
|
||||
/tool graphing resource
|
||||
add allow-address=204.110.188.0/22
|
||||
/tool romon
|
||||
set enabled=yes
|
||||
/user aaa
|
||||
set default-group=full
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# may/09/2026 09:37:53 by RouterOS 6.49.18
|
||||
# may/09/2026 11:21:08 by RouterOS 6.49.18
|
||||
# software id = 8XZE-R7EJ
|
||||
#
|
||||
# model = CCR2004-1G-12S+2XS
|
||||
|
|
@ -40,7 +40,8 @@ add burst-limit=1/1 burst-threshold=1/1 burst-time=1s/1s disabled=yes \
|
|||
limit-at=1/1 max-limit=1/1 name=Inactive packet-marks=Inactive priority=\
|
||||
2/2 target=""
|
||||
/routing bgp instance
|
||||
set default as=393837 out-filter=twc-out router-id=204.110.191.190
|
||||
set default as=393837 cluster-id=10.254.254.254 out-filter=twc-out router-id=\
|
||||
204.110.191.190
|
||||
/routing ospf instance
|
||||
set [ find default=yes ] distribute-default=always-as-type-1 router-id=\
|
||||
10.254.254.254
|
||||
|
|
@ -51,8 +52,7 @@ set [ find default=yes ] distribute-default=always-as-type-1 \
|
|||
set [ find default=yes ] name=onehuargd4a8974y79a497yi
|
||||
add addresses=204.110.188.0/22,10.0.0.0/8 name=kdyyJrT0Mm
|
||||
/system logging action
|
||||
add name=logs remote=204.110.191.229 remote-port=1514 src-address=\
|
||||
10.254.254.254 target=remote
|
||||
add name=logs remote=204.110.191.229 src-address=10.254.254.254 target=remote
|
||||
/user group
|
||||
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\
|
||||
sword,web,sniff,sensitive,api,romon,dude,tikapp"
|
||||
|
|
@ -534,9 +534,9 @@ add address=2605:6000:0:8::f:373/127 advertise=no interface=\
|
|||
add address=2606:1c80::1 interface=vlan9_sfpplus8
|
||||
add address=2606:1c80:0:10::254/128 advertise=no comment="edge loopback" \
|
||||
interface=loopback
|
||||
add address=2606:1c80:0:11::1/127 advertise=no comment=\
|
||||
add address=2606:1c80:0:11::1 advertise=no comment=\
|
||||
"P2P edge<->core direct (backup)" interface=sfp-sfpplus7-core-direct
|
||||
add address=2606:1c80:0:1002::1/127 advertise=no comment=\
|
||||
add address=2606:1c80:0:1002::1 advertise=no comment=\
|
||||
"P2P edge<->core via preseem (primary)" interface=sfp-sfpplus11-preseem
|
||||
/ipv6 firewall address-list
|
||||
add address=2606:1c80::/32 list=bgp-networks
|
||||
|
|
@ -564,6 +564,8 @@ add action=accept chain=forward comment="icmpv6 forward" protocol=icmpv6
|
|||
add action=accept chain=forward comment=internal<->internal dst-address=\
|
||||
2606:1c80::/32 src-address=2606:1c80::/32
|
||||
/ipv6 route
|
||||
add comment="anchor for /32 BGP origination to TWC" distance=1 dst-address=\
|
||||
2606:1c80::/32 type=unreachable
|
||||
add comment="infra: via preseem (primary)" distance=1 dst-address=\
|
||||
2606:1c80::/48 gateway=2606:1c80:0:1002::2
|
||||
add comment="infra: via direct (backup)" distance=2 dst-address=\
|
||||
|
|
@ -607,10 +609,10 @@ add comment="TEAM-CYMRU BOGON Server #2" disabled=yes in-filter=\
|
|||
add address-families=ip,ipv6 default-originate=always disabled=yes name=\
|
||||
edge_core_preseem nexthop-choice=propagate out-filter=bgp-default-only \
|
||||
remote-address=204.110.191.185 remote-as=393837
|
||||
add address-families=ipv6 comment="iBGP to verona, v4 transport / v6 NLRI" \
|
||||
default-originate=always in-filter=ibgp-tower-in-v6 name=ibgp-verona-v6 \
|
||||
nexthop-choice=force-self out-filter=ibgp-tower-out-v6 remote-address=\
|
||||
10.254.254.101 remote-as=393837 update-source=loopback
|
||||
add address-families=ipv6 default-originate=always in-filter=ibgp-rr-in \
|
||||
multihop=yes name=ibgp-rr-core nexthop-choice=force-self out-filter=\
|
||||
ibgp-rr-out remote-address=2606:1c80:0:10::253 remote-as=393837 \
|
||||
update-source=loopback
|
||||
/routing filter
|
||||
add action=accept chain=twc-out comment=blackhole disabled=yes prefix=\
|
||||
204.110.188.197 prefix-length=32 set-bgp-communities=7486:666
|
||||
|
|
@ -630,15 +632,13 @@ add action=accept chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \
|
|||
prefix-length=0
|
||||
add action=discard chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \
|
||||
prefix-length=0-32
|
||||
add action=accept chain=ibgp-tower-in-v6 comment=\
|
||||
"tower /44 customer aggregate" prefix=2606:1c80:1000::/36 prefix-length=\
|
||||
44
|
||||
add action=accept chain=ibgp-tower-in-v6 comment="tower v6 loopback" prefix=\
|
||||
2606:1c80:0:10::/64 prefix-length=128
|
||||
add action=discard chain=ibgp-tower-in-v6 comment="default deny"
|
||||
add action=accept chain=ibgp-tower-out-v6 comment="default route to tower" \
|
||||
prefix=::/0 prefix-length=0
|
||||
add action=discard chain=ibgp-tower-out-v6 comment="default deny"
|
||||
add action=accept chain=ibgp-rr-in comment=\
|
||||
"any reflected infra/customer prefix" prefix=2606:1c80::/32 \
|
||||
prefix-length=44-128
|
||||
add action=discard chain=ibgp-rr-in comment="default deny"
|
||||
add action=accept chain=ibgp-rr-out comment="default route to RR" prefix=::/0 \
|
||||
prefix-length=0
|
||||
add action=discard chain=ibgp-rr-out comment="default deny"
|
||||
/routing ospf interface
|
||||
add interface=sfp-sfpplus12-spectrum network-type=broadcast passive=yes
|
||||
add interface=sfp-sfpplus11-preseem network-type=point-to-point use-bfd=yes
|
||||
|
|
|
|||
111
mikrotik-tool/home-v6-apply.rsc
Normal file
111
mikrotik-tool/home-v6-apply.rsc
Normal file
|
|
@ -0,0 +1,111 @@
|
|||
# =============================================================================
|
||||
# graham's home router — IPv6 apply (RB5009UG+S+, ROS 7.22.3)
|
||||
# =============================================================================
|
||||
#
|
||||
# This is graham's home — connects to verona via ether5-vntx-static carrying
|
||||
# 204.110.191.0/27 (home .1, verona .30). Multi-WAN: TMO primary, VNTX
|
||||
# secondary, Starlink last-resort. v6 transit goes via VNTX (only v6-aware
|
||||
# upstream).
|
||||
#
|
||||
# Treated like a regular WISP customer: DHCPv6-PD from verona's customer
|
||||
# pool. Verona delegates a /56 from `verona-cust-pd-1` (2606:1c80:1001::/48).
|
||||
# Whatever /56 verona hands us is then split into two /64s for our internal
|
||||
# LANs:
|
||||
# * bridge — main home LAN (10.0.16/24, 10.0.19/22)
|
||||
# * ether3-servers — servers LAN (10.0.15.254/21)
|
||||
# Both addresses are derived from the local pool `home-pd` populated by the
|
||||
# DHCPv6 client when the /56 is delegated. If verona reboots and the pool
|
||||
# happens to give a different /56 next time, both LANs renumber together.
|
||||
# =============================================================================
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# WIPE — clean prior v6 config (preserve auto-link-local + Starlink ULA)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 nd remove [find !default]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 dhcp-server remove [find]
|
||||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 pool remove [find name=home-pd]
|
||||
/ipv6 route remove [find static=yes]
|
||||
/ipv6 address remove [find !dynamic and !disabled]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — settings
|
||||
# -----------------------------------------------------------------------------
|
||||
# Forward must stay on; do NOT accept RAs as a router would. The dhcp-client
|
||||
# below enables `add-default-route=yes` to install ::/0 from the server's
|
||||
# advertisements specifically, separate from the global accept-RA toggle.
|
||||
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — DHCPv6 client (request prefix delegation from verona)
|
||||
# -----------------------------------------------------------------------------
|
||||
# Treats us as a wired customer: request=prefix asks for a /56, pool-name
|
||||
# stores the delegation in a local pool we then assign /64s out of.
|
||||
# add-default-route=yes installs ::/0 via verona's link-local on receipt.
|
||||
/ipv6 dhcp-client
|
||||
add interface=ether5-vntx-static request=prefix pool-name=home-pd pool-prefix-length=64 \
|
||||
add-default-route=yes default-route-distance=2 \
|
||||
use-peer-dns=yes \
|
||||
comment="DHCPv6-PD from verona on the wired customer link"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — internal LAN addresses pulled from the delegated /56
|
||||
# -----------------------------------------------------------------------------
|
||||
# from-pool=home-pd grabs a /64 from the delegation; the `address=::1` part
|
||||
# fills the host bits, so each LAN ends up at <prefix>::1.
|
||||
# bridge gets <prefix>::1/64; ether3-servers gets the next /64 at
|
||||
# <prefix+1>::1/64 — pool allocation is sequential, so /64s in the same /56
|
||||
# stay contiguous.
|
||||
/ipv6 address
|
||||
add address=::1 from-pool=home-pd interface=bridge advertise=yes comment="home main LAN"
|
||||
add address=::1 from-pool=home-pd interface=ether3-servers advertise=yes comment="home servers LAN"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — neighbour discovery on internal LANs (SLAAC + RDNSS for clients)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 nd
|
||||
add interface=bridge ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
add interface=ether3-servers ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
# Stateless DHCPv6 for DNS option (clients still get addresses from SLAAC)
|
||||
/ipv6 dhcp-server
|
||||
add interface=bridge name=home-bridge-stateless address-pool=static-only
|
||||
add interface=ether3-servers name=home-servers-stateless address-pool=static-only
|
||||
|
||||
/ipv6 dhcp-server option
|
||||
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall (mirror v4 hygiene; deny by default on input)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 firewall filter
|
||||
add chain=input action=accept connection-state=established,related comment="established"
|
||||
add chain=input action=drop connection-state=invalid comment="invalid"
|
||||
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
||||
add chain=input action=accept src-address=2606:1c80::/32 comment="vntx internal"
|
||||
add chain=input action=drop comment="default deny input"
|
||||
|
||||
# Forward — let internal LANs reach the world; allow inbound established
|
||||
# but don't accept arbitrary inbound to home hosts.
|
||||
add chain=forward action=accept connection-state=established,related comment="established"
|
||||
add chain=forward action=drop connection-state=invalid comment="invalid"
|
||||
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
||||
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=forward action=accept in-interface=bridge comment="home outbound (bridge)"
|
||||
add chain=forward action=accept in-interface=ether3-servers comment="home outbound (servers)"
|
||||
add chain=forward action=drop comment="default deny forward"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# VERIFY (after apply)
|
||||
# -----------------------------------------------------------------------------
|
||||
# /ipv6 dhcp-client print ;; should show status=bound and a /56 prefix
|
||||
# /ipv6 pool print ;; should show home-pd populated
|
||||
# /ipv6 address print ;; bridge + ether3-servers each have ::1/64
|
||||
# /ipv6 route print where active ;; ::/0 via fe80::xxxx of verona
|
||||
# /ping 2606:1c80:0:10::101 count=3 ;; verona loopback
|
||||
# /ping 2606:1c80:0:10::253 count=3 ;; core loopback
|
||||
# /ping 2606:4700:4700::1111 count=3 ;; cloudflare (works once TWC v6 is solved)
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 09:37:54 by RouterOS 7.22.3
|
||||
# 2026-05-09 11:21:08 by RouterOS 7.22.3
|
||||
# software id = ZGNY-ZJW7
|
||||
#
|
||||
# model = RB5009UG+S+
|
||||
|
|
@ -38,6 +38,8 @@ add name=dhcp_pool1 ranges=10.0.8.1-10.0.14.254
|
|||
add add-arp=yes address-pool=home bootp-lease-time=lease-time bootp-support=\
|
||||
dynamic interface=bridge lease-time=8h name=server1
|
||||
add address-pool=dhcp_pool1 interface=ether3-servers name=servers
|
||||
/ipv6 dhcp-server option
|
||||
add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
/ipv6 pool
|
||||
add name=tunnerbroker prefix=2001:470:ba50::/48 prefix-length=48
|
||||
/port
|
||||
|
|
@ -455,16 +457,44 @@ add disabled=yes interface=ether6-tmobile type=external
|
|||
add interface=*14 type=external
|
||||
add interface=bridge type=internal
|
||||
/ipv6 address
|
||||
add address=2001:470:1f0e:299::2 advertise=no disabled=yes interface=*10
|
||||
add address=2001:470:ba50::/48 advertise=no disabled=yes interface=bridge
|
||||
add address=2001:470:1f0f:29a:: disabled=yes interface=bridge
|
||||
add address=::1 comment="home main LAN" from-pool=home-pd interface=bridge
|
||||
add address=::1:0:0:0:1 comment="home servers LAN" from-pool=home-pd \
|
||||
interface=ether3-servers
|
||||
/ipv6 dhcp-client
|
||||
add disabled=yes interface=ether6-tmobile pool-name=tmo pool-prefix-length=64 \
|
||||
request=address
|
||||
add interface=ether7-starlink pool-name=starlink pool-prefix-length=64 \
|
||||
request=address,prefix
|
||||
add add-default-route=yes comment="DHCPv6-PD from verona" \
|
||||
default-route-distance=2 interface=ether5-vntx-static pool-name=home-pd \
|
||||
pool-prefix-length=64 request=prefix
|
||||
/ipv6 dhcp-server
|
||||
add interface=bridge name=home-bridge-stateless
|
||||
add interface=ether3-servers name=home-servers-stateless
|
||||
/ipv6 firewall filter
|
||||
add action=accept chain=input comment=established connection-state=\
|
||||
established,related
|
||||
add action=drop chain=input comment=invalid connection-state=invalid
|
||||
add action=accept chain=input comment=icmpv6 protocol=icmpv6
|
||||
add action=accept chain=input comment=link-local src-address=fe80::/10
|
||||
add action=accept chain=input comment="vntx internal" src-address=\
|
||||
2606:1c80::/32
|
||||
add action=drop chain=input comment="default deny input"
|
||||
add action=accept chain=forward comment=established connection-state=\
|
||||
established,related
|
||||
add action=drop chain=forward comment=invalid connection-state=invalid
|
||||
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
|
||||
icmpv6
|
||||
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
|
||||
add action=accept chain=forward comment="home outbound (bridge)" \
|
||||
in-interface=bridge
|
||||
add action=accept chain=forward comment="home outbound (servers)" \
|
||||
in-interface=ether3-servers
|
||||
add action=drop chain=forward comment="default deny forward"
|
||||
/ipv6 nd
|
||||
set [ find default=yes ] advertise-dns=yes
|
||||
add advertise-dns=yes interface=bridge other-configuration=yes
|
||||
add advertise-dns=yes interface=ether3-servers other-configuration=yes
|
||||
/routing rule
|
||||
add action=lookup-only-in-table disabled=no dst-address=0.0.0.0/0 \
|
||||
src-address=10.0.16.1 table=*400
|
||||
|
|
|
|||
117
mikrotik-tool/lowry-v6-apply.rsc
Normal file
117
mikrotik-tool/lowry-v6-apply.rsc
Normal file
|
|
@ -0,0 +1,117 @@
|
|||
# =============================================================================
|
||||
# lowry — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
|
||||
# =============================================================================
|
||||
#
|
||||
# Lowry is a leaf tower. Single backbone P2P:
|
||||
# * newhope (north) — ether1-newhope, v6 P2P 2606:1c80:0:18::/64 (lowry .2)
|
||||
# Default upstream toward newhope :18::1, which forwards to core.
|
||||
#
|
||||
# Loopback: 2606:1c80:0:10::109/128
|
||||
# /44 customer aggregate: 2606:1c80:1900::/44
|
||||
# Mgmt LAN: 2606:1c80:1900::1/64 (assumes `mgmt` bridge — verify name first).
|
||||
# PPPoE profile assumed `pppoe`. Customer interface-list assumed `customer`.
|
||||
# =============================================================================
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# WIPE
|
||||
# -----------------------------------------------------------------------------
|
||||
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
|
||||
/ipv6 dhcp-server remove [find]
|
||||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find !default]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find !dynamic]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find !dynamic]
|
||||
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — BGP instance
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing bgp instance
|
||||
add name=bgp-instance-1 as=393837 router-id=10.254.254.109
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — addresses
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:10::109/128 interface=lo advertise=no comment="loopback"
|
||||
add address=2606:1c80:0:18::2/64 interface=ether1-newhope advertise=no comment="P2P lowry<->newhope"
|
||||
add address=2606:1c80:1900::1/64 interface=mgmt advertise=yes comment="lowry mgmt LAN"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — static routes
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 route
|
||||
add dst-address=::/0 gateway=2606:1c80:0:18::1 distance=1 comment="default via newhope"
|
||||
add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:18::1 distance=1 comment="core loopback (iBGP bootstrap, via newhope)"
|
||||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:18::1 distance=1 comment="edge loopback (via newhope)"
|
||||
add dst-address=2606:1c80:1900::/44 blackhole distance=200 comment="lowry /44 aggregate (iBGP origin)"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — neighbour discovery on the mgmt LAN
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 nd
|
||||
add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
/ipv6 nd prefix
|
||||
add interface=mgmt prefix=2606:1c80:1900::/64 autonomous=yes on-link=yes
|
||||
|
||||
/ipv6 dhcp-server
|
||||
add interface=mgmt name=lowry-mgmt-stateless address-pool=static-only
|
||||
|
||||
/ipv6 dhcp-server option
|
||||
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — customer PD pool + bind to PPPoE profile
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 pool
|
||||
add name=lowry-cust-pd-1 prefix=2606:1c80:1901::/48 prefix-length=56
|
||||
|
||||
/ppp profile
|
||||
set [find name=pppoe] remote-ipv6-prefix-pool=lowry-cust-pd-1 dhcpv6-pd-pool=lowry-cust-pd-1
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 firewall filter
|
||||
add chain=input action=accept connection-state=established,related comment="established"
|
||||
add chain=input action=drop connection-state=invalid comment="invalid"
|
||||
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
||||
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
|
||||
add chain=input action=drop comment="default deny"
|
||||
|
||||
add chain=forward action=accept connection-state=established,related comment="established"
|
||||
add chain=forward action=drop connection-state=invalid comment="invalid"
|
||||
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
||||
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
|
||||
add chain=forward action=accept src-address=2606:1c80:1900::/44 comment="v6 outbound from lowry customers"
|
||||
add chain=forward action=drop comment="default deny"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP to core (v6 RR)
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing filter rule
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1900::/44 || dst==2606:1c80:0:10::109/128 || (dst-len==64 && dst==2606:1c80:0:18::/64)) { accept; } else { reject; }"
|
||||
|
||||
/routing bgp connection
|
||||
add name=ibgp-rr-core instance=bgp-instance-1 templates=default \
|
||||
afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::109 \
|
||||
remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \
|
||||
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
output.redistribute=connected,static \
|
||||
comment="iBGP to core (v6 RR), v6 transport"
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 09:37:54 by RouterOS 7.21.4
|
||||
# 2026-05-09 11:21:08 by RouterOS 7.21.4
|
||||
# software id = 2I9X-PQZP
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
|
|||
|
|
@ -22,6 +22,7 @@ package main
|
|||
import (
|
||||
"bytes"
|
||||
"crypto/tls"
|
||||
"errors"
|
||||
"fmt"
|
||||
"log"
|
||||
"net"
|
||||
|
|
@ -186,14 +187,13 @@ func sshAuthMethods(password string) []ssh.AuthMethod {
|
|||
return methods
|
||||
}
|
||||
|
||||
// runOverSSH opens an SSH connection to host:port, runs cmd non-interactively,
|
||||
// and returns whatever the router wrote to stdout.
|
||||
func runOverSSH(r Router, sshPort int, cmd string) ([]byte, error) {
|
||||
// dialSSH opens an authenticated SSH connection. The KEX list is widened
|
||||
// because some RouterOS boxes (notably edge) only offer
|
||||
// diffie-hellman-group-exchange-sha256, which x/crypto/ssh doesn't enable
|
||||
// by default.
|
||||
func dialSSH(r Router, sshPort int) (*ssh.Client, error) {
|
||||
addr := net.JoinHostPort(r.Host, strconv.Itoa(sshPort))
|
||||
|
||||
// Some RouterOS boxes (notably the edge router) only offer
|
||||
// diffie-hellman-group-exchange-sha256 for KEX, which x/crypto/ssh keeps
|
||||
// out of its defaults. Opt back in by appending it to the supported list.
|
||||
algos := ssh.SupportedAlgorithms()
|
||||
kex := append(algos.KeyExchanges, ssh.KeyExchangeDHGEXSHA256)
|
||||
|
||||
|
|
@ -217,6 +217,16 @@ func runOverSSH(r Router, sshPort int, cmd string) ([]byte, error) {
|
|||
}
|
||||
return nil, fmt.Errorf("ssh dial %s: %w", addr, err)
|
||||
}
|
||||
return client, nil
|
||||
}
|
||||
|
||||
// runOverSSH opens an SSH connection to host:port, runs cmd non-interactively,
|
||||
// and returns whatever the router wrote to stdout.
|
||||
func runOverSSH(r Router, sshPort int, cmd string) ([]byte, error) {
|
||||
client, err := dialSSH(r, sshPort)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer client.Close()
|
||||
|
||||
session, err := client.NewSession()
|
||||
|
|
@ -235,6 +245,51 @@ func runOverSSH(r Router, sshPort int, cmd string) ([]byte, error) {
|
|||
return stdout.Bytes(), nil
|
||||
}
|
||||
|
||||
// runScriptOverSSH pipes a multi-line .rsc script through an SSH session as
|
||||
// if the user had typed it. Each line is parsed by RouterOS's CLI, exactly
|
||||
// like /import does — section paths persist across lines, errors print but
|
||||
// don't abort the rest of the script. A trailing "/quit\n" is appended so
|
||||
// the shell exits cleanly when the file ends.
|
||||
func runScriptOverSSH(r Router, sshPort int, script []byte) ([]byte, error) {
|
||||
client, err := dialSSH(r, sshPort)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer client.Close()
|
||||
|
||||
session, err := client.NewSession()
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("ssh session: %w", err)
|
||||
}
|
||||
defer session.Close()
|
||||
|
||||
var stdout, stderr bytes.Buffer
|
||||
session.Stdout = &stdout
|
||||
session.Stderr = &stderr
|
||||
|
||||
body := append([]byte{}, script...)
|
||||
if len(body) == 0 || body[len(body)-1] != '\n' {
|
||||
body = append(body, '\n')
|
||||
}
|
||||
body = append(body, []byte("/quit\n")...)
|
||||
session.Stdin = bytes.NewReader(body)
|
||||
|
||||
if err := session.Shell(); err != nil {
|
||||
return nil, fmt.Errorf("ssh shell: %w", err)
|
||||
}
|
||||
|
||||
if err := session.Wait(); err != nil {
|
||||
// Wait returns *ssh.ExitMissingError if the server didn't send an
|
||||
// exit status — common for ROS shells that close the channel
|
||||
// without one. Treat as success if we got output.
|
||||
var exitMissing *ssh.ExitMissingError
|
||||
if !errors.As(err, &exitMissing) {
|
||||
return stdout.Bytes(), fmt.Errorf("ssh wait: %w (stderr: %s)", err, stderr.String())
|
||||
}
|
||||
}
|
||||
return stdout.Bytes(), nil
|
||||
}
|
||||
|
||||
// exportRouter logs in over the API to discover the SSH port, then SSHes in
|
||||
// and runs "/export", writing stdout to <name>.rsc locally.
|
||||
func exportRouter(cfg *Config, r Router) error {
|
||||
|
|
@ -452,6 +507,47 @@ func runSchema(cfg *Config, routerName, path string) {
|
|||
}
|
||||
}
|
||||
|
||||
// runScript pushes a local .rsc file to one router and runs it line-by-line
|
||||
// over SSH. Same login flow as `export` (API → discover SSH port → SSH).
|
||||
// The file is fed to the RouterOS shell exactly as if the user pasted it
|
||||
// in WinBox/SSH; section paths persist across lines, comments are ignored
|
||||
// by RouterOS, and an error on one line doesn't abort the rest.
|
||||
func runScript(cfg *Config, routerName, scriptPath string) {
|
||||
target := findRouter(cfg, routerName)
|
||||
if target == nil {
|
||||
log.Fatalf("no router named %q in config", routerName)
|
||||
}
|
||||
r := cfg.resolve(*target)
|
||||
|
||||
body, err := os.ReadFile(scriptPath)
|
||||
if err != nil {
|
||||
log.Fatalf("read %s: %v", scriptPath, err)
|
||||
}
|
||||
|
||||
log.Printf("[%s] api %s@%s:%d (look up ssh port)", r.Name, r.Username, r.Host, r.Port)
|
||||
api, err := dialAPI(r)
|
||||
if err != nil {
|
||||
log.Fatalf("[%s] %v", r.Name, err)
|
||||
}
|
||||
sshPort, err := lookupSSHPort(api)
|
||||
api.Close()
|
||||
if err != nil {
|
||||
log.Fatalf("[%s] %v", r.Name, err)
|
||||
}
|
||||
|
||||
log.Printf("[%s] ssh %s:%d running %s (%d bytes)", r.Name, r.Host, sshPort, scriptPath, len(body))
|
||||
out, err := runScriptOverSSH(r, sshPort, body)
|
||||
if len(out) > 0 {
|
||||
os.Stdout.Write(out)
|
||||
if !bytes.HasSuffix(out, []byte("\n")) {
|
||||
fmt.Println()
|
||||
}
|
||||
}
|
||||
if err != nil {
|
||||
log.Fatalf("[%s] %v", r.Name, err)
|
||||
}
|
||||
}
|
||||
|
||||
func runList(cfg *Config) {
|
||||
for _, r := range cfg.Routers {
|
||||
r2 := cfg.resolve(r)
|
||||
|
|
|
|||
|
|
@ -126,6 +126,40 @@ def find_interface_id(device_name, interface_name):
|
|||
return data["results"][0]["id"]
|
||||
|
||||
|
||||
def ensure_interface(device_name, interface_name):
|
||||
"""Get or create a NetBox interface for this device. Picks a sensible
|
||||
type based on the interface name pattern. Returns the interface id."""
|
||||
iface_id = find_interface_id(device_name, interface_name)
|
||||
if iface_id is not None:
|
||||
return iface_id
|
||||
device_id = find_device_id(device_name)
|
||||
if device_id is None:
|
||||
return None
|
||||
# Pick type from name
|
||||
nm = interface_name.lower()
|
||||
if nm == "lo" or nm == "loopback" or nm.startswith("vlan") \
|
||||
or nm in ("verona", "mgmt") or nm.endswith("-bridge"):
|
||||
if_type = "virtual"
|
||||
elif nm.startswith("sfp"):
|
||||
if_type = "10gbase-x-sfpp"
|
||||
else:
|
||||
if_type = "1000base-t"
|
||||
payload = {
|
||||
"device": device_id,
|
||||
"name": interface_name,
|
||||
"type": if_type,
|
||||
"description": f"auto-created by netbox_v6_sync.py",
|
||||
}
|
||||
if DRY_RUN:
|
||||
print(f" would CREATE iface {interface_name} ({if_type})")
|
||||
return None
|
||||
code, body = nb("POST", "/dcim/interfaces/", payload)
|
||||
if code >= 400:
|
||||
print(f" iface CREATE failed: {code} {body}")
|
||||
return None
|
||||
return body["id"]
|
||||
|
||||
|
||||
def find_device_id(device_name):
|
||||
code, data = nb("GET", f"/dcim/devices/?name={device_name}")
|
||||
if code != 200 or not data["results"]:
|
||||
|
|
@ -140,11 +174,9 @@ def upsert_ip(address, device_name, interface_name, description):
|
|||
code, data = nb("GET", f"/ipam/ip-addresses/?address={address}")
|
||||
if code != 200:
|
||||
return f"GET failed: {code}"
|
||||
iface_id = find_interface_id(device_name, interface_name)
|
||||
iface_id = ensure_interface(device_name, interface_name)
|
||||
if iface_id is None:
|
||||
# Try to find the interface even if the device has no interface entry
|
||||
# for it (sometimes NetBox doesn't have all interfaces declared)
|
||||
return f"interface {device_name}:{interface_name} not in NetBox — skipped"
|
||||
return f"interface {device_name}:{interface_name} could not be created"
|
||||
payload = {
|
||||
"address": address,
|
||||
"status": "active",
|
||||
|
|
|
|||
132
mikrotik-tool/newhope-v6-apply.rsc
Normal file
132
mikrotik-tool/newhope-v6-apply.rsc
Normal file
|
|
@ -0,0 +1,132 @@
|
|||
# =============================================================================
|
||||
# newhope — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
|
||||
# =============================================================================
|
||||
#
|
||||
# Newhope is a relay tower. P2Ps:
|
||||
# * core (north) — ether2-380, v6 P2P 2606:1c80:0:13::/64 (newhope .2)
|
||||
# * lowry (south) — ether6-lowrycrossing, v6 P2P 2606:1c80:0:18::/64 (newhope .1)
|
||||
# Default upstream toward core via :13::1.
|
||||
# Lowry's loopback :10::109 is reachable through the :18::/64 link (lowry
|
||||
# is dual-homed only via newhope today).
|
||||
#
|
||||
# Loopback: 2606:1c80:0:10::108/128
|
||||
# /44 customer aggregate: 2606:1c80:1800::/44
|
||||
# Mgmt LAN: 2606:1c80:1800::1/64 — assumes a `mgmt` bridge (verify with
|
||||
# /interface/print before applying).
|
||||
# PPPoE profile assumed `pppoe`. Customer interface-list assumed `customer`.
|
||||
# =============================================================================
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# WIPE — drop OSPFv3 + stale internal v6
|
||||
# -----------------------------------------------------------------------------
|
||||
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
|
||||
/ipv6 dhcp-server remove [find]
|
||||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find !default]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find !dynamic]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find !dynamic]
|
||||
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — BGP instance
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing bgp instance
|
||||
add name=bgp-instance-1 as=393837 router-id=10.254.254.108
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — addresses
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:10::108/128 interface=lo advertise=no comment="loopback"
|
||||
add address=2606:1c80:0:13::2/64 interface=ether2-380 advertise=no comment="P2P newhope<->core"
|
||||
add address=2606:1c80:0:18::1/64 interface=ether6-lowrycrossing advertise=no comment="P2P newhope<->lowry"
|
||||
add address=2606:1c80:1800::1/64 interface=mgmt advertise=yes comment="newhope mgmt LAN"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — static routes
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 route
|
||||
add dst-address=::/0 gateway=2606:1c80:0:13::1 distance=1 comment="default via core"
|
||||
add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:13::1 distance=1 comment="core loopback (iBGP bootstrap)"
|
||||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:13::1 distance=1 comment="edge loopback via core"
|
||||
add dst-address=2606:1c80:1800::/44 blackhole distance=200 comment="newhope /44 aggregate (iBGP origin)"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — neighbour discovery on the mgmt LAN
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 nd
|
||||
add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
/ipv6 nd prefix
|
||||
add interface=mgmt prefix=2606:1c80:1800::/64 autonomous=yes on-link=yes
|
||||
|
||||
/ipv6 dhcp-server
|
||||
add interface=mgmt name=newhope-mgmt-stateless address-pool=static-only
|
||||
|
||||
/ipv6 dhcp-server option
|
||||
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — customer PD pool + bind to PPPoE profile
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 pool
|
||||
add name=newhope-cust-pd-1 prefix=2606:1c80:1801::/48 prefix-length=56
|
||||
|
||||
/ppp profile
|
||||
set [find name=pppoe] remote-ipv6-prefix-pool=newhope-cust-pd-1 dhcpv6-pd-pool=newhope-cust-pd-1
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 firewall filter
|
||||
add chain=input action=accept connection-state=established,related comment="established"
|
||||
add chain=input action=drop connection-state=invalid comment="invalid"
|
||||
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
||||
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
|
||||
add chain=input action=drop comment="default deny"
|
||||
|
||||
add chain=forward action=accept connection-state=established,related comment="established"
|
||||
add chain=forward action=drop connection-state=invalid comment="invalid"
|
||||
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
||||
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
|
||||
add chain=forward action=accept src-address=2606:1c80:1800::/44 comment="v6 outbound from newhope customers"
|
||||
add chain=forward action=accept src-address=2606:1c80:1900::/44 comment="v6 outbound from lowry customers (transit)"
|
||||
add chain=forward action=drop comment="default deny"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP to core (v6 RR)
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing filter rule
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1800::/44 || dst==2606:1c80:0:10::108/128 || (dst-len==64 && (dst==2606:1c80:0:13::/64 || dst==2606:1c80:0:18::/64))) { accept; } else { reject; }"
|
||||
|
||||
/routing bgp connection
|
||||
add name=ibgp-rr-core instance=bgp-instance-1 templates=default \
|
||||
afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::108 \
|
||||
remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \
|
||||
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
output.redistribute=connected,static \
|
||||
comment="iBGP to core (v6 RR), v6 transport"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# VERIFY
|
||||
# -----------------------------------------------------------------------------
|
||||
# /ipv6 address print
|
||||
# /ipv6 route print where active
|
||||
# /routing bgp session print
|
||||
# /ping 2606:1c80:0:10::253 count=3 ;; core
|
||||
# /ping 2606:1c80:0:10::109 count=3 ;; lowry (after lowry applies)
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 09:37:54 by RouterOS 7.21.4
|
||||
# 2026-05-09 11:21:08 by RouterOS 7.21.4
|
||||
# software id = 5HTF-YFWV
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
|
|||
|
|
@ -51,6 +51,7 @@
|
|||
/ipv6 address
|
||||
add address=2606:1c80:0:10::101/128 interface=lo advertise=no comment="loopback"
|
||||
add address=2606:1c80:0:20::1/64 interface=ether3-climax-11ghz advertise=no comment="P2P verona<->climax"
|
||||
add address=2606:1c80:0:30::1/64 interface=vlan9_sfpplus1 advertise=no comment="P2P verona<->graham home"
|
||||
add address=2606:1c80:1000::1/64 interface=verona advertise=yes comment="verona mgmt LAN"
|
||||
add address=2606:1c80:1500::1/64 interface=ether6-switch advertise=yes comment="altoga mgmt LAN"
|
||||
|
||||
|
|
@ -82,6 +83,20 @@ add interface=ether6-switch prefix=2606:1c80:1500::/64 autonomous=yes on-link=ye
|
|||
add interface=verona name=verona-mgmt-stateless address-pool=static-only
|
||||
add interface=ether6-switch name=altoga-mgmt-stateless address-pool=static-only
|
||||
|
||||
# DHCPv6 PD server on vlan9_sfpplus1 — graham's home router connects there
|
||||
# and is treated like a regular customer: it requests prefix delegation,
|
||||
# receives a /56 from verona-cust-pd-1, and the dynamic route to that /56
|
||||
# is created automatically with gateway=client-link-local.
|
||||
add interface=vlan9_sfpplus1 name=verona-wired-pd address-pool=static-only prefix-pool=verona-cust-pd-1
|
||||
|
||||
# RA on vlan9_sfpplus1 advertises the link /64 + DNS option so the home
|
||||
# router learns the default route via verona's link-local automatically.
|
||||
/ipv6 nd
|
||||
add interface=vlan9_sfpplus1 ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
/ipv6 nd prefix
|
||||
add interface=vlan9_sfpplus1 prefix=2606:1c80:0:30::/64 autonomous=no on-link=yes
|
||||
|
||||
/ipv6 dhcp-server option
|
||||
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
||||
|
|
@ -122,19 +137,29 @@ add chain=forward action=drop
|
|||
# - parameter is `afi=ip,ipv6` NOT `address-families=...`
|
||||
# - need a `/routing bgp instance` to reference (carries the local AS)
|
||||
# - `templates=default` ties it to the existing /routing/bgp/template
|
||||
# Output filter: only advertise verona+altoga /44 aggregates over this session.
|
||||
# Output filter: advertise verona's own routes — verona+altoga /44 customer
|
||||
# aggregates, verona loopback /128, and connected /64 P2Ps to climax (:20)
|
||||
# and graham's home (:30). Core (the v6 RR) reflects these to every other
|
||||
# client. Anything else is rejected so we don't leak customer LANs etc.
|
||||
/routing filter rule
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1000::/44 || dst==2606:1c80:1500::/44) { accept; } else { reject; }"
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1000::/44 || dst==2606:1c80:1500::/44 || dst==2606:1c80:0:10::101/128 || (dst-len==64 && (dst==2606:1c80:0:20::/64 || dst==2606:1c80:0:30::/64))) { accept; } else { reject; }"
|
||||
|
||||
/routing bgp instance
|
||||
add name=bgp-instance-1 as=393837 router-id=10.254.254.101
|
||||
|
||||
# Single iBGP session to CORE (which is the v6 route reflector for the fleet).
|
||||
# v6 transport (loopback-to-loopback) — sidesteps the v4-mapped-next-hop bug
|
||||
# we saw with v4 transport carrying v6 NLRI.
|
||||
# output.redistribute=connected,static picks up the loopback /128 (connected)
|
||||
# and the customer /44 blackhole aggregates (static); the filter chain narrows
|
||||
# to just those three prefixes.
|
||||
/routing bgp connection
|
||||
add name=ibgp-edge-v6 instance=bgp-instance-1 templates=default \
|
||||
afi=ip,ipv6 local.role=ibgp local.address=10.254.254.101 \
|
||||
remote.address=10.254.254.254 remote.as=393837 multihop=yes \
|
||||
add name=ibgp-rr-core instance=bgp-instance-1 templates=default \
|
||||
afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::101 \
|
||||
remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \
|
||||
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
comment="iBGP to edge, v4 transport / v6 NLRI"
|
||||
output.redistribute=connected,static \
|
||||
comment="iBGP to core (v6 RR), v6 transport"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# VERIFY — paste these after the apply
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 09:37:54 by RouterOS 7.21.4
|
||||
# 2026-05-09 11:21:08 by RouterOS 7.21.4
|
||||
# software id = Y1CT-1WB1
|
||||
#
|
||||
# model = CCR2004-16G-2S+
|
||||
|
|
@ -174,6 +174,12 @@ add address-pool=verona-cgnat addresses-per-mac=unlimited interface=verona \
|
|||
name=hotspot1 profile=hsprof1
|
||||
/ip smb users
|
||||
set [ find default=yes ] disabled=yes
|
||||
/ipv6 dhcp-server
|
||||
add address-pool=verona-cust-pd-1 interface=verona name=verona-cust-pd-server
|
||||
add address-pool=altoga-cust-pd-1 interface=ether6-switch name=\
|
||||
altoga-cust-pd-server
|
||||
add interface=vlan9_sfpplus1 name=verona-wired-pd prefix-pool=\
|
||||
verona-cust-pd-1
|
||||
/ipv6 dhcp-server option
|
||||
add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
/ipv6 pool
|
||||
|
|
@ -441,8 +447,7 @@ set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
|
|||
kdyyJrT0Mm
|
||||
/system logging action
|
||||
set 3 remote=204.110.191.208 src-address=10.254.254.101
|
||||
add name=logs remote=204.110.191.229 remote-port=1514 src-address=\
|
||||
10.254.254.101 target=remote
|
||||
add name=logs remote=204.110.191.229 src-address=10.254.254.101 target=remote
|
||||
/interface bridge port
|
||||
add bridge=verona ingress-filtering=no interface=ether6-switch \
|
||||
internal-path-cost=10 path-cost=10
|
||||
|
|
@ -903,12 +908,12 @@ add disabled=no dst-address=10.0.16.84/32 gateway=204.110.188.225
|
|||
/ipv6 route
|
||||
add comment="default via climax P2P" distance=1 dst-address=::/0 gateway=\
|
||||
2606:1c80:0:20::2
|
||||
add comment="edge loopback (iBGP target reachability fallback)" distance=1 \
|
||||
dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:20::2
|
||||
add blackhole comment="verona /44 aggregate (iBGP origin)" distance=200 \
|
||||
dst-address=2606:1c80:1000::/44
|
||||
add blackhole comment="altoga /44 aggregate (iBGP origin)" distance=200 \
|
||||
dst-address=2606:1c80:1500::/44
|
||||
add comment="core loopback via climax" dst-address=2606:1c80:0:10::253/128 \
|
||||
gateway=2606:1c80:0:20::2
|
||||
/ip service
|
||||
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||
|
|
@ -928,9 +933,8 @@ add address=2606:1c80:0:20::1 advertise=no comment="P2P verona<->climax" \
|
|||
add address=2606:1c80:1000::1 comment="verona mgmt LAN" interface=verona
|
||||
add address=2606:1c80:1500::1 comment="altoga mgmt LAN" interface=\
|
||||
ether6-switch
|
||||
/ipv6 dhcp-server
|
||||
add interface=verona name=verona-mgmt-stateless
|
||||
add interface=ether6-switch name=altoga-mgmt-stateless
|
||||
add address=2606:1c80:0:30::1 advertise=no comment="P2P verona<->graham home" \
|
||||
interface=vlan9_sfpplus1
|
||||
/ipv6 firewall filter
|
||||
add action=accept chain=input comment=established connection-state=\
|
||||
established,related
|
||||
|
|
@ -953,8 +957,10 @@ set [ find default=yes ] advertise-dns=yes
|
|||
add advertise-dns=yes interface=verona managed-address-configuration=yes \
|
||||
other-configuration=yes
|
||||
add advertise-dns=yes interface=ether6-switch other-configuration=yes
|
||||
add advertise-dns=yes interface=vlan9_sfpplus1 other-configuration=yes
|
||||
/ipv6 nd prefix
|
||||
add interface=ether6-switch prefix=2606:1c80:1500::/64
|
||||
add autonomous=no interface=vlan9_sfpplus1 prefix=2606:1c80:0:30::/64
|
||||
/mpls interface
|
||||
add interface=ether3-climax-11ghz mpls-mtu=1508
|
||||
/mpls ldp
|
||||
|
|
@ -977,15 +983,18 @@ set accept=yes
|
|||
/routing bfd configuration
|
||||
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
|
||||
/routing bgp connection
|
||||
add afi=ip,ipv6 comment="iBGP to edge, v4 transport / v6 NLRI" instance=\
|
||||
bgp-instance-1 local.address=10.254.254.101 .role=ibgp multihop=yes name=\
|
||||
ibgp-edge-v6 nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
remote.address=10.254.254.254 .as=393837 templates=default
|
||||
add afi=ip,ipv6 as=393837 comment="iBGP to core (v6 RR), v6 transport" \
|
||||
instance=bgp-instance-1 local.address=2606:1c80:0:10::101 .role=ibgp \
|
||||
multihop=yes name=ibgp-rr-core nexthop-choice=force-self \
|
||||
output.filter-chain=v6-ibgp-out .redistribute=connected,static \
|
||||
remote.address=2606:1c80:0:10::253 .as=393837 templates=default
|
||||
/routing filter rule
|
||||
add chain=ospf-in disabled=no rule="accept;"
|
||||
add chain=ospf-out disabled=no rule="accept;"
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1000::/44 || dst==2\
|
||||
606:1c80:1500::/44) { accept; } else { reject; }"
|
||||
606:1c80:1500::/44 || dst==2606:1c80:0:10::101/128 || (dst-len==64 && (dst\
|
||||
==2606:1c80:0:20::/64 || dst==2606:1c80:0:30::/64))) { accept; } else { re\
|
||||
ject; }"
|
||||
/routing ospf interface-template
|
||||
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
||||
ether3-climax-11ghz priority=1 type=ptp use-bfd=no
|
||||
|
|
@ -1003,6 +1012,7 @@ set name=Verona
|
|||
add action=remote topics=info
|
||||
add disabled=yes topics=ospf
|
||||
add action=disk prefix=gtemp topics=firewall
|
||||
add action=logs topics=info
|
||||
/system note
|
||||
set show-at-login=no
|
||||
/system ntp client
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue