diff --git a/mikrotik-tool/494-v6-apply.rsc b/mikrotik-tool/494-v6-apply.rsc new file mode 100644 index 0000000..755ac83 --- /dev/null +++ b/mikrotik-tool/494-v6-apply.rsc @@ -0,0 +1,117 @@ +# ============================================================================= +# 494 — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3) +# ============================================================================= +# +# 494 is a leaf tower. Single backbone P2P: +# * climax (north) — ether2-climax (AF11), v6 P2P 2606:1c80:0:17::/64 (494 .2) +# Default upstream toward climax via :17::1 — climax forwards to core. +# +# Loopback: 2606:1c80:0:10::111/128 +# /44 customer aggregate: 2606:1c80:1A00::/44 +# Mgmt LAN: 2606:1c80:1A00::1/64 (assumes `mgmt` bridge — verify name first). +# PPPoE profile assumed `pppoe`. Customer interface-list assumed `customer`. +# ============================================================================= + +# ----------------------------------------------------------------------------- +# WIPE +# ----------------------------------------------------------------------------- +/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool="" +/ipv6 dhcp-server remove [find] +/ipv6 dhcp-server option remove [find] +/ipv6 dhcp-client remove [find] +/ipv6 nd prefix remove [find] +/ipv6 nd remove [find !default] +/ipv6 pool remove [find] +/ipv6 route remove [find !dynamic] +/ipv6 firewall filter remove [find] +/ipv6 firewall mangle remove [find] +/ipv6 firewall raw remove [find] +/ipv6 address remove [find !dynamic] + +/routing ospf interface-template remove [find area=backbone-v3] +/routing ospf area remove [find name=backbone-v3] +/routing ospf instance remove [find name=default-v3] + +/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"] + +# ----------------------------------------------------------------------------- +# APPLY — BGP instance +# ----------------------------------------------------------------------------- +/routing bgp instance +add name=bgp-instance-1 as=393837 router-id=10.254.254.111 + +# ----------------------------------------------------------------------------- +# APPLY — addresses +# ----------------------------------------------------------------------------- +/ipv6 settings set forward=yes accept-router-advertisements=no + +/ipv6 address +add address=2606:1c80:0:10::111/128 interface=lo advertise=no comment="loopback" +add address=2606:1c80:0:17::2/64 interface=ether2-climax advertise=no comment="P2P 494<->climax" +add address=2606:1c80:1A00::1/64 interface=mgmt advertise=yes comment="494 mgmt LAN" + +# ----------------------------------------------------------------------------- +# APPLY — static routes +# ----------------------------------------------------------------------------- +/ipv6 route +add dst-address=::/0 gateway=2606:1c80:0:17::1 distance=1 comment="default via climax" +add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:17::1 distance=1 comment="core loopback (iBGP bootstrap, via climax)" +add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:17::1 distance=1 comment="edge loopback (via climax)" +add dst-address=2606:1c80:1A00::/44 blackhole distance=200 comment="494 /44 aggregate (iBGP origin)" + +# ----------------------------------------------------------------------------- +# APPLY — neighbour discovery on the mgmt LAN +# ----------------------------------------------------------------------------- +/ipv6 nd +add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes + +/ipv6 nd prefix +add interface=mgmt prefix=2606:1c80:1A00::/64 autonomous=yes on-link=yes + +/ipv6 dhcp-server +add interface=mgmt name=494-mgmt-stateless address-pool=static-only + +/ipv6 dhcp-server option +add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" + +# ----------------------------------------------------------------------------- +# APPLY — customer PD pool + bind to PPPoE profile +# ----------------------------------------------------------------------------- +/ipv6 pool +add name=494-cust-pd-1 prefix=2606:1c80:1A01::/48 prefix-length=56 + +/ppp profile +set [find name=pppoe] remote-ipv6-prefix-pool=494-cust-pd-1 dhcpv6-pd-pool=494-cust-pd-1 + +# ----------------------------------------------------------------------------- +# APPLY — firewall +# ----------------------------------------------------------------------------- +/ipv6 firewall filter +add chain=input action=accept connection-state=established,related comment="established" +add chain=input action=drop connection-state=invalid comment="invalid" +add chain=input action=accept protocol=icmpv6 comment="icmpv6" +add chain=input action=accept src-address=fe80::/10 comment="link-local" +add chain=input action=accept src-address=2606:1c80::/32 comment="internal" +add chain=input action=drop comment="default deny" + +add chain=forward action=accept connection-state=established,related comment="established" +add chain=forward action=drop connection-state=invalid comment="invalid" +add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD" +add chain=forward action=accept protocol=icmpv6 comment="icmpv6" +add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal" +add chain=forward action=accept src-address=2606:1c80:1A00::/44 comment="v6 outbound from 494 customers" +add chain=forward action=drop comment="default deny" + +# ----------------------------------------------------------------------------- +# APPLY — iBGP to core (v6 RR) +# ----------------------------------------------------------------------------- +/routing filter rule +add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1A00::/44 || dst==2606:1c80:0:10::111/128 || (dst-len==64 && dst==2606:1c80:0:17::/64)) { accept; } else { reject; }" + +/routing bgp connection +add name=ibgp-rr-core instance=bgp-instance-1 templates=default \ + afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::111 \ + remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \ + nexthop-choice=force-self output.filter-chain=v6-ibgp-out \ + output.redistribute=connected,static \ + comment="iBGP to core (v6 RR), v6 transport" diff --git a/mikrotik-tool/494.rsc b/mikrotik-tool/494.rsc index 2d708f5..e8b484a 100644 --- a/mikrotik-tool/494.rsc +++ b/mikrotik-tool/494.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:37:54 by RouterOS 7.21.4 +# 2026-05-09 11:21:08 by RouterOS 7.21.4 # software id = K4QG-8NQV # # model = RB5009UG+S+ @@ -354,7 +354,7 @@ add disabled=no instance=ospf-instance-1 name=ospf-area-1 set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\ kdyyJrT0Mm /system logging action -add name=netsvr remote=204.110.191.229 remote-port=1514 target=remote +add name=logs remote=204.110.191.229 target=remote /interface bridge port add bridge=494 interface=ether8 internal-path-cost=10 path-cost=10 add bridge=494 interface=ether7 internal-path-cost=10 path-cost=10 @@ -480,10 +480,10 @@ set time-zone-name=America/Chicago /system identity set name=494 /system logging -add action=netsvr prefix=test1 topics=system,info -add action=netsvr prefix=test1 topics=warning -add action=netsvr prefix=test1 topics=critical -add action=netsvr prefix=test1 topics=error,!ospf,!route +add action=logs prefix=test1 topics=system,info +add action=logs prefix=test1 topics=warning +add action=logs prefix=test1 topics=critical +add action=logs prefix=test1 topics=error,!ospf,!route /system ntp client set enabled=yes /system ntp client servers diff --git a/mikrotik-tool/982-v6-apply.rsc b/mikrotik-tool/982-v6-apply.rsc new file mode 100644 index 0000000..8e226a1 --- /dev/null +++ b/mikrotik-tool/982-v6-apply.rsc @@ -0,0 +1,117 @@ +# ============================================================================= +# 982 — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3) +# ============================================================================= +# +# 982 is a leaf tower. Single backbone P2P: +# * core (north) — ether7-380 (60 GHz), v6 P2P 2606:1c80:0:14::/64 (982 .2) +# Default upstream toward core via :14::1. +# +# Loopback: 2606:1c80:0:10::110/128 +# /44 customer aggregate: 2606:1c80:1300::/44 +# Mgmt LAN: 2606:1c80:1300::1/64 (assumes `mgmt` bridge — verify name first). +# PPPoE profile assumed `pppoe`. Customer interface-list assumed `customer`. +# ============================================================================= + +# ----------------------------------------------------------------------------- +# WIPE +# ----------------------------------------------------------------------------- +/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool="" +/ipv6 dhcp-server remove [find] +/ipv6 dhcp-server option remove [find] +/ipv6 dhcp-client remove [find] +/ipv6 nd prefix remove [find] +/ipv6 nd remove [find !default] +/ipv6 pool remove [find] +/ipv6 route remove [find !dynamic] +/ipv6 firewall filter remove [find] +/ipv6 firewall mangle remove [find] +/ipv6 firewall raw remove [find] +/ipv6 address remove [find !dynamic] + +/routing ospf interface-template remove [find area=backbone-v3] +/routing ospf area remove [find name=backbone-v3] +/routing ospf instance remove [find name=default-v3] + +/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"] + +# ----------------------------------------------------------------------------- +# APPLY — BGP instance +# ----------------------------------------------------------------------------- +/routing bgp instance +add name=bgp-instance-1 as=393837 router-id=10.254.254.110 + +# ----------------------------------------------------------------------------- +# APPLY — addresses +# ----------------------------------------------------------------------------- +/ipv6 settings set forward=yes accept-router-advertisements=no + +/ipv6 address +add address=2606:1c80:0:10::110/128 interface=lo advertise=no comment="loopback" +add address=2606:1c80:0:14::2/64 interface=ether7-380 advertise=no comment="P2P 982<->core (60GHz)" +add address=2606:1c80:1300::1/64 interface=mgmt advertise=yes comment="982 mgmt LAN" + +# ----------------------------------------------------------------------------- +# APPLY — static routes +# ----------------------------------------------------------------------------- +/ipv6 route +add dst-address=::/0 gateway=2606:1c80:0:14::1 distance=1 comment="default via core" +add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:14::1 distance=1 comment="core loopback (iBGP bootstrap)" +add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:14::1 distance=1 comment="edge loopback via core" +add dst-address=2606:1c80:1300::/44 blackhole distance=200 comment="982 /44 aggregate (iBGP origin)" + +# ----------------------------------------------------------------------------- +# APPLY — neighbour discovery on the mgmt LAN +# ----------------------------------------------------------------------------- +/ipv6 nd +add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes + +/ipv6 nd prefix +add interface=mgmt prefix=2606:1c80:1300::/64 autonomous=yes on-link=yes + +/ipv6 dhcp-server +add interface=mgmt name=982-mgmt-stateless address-pool=static-only + +/ipv6 dhcp-server option +add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" + +# ----------------------------------------------------------------------------- +# APPLY — customer PD pool + bind to PPPoE profile +# ----------------------------------------------------------------------------- +/ipv6 pool +add name=982-cust-pd-1 prefix=2606:1c80:1301::/48 prefix-length=56 + +/ppp profile +set [find name=pppoe] remote-ipv6-prefix-pool=982-cust-pd-1 dhcpv6-pd-pool=982-cust-pd-1 + +# ----------------------------------------------------------------------------- +# APPLY — firewall +# ----------------------------------------------------------------------------- +/ipv6 firewall filter +add chain=input action=accept connection-state=established,related comment="established" +add chain=input action=drop connection-state=invalid comment="invalid" +add chain=input action=accept protocol=icmpv6 comment="icmpv6" +add chain=input action=accept src-address=fe80::/10 comment="link-local" +add chain=input action=accept src-address=2606:1c80::/32 comment="internal" +add chain=input action=drop comment="default deny" + +add chain=forward action=accept connection-state=established,related comment="established" +add chain=forward action=drop connection-state=invalid comment="invalid" +add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD" +add chain=forward action=accept protocol=icmpv6 comment="icmpv6" +add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal" +add chain=forward action=accept src-address=2606:1c80:1300::/44 comment="v6 outbound from 982 customers" +add chain=forward action=drop comment="default deny" + +# ----------------------------------------------------------------------------- +# APPLY — iBGP to core (v6 RR) +# ----------------------------------------------------------------------------- +/routing filter rule +add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1300::/44 || dst==2606:1c80:0:10::110/128 || (dst-len==64 && dst==2606:1c80:0:14::/64)) { accept; } else { reject; }" + +/routing bgp connection +add name=ibgp-rr-core instance=bgp-instance-1 templates=default \ + afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::110 \ + remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \ + nexthop-choice=force-self output.filter-chain=v6-ibgp-out \ + output.redistribute=connected,static \ + comment="iBGP to core (v6 RR), v6 transport" diff --git a/mikrotik-tool/982.rsc b/mikrotik-tool/982.rsc index 4f05a37..186cbe7 100644 --- a/mikrotik-tool/982.rsc +++ b/mikrotik-tool/982.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:37:54 by RouterOS 7.21.4 +# 2026-05-09 11:21:08 by RouterOS 7.21.4 # software id = FUVS-HCM5 # # model = CCR1009-7G-1C-1S+ @@ -257,8 +257,7 @@ add disabled=no instance=default-v3 name=backbone-v3 set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\ kdyyJrT0Mm /system logging action -add name=logs remote=204.110.191.229 remote-port=1514 src-address=\ - 10.254.254.110 target=remote +add name=logs remote=204.110.191.229 src-address=10.254.254.110 target=remote /interface bridge port add bridge=982 ingress-filtering=no interface=ether1 internal-path-cost=10 \ path-cost=10 @@ -425,6 +424,7 @@ set time-zone-name=America/Chicago set name=982 /system logging add action=remote topics=info +add action=logs topics=info /system ntp client set enabled=yes /system ntp client servers diff --git a/mikrotik-tool/climax-v6-apply.rsc b/mikrotik-tool/climax-v6-apply.rsc index b768802..1ffa4cf 100644 --- a/mikrotik-tool/climax-v6-apply.rsc +++ b/mikrotik-tool/climax-v6-apply.rsc @@ -124,15 +124,23 @@ add chain=forward action=drop # ----------------------------------------------------------------------------- # APPLY — iBGP to edge (v4 transport / v6 NLRI) # ----------------------------------------------------------------------------- +# Output filter: advertise climax's own routes — /44 customer aggregate, +# loopback /128, and connected /64 P2Ps toward verona, core, culleoka, 494. +# Core (v6 RR) reflects these to every other client. /routing filter rule -add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1100::/44) { accept; } else { reject; }" +add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1100::/44 || dst==2606:1c80:0:10::102/128 || (dst-len==64 && (dst==2606:1c80:0:12::/64 || dst==2606:1c80:0:17::/64 || dst==2606:1c80:0:20::/64 || dst==2606:1c80:0:21::/64))) { accept; } else { reject; }" +# Single iBGP session to CORE (which is the v6 route reflector for the fleet). +# v6 transport (loopback-to-loopback). output.redistribute=connected,static +# picks up the loopback /128 (connected) and the /44 blackhole aggregate +# (static); the filter chain narrows the set. /routing bgp connection -add name=ibgp-edge-v6 instance=bgp-instance-1 templates=default \ - afi=ip,ipv6 local.role=ibgp local.address=10.254.254.102 \ - remote.address=10.254.254.254 remote.as=393837 multihop=yes \ +add name=ibgp-rr-core instance=bgp-instance-1 templates=default \ + afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::102 \ + remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \ nexthop-choice=force-self output.filter-chain=v6-ibgp-out \ - comment="iBGP to edge, v4 transport / v6 NLRI" + output.redistribute=connected,static \ + comment="iBGP to core (v6 RR), v6 transport" # ----------------------------------------------------------------------------- # VERIFY (paste after apply) diff --git a/mikrotik-tool/climax.rsc b/mikrotik-tool/climax.rsc index 57098b8..dea138b 100644 --- a/mikrotik-tool/climax.rsc +++ b/mikrotik-tool/climax.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:37:53 by RouterOS 7.21.4 +# 2026-05-09 11:21:08 by RouterOS 7.21.4 # software id = UETF-WF31 # # model = CCR2004-16G-2S+ @@ -399,10 +399,12 @@ add disabled=no dst-address=10.254.254.101/32 gateway=10.250.1.25 \ /ipv6 route add comment="default via core" distance=1 dst-address=::/0 gateway=\ 2606:1c80:0:12::1 -add comment="edge loopback via core" distance=1 dst-address=\ - 2606:1c80:0:10::254/128 gateway=2606:1c80:0:12::1 add blackhole comment="climax /44 aggregate (iBGP origin)" distance=200 \ dst-address=2606:1c80:1100::/44 +add comment="core loopback via core P2P" dst-address=2606:1c80:0:10::253/128 \ + gateway=2606:1c80:0:12::1 +add comment="verona loopback (bootstrap, beats stale BGP)" distance=1 \ + dst-address=2606:1c80:0:10::101/128 gateway=2606:1c80:0:20::1 /ip service set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes @@ -426,10 +428,14 @@ add address=2606:1c80:0:21::1 advertise=no comment="P2P climax<->culleoka" \ add address=2606:1c80:0:17::1 advertise=no comment="P2P climax<->494" \ interface=ether5-494 add address=2606:1c80:1100::1 comment="climax mgmt LAN" interface=mgmt +add address=2606:1c80:1100:1::1 comment="climax customer LAN (PPPoE+DHCP)" \ + interface=climax-bridge /ipv6 dhcp-relay option set client_mac value="0x0001\$(CLIENT_MAC)" /ipv6 dhcp-server add interface=mgmt name=climax-mgmt-stateless +add address-pool=climax-cust-pd-1 interface=climax-bridge name=\ + climax-cust-pd-server /ipv6 firewall filter add action=accept chain=input comment=established connection-state=\ established,related @@ -453,6 +459,7 @@ add action=drop chain=forward comment="default deny" /ipv6 nd set [ find default=yes ] advertise-dns=yes add advertise-dns=yes interface=mgmt other-configuration=yes +add advertise-dns=yes interface=climax-bridge other-configuration=yes /mpls interface add interface=ether6-verona-11ghz mpls-mtu=1508 add interface=ether4-380-airfiber24 mpls-mtu=1508 @@ -478,14 +485,17 @@ add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5 vrf=\ main /routing bgp connection add afi=ip,ipv6 comment="iBGP to edge, v4 transport / v6 NLRI" instance=\ - bgp-instance-1 local.address=10.254.254.102 .role=ibgp multihop=yes name=\ - ibgp-edge-v6 nexthop-choice=force-self output.filter-chain=v6-ibgp-out \ - remote.address=10.254.254.254 .as=393837 templates=default + bgp-instance-1 local.address=2606:1c80:0:10::102 .role=ibgp multihop=yes \ + name=ibgp-rr-core nexthop-choice=force-self output.filter-chain=\ + v6-ibgp-out .redistribute=connected,static remote.address=\ + 2606:1c80:0:10::253 .as=393837 templates=default /routing filter rule add chain=ospf-in disabled=no rule=accept add chain=ospf-out disabled=no rule=accept -add chain=v6-ibgp-out disabled=no rule=\ - "if (dst==2606:1c80:1100::/44) { accept; } else { reject; }" +add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1100::/44 || dst==2\ + 606:1c80:0:10::102/128 || (dst-len==64 && (dst==2606:1c80:0:12::/64 || dst\ + ==2606:1c80:0:17::/64 || dst==2606:1c80:0:20::/64 || dst==2606:1c80:0:21::\ + /64))) { accept; } else { reject; }" /routing ospf interface-template add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\ ether6-verona-11ghz priority=1 type=ptp use-bfd=no @@ -504,6 +514,8 @@ set contact=graham@vntx.net enabled=yes location="33.187291, -96.448119" set time-zone-autodetect=no time-zone-name=CST6CDT /system identity set name=Climax +/system logging +add action=logs topics=info /system ntp client set enabled=yes /system ntp client servers diff --git a/mikrotik-tool/core-v6-apply.rsc b/mikrotik-tool/core-v6-apply.rsc index 31074b0..e0d7764 100644 --- a/mikrotik-tool/core-v6-apply.rsc +++ b/mikrotik-tool/core-v6-apply.rsc @@ -138,17 +138,57 @@ add chain=forward action=accept in-interface-list=customer add chain=forward action=drop comment="default deny" # ----------------------------------------------------------------------------- -# APPLY — iBGP to edge (v4 transport / v6 NLRI) +# APPLY — iBGP route reflector (core is RR; edge + every tower are RR clients) # ----------------------------------------------------------------------------- -/routing filter rule -add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1400::/44) { accept; } else { reject; }" +# Why core (not edge) is the RR: ROS 6.49 on edge does not properly reflect v6 +# NLRI even with all RR settings (cluster-id, route-reflect, multihop, correct +# in/out filters). ROS7 on core does. So core takes the RR role and edge is +# just another iBGP client — it learns tower /44s + /128 loopbacks reflected +# from core, and supplies the v6 default that core reflects back to towers. +# +# cluster-id on the bgp-instance turns this router into a route reflector. +# It must be set BEFORE adding the client connections. +/routing bgp instance set [find name=bgp-instance-1] cluster-id=10.254.254.253 +# Filter for RR-reflected traffic (in & out): allow ::/0, any /44 (customer +# aggregates), any /64 (P2P backbone links + per-tower customer LANs), any +# /128 (router loopbacks). Reject everything else (defense in depth — keeps +# random connected /80 etc. from leaking). +# NOTE on syntax: ROS 7.21 routing-filter language doesn't accept range +# matchers like `dst-in ` or `dst > ` — only `dst==` +# and length comparisons. So we match by length-class, not by sub-range. +# The /48 covering customer-vs-infra distinction is enforced by the +# ORIGINATING router's own narrower filter (v6-ibgp-out below). +/routing filter rule +add chain=v6-rr-out disabled=no rule="if (dst==::/0 || dst-len==44 || dst-len==64 || dst-len==128) { accept; } else { reject; }" +add chain=v6-rr-in disabled=no rule="if (dst==::/0 || dst-len==44 || dst-len==64 || dst-len==128) { accept; } else { reject; }" + +# Filter for advertising CORE'S OWN connected/static routes outbound (this +# filter runs on each connection's output.filter-chain — what core ORIGINATES +# rather than what it REFLECTS). Narrow by exact prefix so only core's /44 +# customer aggregate, /128 loopback, and /64 P2P links toward each neighbour +# escape into iBGP. +add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1400::/44 || dst==2606:1c80:0:10::253/128 || (dst-len==64 && (dst==2606:1c80:0:11::/64 || dst==2606:1c80:0:12::/64 || dst==2606:1c80:0:13::/64 || dst==2606:1c80:0:14::/64 || dst==2606:1c80:0:15::/64 || dst==2606:1c80:0:1002::/64))) { accept; } else { reject; }" + +# All client connections share these settings: +# templates=default inherits keepalive/holdtime/timers +# afi=ip,ipv6 carry both v4 and v6 NLRI (v4 unused on these but harmless) +# local.role=ibgp same-AS = iBGP +# multihop=yes loopback-to-loopback (more than one hop) +# nexthop-choice=force-self pin next-hop to core's v6 loopback +# cluster=yes marks the peer as an RR client +# input.filter=v6-rr-in limit what we accept +# output.filter-chain=v6-rr-out limit what we send (covers reflected + originated) +# output.redistribute=connected,static pick up our own /44 + /128 /routing bgp connection -add name=ibgp-edge-v6 instance=bgp-instance-1 templates=default \ - afi=ip,ipv6 local.role=ibgp local.address=10.254.254.253 \ - remote.address=10.254.254.254 remote.as=393837 multihop=yes \ - nexthop-choice=force-self output.filter-chain=v6-ibgp-out \ - comment="iBGP to edge, v4 transport / v6 NLRI" +add name=ibgp-rr-edge instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::254 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: edge" +add name=ibgp-rr-verona instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::101 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: verona" +add name=ibgp-rr-climax instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::102 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: climax" +add name=ibgp-rr-culleoka instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::104 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: culleoka" +add name=ibgp-rr-newhope instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::108 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: newhope" +add name=ibgp-rr-lowry instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::109 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: lowry" +add name=ibgp-rr-982 instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::110 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: 982" +add name=ibgp-rr-494 instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::111 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: 494" # ----------------------------------------------------------------------------- # VERIFY (paste after apply) diff --git a/mikrotik-tool/core.rsc b/mikrotik-tool/core.rsc index 6fb02de..9d47dcf 100644 --- a/mikrotik-tool/core.rsc +++ b/mikrotik-tool/core.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:37:54 by RouterOS 7.21.4 +# 2026-05-09 11:21:08 by RouterOS 7.21.4 # software id = XS5B-41QR # # model = CCR1009-7G-1C-1S+ @@ -351,7 +351,8 @@ set ether6-culleoka-11ghz queue=FQ_Codel set ether7-380tower queue=FQ_Codel set sfp-sfpplus1-edge-preseem queue=FQ_Codel /routing bgp instance -add as=393837 name=bgp-instance-1 router-id=10.254.254.253 +add as=393837 cluster-id=10.254.254.253 name=bgp-instance-1 router-id=\ + 10.254.254.253 /routing bgp template set default as=65530 disabled=no /routing id @@ -367,8 +368,7 @@ add fib name=testnat set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\ kdyyJrT0Mm /system logging action -add name=logs remote=204.110.191.229 remote-port=1514 src-address=\ - 10.254.254.253 target=remote +add name=logs remote=204.110.191.229 src-address=10.254.254.253 target=remote /ip smb set enabled=no /ip firewall connection tracking @@ -484,6 +484,10 @@ add comment="edge loopback via direct" distance=2 dst-address=\ 2606:1c80:0:10::254/128 gateway=2606:1c80:0:11::1 add blackhole comment="core /44 aggregate (iBGP origin)" distance=200 \ dst-address=2606:1c80:1400::/44 +add comment="verona loopback via climax" dst-address=2606:1c80:0:10::101/128 \ + gateway=2606:1c80:0:12::2 +add comment="climax loopback via climax P2P" dst-address=\ + 2606:1c80:0:10::102/128 gateway=2606:1c80:0:12::2 /ip service set ftp disabled=yes set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes @@ -511,8 +515,11 @@ add address=2606:1c80:0:14::1 advertise=no comment="P2P core<->982 60GHz" \ add address=2606:1c80:0:15::1 advertise=no comment="P2P core<->culleoka" \ interface=ether6-culleoka-11ghz add address=2606:1c80:1400::1 comment="380 mgmt LAN" interface=vlan10_combo1 +add address=2606:1c80:1400:1::1 comment="380 customer LAN (PPPoE+DHCP)" \ + interface=combo1-380 /ipv6 dhcp-server add interface=vlan10_combo1 name=core-mgmt-stateless +add address-pool=core-cust-pd-1 interface=combo1-380 name=core-cust-pd-server /ipv6 firewall filter add action=accept chain=input comment=established connection-state=\ established,related @@ -535,6 +542,7 @@ add action=drop chain=forward comment="default deny" /ipv6 nd set [ find default=yes ] advertise-dns=yes add advertise-dns=yes interface=vlan10_combo1 other-configuration=yes +add advertise-dns=yes interface=combo1-380 other-configuration=yes /mpls interface add interface=ether5-climax mpls-mtu=1508 add interface=ether6-culleoka-11ghz mpls-mtu=1508 @@ -560,15 +568,59 @@ add accounting-backup=yes address=45.76.56.5 require-message-auth=no service=\ /routing bfd configuration add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5 /routing bgp connection -add afi=ip,ipv6 comment="iBGP to edge, v4 transport / v6 NLRI" instance=\ - bgp-instance-1 local.address=10.254.254.253 .role=ibgp multihop=yes name=\ - ibgp-edge-v6 nexthop-choice=force-self output.filter-chain=v6-ibgp-out \ - remote.address=10.254.254.254 .as=393837 templates=default +add afi=ip,ipv6 as=393837 comment="iBGP to edge, v4 transport / v6 NLRI" \ + input.filter=v6-rr-in instance=bgp-instance-1 local.address=\ + 2606:1c80:0:10::253 .role=ibgp-rr multihop=yes name=ibgp-rr-edge \ + nexthop-choice=default output.filter-chain=v6-rr-out .redistribute=\ + connected,static remote.address=2606:1c80:0:10::254 .as=393837 templates=\ + default +add afi=ip,ipv6 as=393837 comment="RR client: climax" input.filter=v6-rr-in \ + instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \ + multihop=yes name=ibgp-rr-climax nexthop-choice=default \ + output.filter-chain=v6-rr-out .redistribute=connected,static \ + remote.address=2606:1c80:0:10::102 .as=393837 templates=default +add afi=ip,ipv6 as=393837 comment="RR client: culleoka" input.filter=v6-rr-in \ + instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \ + multihop=yes name=ibgp-rr-culleoka nexthop-choice=default \ + output.filter-chain=v6-rr-out .redistribute=connected,static \ + remote.address=2606:1c80:0:10::104 .as=393837 templates=default +add afi=ip,ipv6 as=393837 comment="RR client: newhope" input.filter=v6-rr-in \ + instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \ + multihop=yes name=ibgp-rr-newhope nexthop-choice=default \ + output.filter-chain=v6-rr-out .redistribute=connected,static \ + remote.address=2606:1c80:0:10::108 .as=393837 templates=default +add afi=ip,ipv6 as=393837 comment="RR client: lowry" input.filter=v6-rr-in \ + instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \ + multihop=yes name=ibgp-rr-lowry nexthop-choice=default \ + output.filter-chain=v6-rr-out .redistribute=connected,static \ + remote.address=2606:1c80:0:10::109 .as=393837 templates=default +add afi=ip,ipv6 as=393837 comment="RR client: 982" input.filter=v6-rr-in \ + instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \ + multihop=yes name=ibgp-rr-982 nexthop-choice=default output.filter-chain=\ + v6-rr-out .redistribute=connected,static remote.address=\ + 2606:1c80:0:10::110 .as=393837 templates=default +add afi=ip,ipv6 as=393837 comment="RR client: 494" input.filter=v6-rr-in \ + instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \ + multihop=yes name=ibgp-rr-494 nexthop-choice=default output.filter-chain=\ + v6-rr-out .redistribute=connected,static remote.address=\ + 2606:1c80:0:10::111 .as=393837 templates=default +add afi=ip,ipv6 as=393837 comment="RR client: verona" input.filter=v6-rr-in \ + instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \ + multihop=yes name=ibgp-rr-verona nexthop-choice=default \ + output.filter-chain=v6-rr-out .redistribute=connected,static \ + remote.address=2606:1c80:0:10::101 .as=393837 templates=default /routing filter rule add chain=ospf-in disabled=no rule="accept;" add chain=ospf-out disabled=no rule="accept;" -add chain=v6-ibgp-out disabled=no rule=\ - "if (dst==2606:1c80:1400::/44) { accept; } else { reject; }" +add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1400::/44 || dst==2\ + 606:1c80:0:10::253/128 || (dst-len==64 && (dst==2606:1c80:0:11::/64 || dst\ + ==2606:1c80:0:12::/64 || dst==2606:1c80:0:13::/64 || dst==2606:1c80:0:14::\ + /64 || dst==2606:1c80:0:15::/64 || dst==2606:1c80:0:1002::/64))) { accept;\ + \_} else { reject; }" +add chain=v6-rr-out disabled=no rule="if (dst==::/0 || dst-len==44 || dst-len=\ + =64 || dst-len==128) { accept; } else { reject; }" +add chain=v6-rr-in disabled=no rule="if (dst==::/0 || dst-len==44 || dst-len==\ + 64 || dst-len==128) { accept; } else { reject; }" /routing ospf interface-template add area=backbone-v2 auth-id=1 cost=10 disabled=no interfaces=\ sfp-sfpplus1-edge-preseem priority=1 type=ptp use-bfd=yes diff --git a/mikrotik-tool/culleoka-v6-apply.rsc b/mikrotik-tool/culleoka-v6-apply.rsc new file mode 100644 index 0000000..3199dd6 --- /dev/null +++ b/mikrotik-tool/culleoka-v6-apply.rsc @@ -0,0 +1,147 @@ +# ============================================================================= +# culleoka — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3) +# ============================================================================= +# +# Culleoka has two upstream paths: +# * core (primary) — ether6-380-11ghz, v6 P2P 2606:1c80:0:15::/64 +# * climax (backup) — ether1-climax-11ghz, v6 P2P 2606:1c80:0:21::/64 +# The climax-↔-culleoka 11 GHz radio link is currently DOWN at the radio +# (power injector unplugged); the v6 P2P is configured but inactive until +# the radio comes back up. v4 transit currently goes via core. +# +# Loopback: 2606:1c80:0:10::104/128 +# /44 customer aggregate: 2606:1c80:1600::/44 +# Mgmt LAN: 2606:1c80:1600::1/64 — assumes a `mgmt` bridge similar to +# climax. If culleoka uses a different name (e.g. `bridge1`, `lan`), +# substitute on apply. PPPoE profile assumed `pppoe` — verify with +# /ppp profile print before applying. +# +# Customer interface-list assumed `customer` (same as climax). +# ============================================================================= + +# ----------------------------------------------------------------------------- +# WIPE — drop OSPFv3 + stale internal v6 +# ----------------------------------------------------------------------------- +/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool="" +/ipv6 dhcp-server remove [find] +/ipv6 dhcp-server option remove [find] +/ipv6 dhcp-client remove [find] +/ipv6 nd prefix remove [find] +/ipv6 nd remove [find !default] +/ipv6 pool remove [find] +/ipv6 route remove [find !dynamic] +/ipv6 firewall filter remove [find] +/ipv6 firewall mangle remove [find] +/ipv6 firewall raw remove [find] +/ipv6 address remove [find !dynamic] + +/routing ospf interface-template remove [find area=backbone-v3] +/routing ospf area remove [find name=backbone-v3] +/routing ospf instance remove [find name=default-v3] + +/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"] + +# ----------------------------------------------------------------------------- +# APPLY — BGP instance +# ----------------------------------------------------------------------------- +/routing bgp instance +add name=bgp-instance-1 as=393837 router-id=10.254.254.104 + +# ----------------------------------------------------------------------------- +# APPLY — addresses +# ----------------------------------------------------------------------------- +/ipv6 settings set forward=yes accept-router-advertisements=no + +/ipv6 address +add address=2606:1c80:0:10::104/128 interface=lo advertise=no comment="loopback" +add address=2606:1c80:0:15::2/64 interface=ether6-380-11ghz advertise=no comment="P2P culleoka<->core" +add address=2606:1c80:0:21::2/64 interface=ether1-climax-11ghz advertise=no comment="P2P culleoka<->climax (radio DOWN)" +add address=2606:1c80:1600::1/64 interface=mgmt advertise=yes comment="culleoka mgmt LAN" + +# ----------------------------------------------------------------------------- +# APPLY — static routes +# ----------------------------------------------------------------------------- +/ipv6 route +# Default upstream toward core (climax path stays as a higher-distance backup +# that becomes active automatically when the climax 11 GHz radio is brought +# back up — same shape as v4 OSPF cost relationship in CLAUDE.md). +add dst-address=::/0 gateway=2606:1c80:0:15::1 distance=1 comment="default via core (primary)" +add dst-address=::/0 gateway=2606:1c80:0:21::1 distance=100 comment="default via climax (backup, radio down)" + +# Bootstrap: reach core's v6 loopback before iBGP comes up. Distance=1 wins +# over the BGP-learned /128 (distance=200) once the session is up; both +# routes have the same forwarding outcome. +add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:15::1 distance=1 comment="core loopback (iBGP bootstrap)" +add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:15::1 distance=1 comment="edge loopback via core" + +# Blackhole the /44 so output.redistribute=static picks it up for iBGP. +add dst-address=2606:1c80:1600::/44 blackhole distance=200 comment="culleoka /44 aggregate (iBGP origin)" + +# ----------------------------------------------------------------------------- +# APPLY — neighbour discovery on the mgmt LAN (SLAAC + RDNSS) +# ----------------------------------------------------------------------------- +/ipv6 nd +add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes + +/ipv6 nd prefix +add interface=mgmt prefix=2606:1c80:1600::/64 autonomous=yes on-link=yes + +/ipv6 dhcp-server +add interface=mgmt name=culleoka-mgmt-stateless address-pool=static-only + +/ipv6 dhcp-server option +add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" + +# ----------------------------------------------------------------------------- +# APPLY — customer PD pool + bind to PPPoE profile +# ----------------------------------------------------------------------------- +/ipv6 pool +add name=culleoka-cust-pd-1 prefix=2606:1c80:1601::/48 prefix-length=56 + +/ppp profile +set [find name=pppoe] remote-ipv6-prefix-pool=culleoka-cust-pd-1 dhcpv6-pd-pool=culleoka-cust-pd-1 + +# ----------------------------------------------------------------------------- +# APPLY — firewall +# ----------------------------------------------------------------------------- +/ipv6 firewall filter +add chain=input action=accept connection-state=established,related comment="established" +add chain=input action=drop connection-state=invalid comment="invalid" +add chain=input action=accept protocol=icmpv6 comment="icmpv6" +add chain=input action=accept src-address=fe80::/10 comment="link-local" +add chain=input action=accept src-address=2606:1c80::/32 comment="internal" +add chain=input action=drop comment="default deny" + +add chain=forward action=accept connection-state=established,related comment="established" +add chain=forward action=drop connection-state=invalid comment="invalid" +add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD" +add chain=forward action=accept protocol=icmpv6 comment="icmpv6" +add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal" +add chain=forward action=accept src-address=2606:1c80:1600::/44 comment="v6 outbound from culleoka customers" +add chain=forward action=drop comment="default deny" + +# ----------------------------------------------------------------------------- +# APPLY — iBGP to core (v6 RR) +# ----------------------------------------------------------------------------- +/routing filter rule +add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1600::/44 || dst==2606:1c80:0:10::104/128 || (dst-len==64 && (dst==2606:1c80:0:15::/64 || dst==2606:1c80:0:21::/64))) { accept; } else { reject; }" + +/routing bgp connection +add name=ibgp-rr-core instance=bgp-instance-1 templates=default \ + afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::104 \ + remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \ + nexthop-choice=force-self output.filter-chain=v6-ibgp-out \ + output.redistribute=connected,static \ + comment="iBGP to core (v6 RR), v6 transport" + +# ----------------------------------------------------------------------------- +# VERIFY (paste after apply) +# ----------------------------------------------------------------------------- +# /ipv6 address print +# /ipv6 route print where active +# /routing bgp session print ;; ibgp-rr-core should be Established +# +# After session is up: +# /ping 2606:1c80:0:10::253 count=3 ;; core loopback +# /ping 2606:1c80:0:10::254 count=3 ;; edge loopback (via core) +# /ping 2606:4700:4700::1111 count=3 ;; cloudflare (needs working TWC v6) diff --git a/mikrotik-tool/culleoka.rsc b/mikrotik-tool/culleoka.rsc index d214bbc..41036c4 100644 --- a/mikrotik-tool/culleoka.rsc +++ b/mikrotik-tool/culleoka.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:37:54 by RouterOS 7.21.4 +# 2026-05-09 11:21:08 by RouterOS 7.21.4 # software id = HVP9-3G0K # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/edge-v6-apply.rsc b/mikrotik-tool/edge-v6-apply.rsc index ee7e152..cec0cd3 100644 --- a/mikrotik-tool/edge-v6-apply.rsc +++ b/mikrotik-tool/edge-v6-apply.rsc @@ -111,38 +111,40 @@ add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80 # ----------------------------------------------------------------------------- # APPLY — iBGP route filters (v6) # ----------------------------------------------------------------------------- -# in-filter: accept any /44 inside the tower allocation block 2606:1c80:1000::/36. -# Anything else from a tower iBGP peer is rejected (defense in depth — we -# don't want a tower advertising the world to us). +# Edge has ONE iBGP v6 peer: core, which is the v6 RR for the fleet. Edge is +# an RR client of core (no `route-reflect=yes` — that flag would mark the +# OTHER side as a client, but edge has no clients). Edge sends ::/0 to core +# (which reflects it to towers) and learns tower /44s + /128 loopbacks from +# core (reflected from each tower). +# +# in-filter: accept any infra/customer prefix that core (v6 RR) reflects to +# us. Length 44 = customer aggregates, 64 = backbone P2Ps + per-tower LAN /64s, +# 128 = router loopbacks. Anything else within 2606:1c80::/32 is rejected +# (defense in depth — keeps random connected /80 etc. from leaking). /routing filter -add chain=ibgp-tower-in-v6 prefix=2606:1c80:1000::/36 prefix-length=44 action=accept comment="tower /44 customer aggregate" -add chain=ibgp-tower-in-v6 prefix=2606:1c80:0:10::/64 prefix-length=128 action=accept comment="tower v6 loopback" -add chain=ibgp-tower-in-v6 action=discard comment="default deny" +add chain=ibgp-rr-in prefix=2606:1c80::/32 prefix-length=44-128 action=accept comment="any reflected infra/customer prefix" +add chain=ibgp-rr-in action=discard comment="default deny" -# out-filter: edge sends ONLY the v6 default to towers. Towers don't need -# anything else from edge — they reach customers via their own routes and -# transit upstream via the default. -add chain=ibgp-tower-out-v6 prefix=::/0 prefix-length=0 action=accept comment="default route to tower" -add chain=ibgp-tower-out-v6 action=discard comment="default deny" +# out-filter: edge sends only the v6 default to core (which the RR fans +# out to every tower). Anything else stays inside edge. +add chain=ibgp-rr-out prefix=::/0 prefix-length=0 action=accept comment="default route" +add chain=ibgp-rr-out action=discard comment="default deny" # ----------------------------------------------------------------------------- -# APPLY — iBGP peer to verona (over v4 transport, carrying v6 NLRI) +# APPLY — iBGP peer to core (v6 transport, carrying v6 NLRI) # ----------------------------------------------------------------------------- -# ROS6 syntax: address-families=ipv6 with a v4 remote-address gives -# MP-BGP v6-NLRI-over-v4-TCP. update-source=loopback ensures the TCP -# session sources from the v4 loopback (10.254.254.254). -# nexthop-choice=force-self pins the v6 next-hop edge advertises to -# its own v6 loopback (2606:1c80:0:10::254), reachable from verona once -# climax has its v6 apply. +# v6 transport (loopback-to-loopback over 2606:1c80:0:10::254 ↔ ::253) avoids +# the v4-mapped-next-hop bug we hit with v4 transport carrying v6 NLRI. Core +# (ROS7) is the route reflector — edge is an RR client and, importantly, NOT +# a reflector itself (ROS 6.49 does not properly reflect v6 NLRI even with +# all RR settings; that's the entire reason core has the role). +# update-source=loopback sources the TCP session from edge's loopback iface +# (which holds both 10.254.254.254 and 2606:1c80:0:10::254). +# nexthop-choice=force-self pins the next-hop edge advertises (::/0) to +# edge's own v6 loopback so towers can resolve it via the RR-reflected +# /128 path. /routing bgp peer -add name=ibgp-verona-v6 \ - remote-address=10.254.254.101 remote-as=393837 \ - update-source=loopback \ - address-families=ipv6 \ - nexthop-choice=force-self \ - in-filter=ibgp-tower-in-v6 out-filter=ibgp-tower-out-v6 \ - default-originate=always \ - comment="iBGP to verona, v4 transport / v6 NLRI" +add name=ibgp-rr-core remote-address=2606:1c80:0:10::253 remote-as=393837 update-source=loopback address-families=ipv6 nexthop-choice=force-self ttl=255 in-filter=ibgp-rr-in out-filter=ibgp-rr-out default-originate=always comment="iBGP to core (v6 RR), v6 transport" # ----------------------------------------------------------------------------- # VERIFY (paste after apply) diff --git a/mikrotik-tool/edge-working.rsc b/mikrotik-tool/edge-working.rsc new file mode 100644 index 0000000..75f503b --- /dev/null +++ b/mikrotik-tool/edge-working.rsc @@ -0,0 +1,720 @@ +# may/09/2026 09:37:53 by RouterOS 6.49.18 +# software id = 8XZE-R7EJ +# +# model = CCR2004-1G-12S+2XS +# serial number = C8A70C55A930 +/interface bridge +add name=cgnat +add fast-forward=no name=loopback +/interface ethernet +set [ find default-name=ether1 ] rx-flow-control=auto tx-flow-control=auto +set [ find default-name=sfp-sfpplus7 ] auto-negotiation=no name=\ + sfp-sfpplus7-core-direct +set [ find default-name=sfp-sfpplus8 ] name=sfp-sfpplus8-server-switch \ + rx-flow-control=auto tx-flow-control=auto +set [ find default-name=sfp-sfpplus10 ] rx-flow-control=auto tx-flow-control=\ + auto +set [ find default-name=sfp-sfpplus11 ] name=sfp-sfpplus11-preseem \ + rx-flow-control=auto tx-flow-control=auto +set [ find default-name=sfp-sfpplus12 ] l2mtu=1500 name=\ + sfp-sfpplus12-spectrum rx-flow-control=auto tx-flow-control=auto +/interface vlan +add interface=sfp-sfpplus8-server-switch name=vlan9_sfpplus8 vlan-id=9 +/interface wireless security-profiles +set [ find default=yes ] supplicant-identity=MikroTik +/ip dhcp-server +add disabled=no interface=vlan9_sfpplus8 name=servers-public +/ip pool +add name=380building ranges=10.0.0.150-10.0.0.239 +add name=servers-public ranges=204.110.191.193-204.110.191.217 +/ip dhcp-server +add address-pool=380building disabled=no interface=sfp-sfpplus8-server-switch \ + name=380-building +/ppp profile +add name=RWB_sstp_profile +/queue simple +add burst-limit=1M/1M burst-threshold=1M/1M burst-time=1s/1s disabled=yes \ + limit-at=1M/1M max-limit=1M/1M name=Delinquent packet-marks=Delenquent \ + priority=2/2 target="" +add burst-limit=1/1 burst-threshold=1/1 burst-time=1s/1s disabled=yes \ + limit-at=1/1 max-limit=1/1 name=Inactive packet-marks=Inactive priority=\ + 2/2 target="" +/routing bgp instance +set default as=393837 out-filter=twc-out router-id=204.110.191.190 +/routing ospf instance +set [ find default=yes ] distribute-default=always-as-type-1 router-id=\ + 10.254.254.254 +/routing ospf-v3 instance +set [ find default=yes ] distribute-default=always-as-type-1 \ + redistribute-connected=as-type-1 router-id=10.254.254.254 +/snmp community +set [ find default=yes ] name=onehuargd4a8974y79a497yi +add addresses=204.110.188.0/22,10.0.0.0/8 name=kdyyJrT0Mm +/system logging action +add name=logs remote=204.110.191.229 remote-port=1514 src-address=\ + 10.254.254.254 target=remote +/user group +set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\ + sword,web,sniff,sensitive,api,romon,dude,tikapp" +/ip firewall connection tracking +set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \ + tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \ + tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \ + tcp-time-wait-timeout=2m udp-stream-timeout=2m udp-timeout=30s +/ip neighbor discovery-settings +set discover-interface-list=!dynamic +/ip settings +set rp-filter=strict tcp-syncookies=yes +/ipv6 settings +set accept-router-advertisements=no +/ip address +add address=71.41.226.118/30 interface=sfp-sfpplus12-spectrum network=\ + 71.41.226.116 +add address=204.110.191.186/30 interface=sfp-sfpplus11-preseem network=\ + 204.110.191.184 +add address=204.110.191.254/26 interface=vlan9_sfpplus8 network=\ + 204.110.191.192 +add address=10.254.254.254 interface=loopback network=10.254.254.254 +add address=204.110.191.182/30 interface=sfp-sfpplus7-core-direct network=\ + 204.110.191.180 +add address=10.0.0.254/24 interface=sfp-sfpplus8-server-switch network=\ + 10.0.0.0 +add address=204.110.190.129/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.130/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.131/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.132/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.133/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.134/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.135/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.136/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.137/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.138/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.139/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.140/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.141/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.142/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.143/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.144/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.145/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.146/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.147/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.148/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.149/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.150/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.151/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.152/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.153/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.154/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.155/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.156/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.157/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.158/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.159/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.160/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.161/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.162/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.163/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.164/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.165/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.166/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.167/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.168/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.169/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.170/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.171/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.172/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.173/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.174/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.175/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.176/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.177/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.178/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.179/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.180/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.181/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.182/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.183/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.184/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.185/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.186/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.187/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.188/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.189/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.190/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.191/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.192/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.193/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.194/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.195/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.196/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.197/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.198/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.199/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.200/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.201/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.202/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.203/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.204/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.205/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.206/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.207/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.208/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.209/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.210/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.211/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.212/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.213/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.214/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.215/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.216/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.217/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.218/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.219/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.220/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.221/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.222/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.223/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.224/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.225/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.226/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.227/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.228/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.229/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.230/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.231/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.232/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.233/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.234/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.235/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.236/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.237/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.238/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.239/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.240/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.241/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.242/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.243/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.244/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.245/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.246/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.247/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.248/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.249/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.250/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.251/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.252/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.253/25 interface=cgnat network=204.110.190.128 +add address=204.110.190.254/25 interface=cgnat network=204.110.190.128 +/ip dhcp-server lease +add address=10.0.0.249 client-id=1:0:21:9b:91:5c:b6 mac-address=\ + 00:21:9B:91:5C:B6 server=380-building +add address=204.110.191.205 mac-address=BC:24:11:8B:C0:9C +add address=10.0.0.250 client-id=1:48:a9:8a:38:3b:2d mac-address=\ + 48:A9:8A:38:3B:2D server=380-building +add address=10.0.0.253 client-id=\ + ff:ca:53:9:5a:0:2:0:0:ab:11:2c:53:dd:b2:c1:50:9a:35 comment=truenas \ + mac-address=BC:24:11:29:2B:5A server=380-building +add address=10.0.0.252 client-id=1:bc:24:11:f5:81:d6 mac-address=\ + BC:24:11:F5:81:D6 server=380-building +add address=10.0.0.251 client-id=1:bc:24:11:6b:73:53 mac-address=\ + BC:24:11:6B:73:53 server=380-building +/ip dhcp-server network +add address=10.0.0.0/24 dns-server=9.9.9.9,1.1.1.1 domain=vntx.net gateway=\ + 10.0.0.254 ntp-server=23.150.41.122 +add address=204.110.191.192/26 dns-server=\ + 204.110.191.240,204.110.191.250,1.1.1.1 gateway=204.110.191.254 +/ip dns +set servers=204.110.191.240,204.110.191.250 +/ip firewall address-list +add address=204.110.188.0/22 list=trusted +add address=100.64.0.0/10 list=trusted +add address=10.0.0.0/8 list=trusted +add address=35.197.73.77 list=preseem +add address=35.199.29.237 list=preseem +add address=98.97.82.0/24 comment=starlink list=trusted +add address=129.222.72.0/24 comment=starlink list=trusted +add address=129.222.73.0/24 comment=starlink list=trusted +add address=129.222.74.0/24 comment=starlink list=trusted +add address=129.222.75.0/24 comment=starlink list=trusted +add address=129.222.76.0/24 comment=starlink list=trusted +add address=129.222.77.0/24 comment=starlink list=trusted +add address=129.222.78.0/24 comment=starlink list=trusted +add address=129.222.79.0/24 comment=starlink list=trusted +add address=98.97.80.0/24 comment=starlink list=trusted +add address=98.97.81.0/24 comment=starlink list=trusted +add address=98.97.83.0/24 comment=starlink list=trusted +add address=98.97.84.0/24 comment=starlink list=trusted +add address=98.97.85.0/24 comment=starlink list=trusted +add address=98.97.86.0/24 comment=starlink list=trusted +add address=98.97.87.0/24 comment=starlink list=trusted +add address=98.97.88.0/24 comment=starlink list=trusted +add address=98.97.89.0/24 comment=starlink list=trusted +add address=98.97.90.0/24 comment=starlink list=trusted +add address=98.97.91.0/24 comment=starlink list=trusted +add address=98.97.92.0/24 comment=starlink list=trusted +add address=98.97.93.0/24 comment=starlink list=trusted +add address=98.97.94.0/24 comment=starlink list=trusted +add address=98.97.95.0/24 comment=starlink list=trusted +add address=52.158.209.86 list=trusted +add address=3.210.85.72 list=gaiia +add address=3.81.237.51 list=gaiia +add address=3.215.70.188 list=gaiia +add address=3.228.90.246 list=gaiia +add address=47.147.43.145 list=trusted +add address=71.41.226.117 comment=TWC list=BGP-NEIGHBORS +add address=204.110.191.185 comment=Preseem list=BGP-NEIGHBORS +add address=204.110.191.252 comment="Virtual RouterOS" list=BGP-NEIGHBORS +add address=204.110.188.0/22 list=bgp-networks +add address=151.243.11.0/24 list=abusive +add address=172.245.56.83 list=trusted +/ip firewall filter +add action=accept chain=input comment="BGP Input" dst-port=179 protocol=tcp +add action=accept chain=output comment="BGP Output" protocol=tcp src-port=179 +add action=accept chain=forward comment="BGP Forward" dst-port=179 protocol=\ + tcp +add action=accept chain=forward comment="BGP Forward Reply" protocol=tcp \ + src-port=179 +add action=accept chain=input comment="OSPF Input" protocol=ospf +add action=accept chain=output comment="OSPF Output" protocol=ospf +add action=accept chain=forward comment="OSPF Forward" protocol=ospf +add action=accept chain=input comment="Established Input" connection-state=\ + established,related +add action=accept chain=forward comment="Established Forward" \ + connection-state=established,related +add action=accept chain=input comment="Allow Remote Winbox" disabled=yes \ + in-interface=*18 +add action=fasttrack-connection chain=forward comment=\ + "fasttrack established/related" connection-state=established,related +add action=accept chain=forward comment="accept established/related" \ + connection-state=established,related +add action=drop chain=forward dst-address=91.190.98.0/24 log=yes +add action=accept chain=forward dst-port=23 protocol=tcp src-address=\ + 204.110.190.208 +add action=accept chain=forward dst-address=204.110.191.219 +add action=accept chain=forward dst-address=204.110.191.222 +add action=accept chain=forward dst-address=204.110.191.252 +add action=accept chain=forward dst-address=204.110.191.8 +add action=accept chain=forward dst-address=204.110.191.192/26 src-address=\ + 52.158.209.86 +add action=accept chain=forward dst-address=204.110.191.210 +add action=accept chain=forward disabled=yes dst-address=204.110.191.248 \ + dst-port=3306 log=yes protocol=tcp +add action=accept chain=forward dst-address=204.110.191.248 dst-port=3306 \ + protocol=tcp src-address-list=gaiia +add action=accept chain=forward disabled=yes dst-address=204.110.191.248 +add action=accept chain=forward dst-address=204.110.191.231 +add action=accept chain=forward dst-address=204.110.191.232 in-interface=\ + sfp-sfpplus12-spectrum +add action=tarpit chain=input protocol=tcp src-address-list=abusive +add action=drop chain=forward src-address-list=abusive +add action=accept chain=forward connection-state=established,related \ + disabled=yes +add action=accept chain=input connection-state=established,related,untracked \ + disabled=yes +add action=drop chain=forward disabled=yes dst-port=3389 in-interface=\ + sfp-sfpplus12-spectrum protocol=tcp +add action=drop chain=forward disabled=yes dst-port=3389 in-interface=\ + sfp-sfpplus12-spectrum protocol=udp +add action=drop chain=forward comment="Drop anyone in Black List (SSH)." \ + in-interface=sfp-sfpplus12-spectrum log-prefix="BL_Black List (SSH)" \ + src-address-list="Black List (SSH)" +add action=drop chain=forward comment="block incoming ftp" disabled=yes \ + dst-port=21 in-interface=sfp-sfpplus12-spectrum protocol=tcp +add action=drop chain=forward comment="block incoming telnet" dst-port=23 \ + in-interface=sfp-sfpplus12-spectrum protocol=tcp +add action=drop chain=input comment="Drop all packets from public internet whi\ + ch should not exist in public network" in-interface=\ + sfp-sfpplus12-spectrum src-address-list=NotPublic +add action=drop chain=input disabled=yes dst-port=3784 in-interface=\ + sfp-sfpplus12-spectrum log=yes protocol=udp +add action=drop chain=forward comment=bfd dst-port=3784 in-interface=\ + sfp-sfpplus12-spectrum protocol=udp +add action=drop chain=input comment=bfd dst-port=3784 in-interface=\ + sfp-sfpplus12-spectrum protocol=udp +add action=drop chain=input comment="Drop Invalid connections" \ + connection-state=invalid +add action=add-src-to-address-list address-list=winbox_blacklist \ + address-list-timeout=4w3d chain=input connection-state=new disabled=yes \ + dst-port=8291 log=yes protocol=tcp src-address-list=winbox_stage3 +add action=add-src-to-address-list address-list=winbox_stage3 \ + address-list-timeout=1m chain=input connection-state=new disabled=yes \ + dst-port=8291 protocol=tcp src-address-list=winbox_stage2 +add action=add-src-to-address-list address-list=winbox_stage2 \ + address-list-timeout=1m chain=input connection-state=new disabled=yes \ + dst-port=8291 protocol=tcp src-address-list=winbox_stage1 +add action=add-src-to-address-list address-list=winbox_stage1 \ + address-list-timeout=1m chain=input connection-state=new disabled=yes \ + dst-port=8291 protocol=tcp src-address-list=!vntx +add action=drop chain=forward comment="drop winbox brute downstream" \ + disabled=yes dst-port=8291 protocol=tcp src-address-list=winbox_blacklist +add action=accept chain=input comment="BGP Neighbors" dst-port=179 protocol=\ + tcp src-address-list=BGP-NEIGHBORS +add action=drop chain=input comment="Drop anyone in Black List (SSH)." \ + disabled=yes in-interface=sfp-sfpplus12-spectrum log-prefix=\ + "BL_Black List (SSH)" src-address-list="Black List (SSH)" +add action=jump chain=input comment="Jump to Black List (SSH) chain." \ + dst-port=22 in-interface=sfp-sfpplus12-spectrum jump-target=\ + "Black List (SSH) Chain" protocol=tcp +add action=drop chain=input comment=. dst-port=23 in-interface=\ + sfp-sfpplus12-spectrum protocol=tcp +add action=drop chain=forward comment=. dst-port=23 in-interface=\ + sfp-sfpplus12-spectrum protocol=tcp +add action=jump chain=forward comment="Jump to Black List (SSH) chain." \ + dst-port=22 in-interface=sfp-sfpplus12-spectrum jump-target=\ + "Black List (SSH) Chain" protocol=tcp +add action=add-src-to-address-list address-list="Black List (SSH)" \ + address-list-timeout=4w2d chain="Black List (SSH) Chain" comment="Transfer\ + \_repeated attempts from Black List (SSH) Stage 3 to Black List (SSH)." \ + connection-state=new in-interface=sfp-sfpplus12-spectrum log-prefix=\ + "Add_Black List (SSH)" src-address-list="Black List (SSH) Stage 3" +add action=add-src-to-address-list address-list="Black List (SSH) Stage 3" \ + address-list-timeout=1m chain="Black List (SSH) Chain" comment=\ + "Add successive attempts to Black List (SSH) Stage 3." connection-state=\ + new in-interface=sfp-sfpplus12-spectrum log-prefix=\ + "Add_Black List (SSH) S3" src-address-list="Black List (SSH) Stage 2" +add action=add-src-to-address-list address-list="Black List (SSH) Stage 2" \ + address-list-timeout=1m chain="Black List (SSH) Chain" comment=\ + "Add successive attempts to Black List (SSH) Stage 2." connection-state=\ + new in-interface=sfp-sfpplus12-spectrum log-prefix=\ + "Add_Black List (SSH) S2" src-address-list="Black List (SSH) Stage 1" +add action=add-src-to-address-list address-list="Black List (SSH) Stage 1" \ + address-list-timeout=1m chain="Black List (SSH) Chain" comment=\ + "Add initial attempt to Black List (SSH) Stage 1." connection-state=new \ + in-interface=sfp-sfpplus12-spectrum log-prefix="Add_Black List (SSH) S1" \ + src-address-list=!trusted +add action=return chain="Black List (SSH) Chain" comment=\ + "Return From Black List (SSH) chain." +add action=accept chain=forward disabled=yes dst-address=204.110.191.192/26 \ + dst-port=3306 log=yes protocol=tcp src-address=162.243.131.32 +add action=accept chain=forward dst-address=204.110.191.197 +add action=accept chain=forward comment=micromirror dst-address=\ + 204.110.191.235 +add action=accept chain=forward dst-address=204.110.191.219 +add action=accept chain=forward dst-address=204.110.191.8 +add action=accept chain=forward dst-address=204.110.191.192/26 protocol=icmp +add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=80 \ + protocol=tcp +add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=443 \ + protocol=tcp +add action=accept chain=forward dst-address=204.110.191.232 dst-port=14580 \ + protocol=tcp +add action=accept chain=forward dst-address=204.110.191.232 dst-port=14501 \ + protocol=tcp +add action=accept chain=forward comment=wireguard dst-address=204.110.191.247 \ + dst-port=51820 protocol=udp +add action=accept chain=forward dst-address=204.110.191.247 dst-port=22 \ + protocol=tcp +add action=drop chain=forward disabled=yes dst-address=204.110.191.192/26 \ + dst-port=3306 log=yes protocol=tcp +add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=53 \ + protocol=udp src-address-list=trusted +add action=accept chain=forward comment=ns2 dst-address=204.110.191.239 \ + dst-port=53 protocol=udp +add action=accept chain=forward comment=ns1 dst-address=204.110.191.249 \ + dst-port=53 protocol=udp +add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=22 \ + protocol=tcp src-address-list=trusted +add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=22 \ + protocol=tcp src-address-list=preseem +add action=accept chain=forward dst-address=204.110.191.192/26 \ + src-address-list=trusted +add action=drop chain=forward dst-address=204.110.191.192/26 \ + src-address-list=!trusted +add action=drop chain=input dst-port=8921 protocol=tcp src-address-list=\ + !trusted +add action=drop chain=forward dst-port=8921 protocol=tcp src-address-list=\ + !trusted +add action=drop chain=input disabled=yes in-interface=sfp-sfpplus12-spectrum \ + src-address=100.64.0.0/10 +add action=drop chain=output disabled=yes dst-address=100.64.0.0/10 \ + out-interface=sfp-sfpplus12-spectrum +add action=drop chain=forward disabled=yes in-interface=\ + sfp-sfpplus12-spectrum src-address=100.64.0.0/10 +add action=drop chain=forward disabled=yes out-interface=\ + sfp-sfpplus12-spectrum src-address=100.64.0.0/10 +add action=drop chain=forward disabled=yes dst-address=100.64.0.0/10 \ + out-interface=sfp-sfpplus12-spectrum +add action=accept chain=input comment="Established Input" connection-state=\ + established,related +add action=accept chain=forward comment="Established Forward" \ + connection-state=established,related +add action=accept chain=input comment=BGP dst-port=179 protocol=tcp +add action=accept chain=output comment=BGP protocol=tcp src-port=179 +add action=accept chain=forward comment=BGP dst-port=179 protocol=tcp +add action=accept chain=forward comment=BGP protocol=tcp src-port=179 +add action=accept chain=input comment=OSPF protocol=ospf +add action=accept chain=output comment=OSPF protocol=ospf +add action=accept chain=forward comment=OSPF protocol=ospf +add action=drop chain=forward dst-port=23 log-prefix=TELNET protocol=tcp +/ip firewall mangle +add action=mark-packet chain=prerouting disabled=yes new-packet-mark=Inactive \ + passthrough=no src-address-list=Inactive +add action=mark-packet chain=prerouting disabled=yes dst-address-list=\ + Inactive new-packet-mark=Inactive passthrough=no +add action=accept chain=postrouting disabled=yes protocol=tcp tcp-flags=ack +/ip firewall nat +add action=src-nat chain=srcnat comment="Internal NAT catch-all" \ + out-interface=sfp-sfpplus12-spectrum src-address=10.0.0.0/8 to-addresses=\ + 204.110.191.190 +add action=src-nat chain=srcnat out-interface=sfp-sfpplus12-spectrum \ + src-address=10.0.0.0/24 to-addresses=204.110.190.254 +add action=src-nat chain=srcnat comment="Loopback NAT" out-interface=\ + sfp-sfpplus12-spectrum src-address=10.254.254.0/24 to-addresses=\ + 204.110.191.190 +add action=src-nat chain=srcnat comment="Loopback NAT" out-interface=\ + sfp-sfpplus12-spectrum src-address=10.254.254.0/24 to-addresses=\ + 204.110.191.190 +add action=src-nat chain=srcnat out-interface=sfp-sfpplus12-spectrum \ + src-address=10.0.0.0/8 to-addresses=204.110.191.190 +add action=src-nat chain=srcnat comment="Internal Network NAT" out-interface=\ + sfp-sfpplus12-spectrum src-address=10.250.1.0/24 to-addresses=\ + 204.110.191.190 +add action=src-nat chain=srcnat comment="Internal Network NAT" out-interface=\ + sfp-sfpplus12-spectrum src-address=10.250.1.0/24 to-addresses=\ + 204.110.191.190 +add action=src-nat chain=srcnat comment="fallthrough CGNAT" disabled=yes \ + out-interface=sfp-sfpplus12-spectrum src-address=100.64.0.0/10 \ + to-addresses=204.110.190.254 +add action=netmap chain=srcnat ipsec-policy=out,none out-interface=\ + sfp-sfpplus12-spectrum src-address=100.64.0.0/10 to-addresses=\ + 204.110.190.128/25 +add action=netmap chain=dstmap comment=\ + "Port Forwarding Solution for CGNAT (TCP)" dst-address=204.110.190.128/25 \ + dst-port=1024-65535 protocol=tcp to-addresses=100.64.0.0/10 +add action=netmap chain=dstmap comment=\ + "Port Forwarding Solution for CGNAT (UDP)" dst-address=204.110.190.128/25 \ + dst-port=1024-65535 protocol=udp to-addresses=100.64.0.0/10 +/ip firewall raw +add action=drop chain=prerouting src-address-list="Black List (SSH)" +add action=drop chain=prerouting disabled=yes src-address-list=abusive +add action=drop chain=prerouting disabled=yes src-address-list=\ + winbox_blacklist +/ip proxy +set port=23435 +/ip proxy access +add src-address=204.110.188.0/22 +/ip route +add distance=1 gateway=71.41.226.117 +add distance=1 dst-address=10.10.0.0/20 gateway=204.110.191.185 +add distance=1 dst-address=10.10.16.0/20 gateway=204.110.191.185 +add distance=1 dst-address=10.250.1.8/29 gateway=204.110.191.185 +add distance=1 dst-address=10.250.1.8/29 gateway=204.110.191.185 +add distance=1 dst-address=10.250.1.24/29 gateway=204.110.191.185 +add distance=1 dst-address=10.250.1.64/29 gateway=204.110.191.185 +add distance=1 dst-address=10.250.1.64/29 gateway=204.110.191.185 +add distance=1 dst-address=10.250.1.88/29 gateway=204.110.191.185 +add distance=1 dst-address=10.250.1.88/29 gateway=204.110.191.185 +add distance=1 dst-address=10.254.254.101/32 gateway=204.110.191.185 +add distance=1 dst-address=10.254.254.102/32 gateway=204.110.191.185 +add distance=1 dst-address=100.64.0.0/10 gateway=204.110.191.185 +add distance=1 dst-address=100.64.0.0/22 gateway=204.110.191.185 +add distance=1 dst-address=100.64.4.0/22 gateway=204.110.191.185 +add distance=1 dst-address=100.64.4.0/22 gateway=204.110.191.185 +add distance=1 dst-address=100.64.12.0/22 gateway=204.110.191.185 +add distance=1 dst-address=172.63.0.0/20 gateway=204.110.191.253 +add distance=1 dst-address=204.110.188.0/22 gateway=204.110.191.181 +add distance=1 dst-address=204.110.188.0/27 gateway=204.110.191.253 +add distance=1 dst-address=204.110.188.32/27 gateway=204.110.191.185 +add distance=1 dst-address=204.110.188.32/27 gateway=204.110.191.185 +add distance=1 dst-address=204.110.188.224/27 gateway=204.110.191.185 +add distance=1 dst-address=204.110.191.0/27 gateway=204.110.191.185 +/ip service +set telnet disabled=yes +set ftp disabled=yes +set www address=204.110.188.0/22 port=2080 +set ssh address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10 port=1022 +set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10 +set api-ssl address=0.0.0.0/0 certificate=server +/ip ssh +set always-allow-password-login=yes forwarding-enabled=remote strong-crypto=\ + yes +/ipv6 address +add address=2605:6000:0:8::f:373/127 advertise=no interface=\ + sfp-sfpplus12-spectrum +add address=2606:1c80::1 interface=vlan9_sfpplus8 +add address=2606:1c80:0:10::254/128 advertise=no comment="edge loopback" \ + interface=loopback +add address=2606:1c80:0:11::1/127 advertise=no comment=\ + "P2P edge<->core direct (backup)" interface=sfp-sfpplus7-core-direct +add address=2606:1c80:0:1002::1/127 advertise=no comment=\ + "P2P edge<->core via preseem (primary)" interface=sfp-sfpplus11-preseem +/ipv6 firewall address-list +add address=2606:1c80::/32 list=bgp-networks +/ipv6 firewall filter +add action=accept chain=input comment="IPv6 BGP Input" dst-port=179 protocol=\ + tcp +add action=accept chain=output comment="IPv6 BGP Output" protocol=tcp \ + src-port=179 +add action=accept chain=forward comment="IPv6 BGP Forward" dst-port=179 \ + protocol=tcp +add action=accept chain=forward comment="IPv6 BGP Forward Reply" protocol=tcp \ + src-port=179 +add action=accept chain=input comment="IPv6 Established Input" \ + connection-state=established,related +add action=accept chain=forward comment="IPv6 Established Forward" \ + connection-state=established,related +add action=accept chain=input comment="icmpv6 input" protocol=icmpv6 +add action=accept chain=input comment="link-local input" src-address=\ + fe80::/10 +add action=accept chain=input comment="internal input" src-address=\ + 2606:1c80::/32 +add action=accept chain=forward comment="PMTUD forward" hop-limit=equal:1 \ + protocol=icmpv6 +add action=accept chain=forward comment="icmpv6 forward" protocol=icmpv6 +add action=accept chain=forward comment=internal<->internal dst-address=\ + 2606:1c80::/32 src-address=2606:1c80::/32 +/ipv6 route +add comment="infra: via preseem (primary)" distance=1 dst-address=\ + 2606:1c80::/48 gateway=2606:1c80:0:1002::2 +add comment="infra: via direct (backup)" distance=2 dst-address=\ + 2606:1c80::/48 gateway=2606:1c80:0:11::2 +/mpls interface +set [ find default=yes ] mpls-mtu=1530 +add interface=sfp-sfpplus8-server-switch mpls-mtu=1530 +/mpls ldp +set distribute-for-default-route=yes enabled=yes loop-detect=yes lsr-id=\ + 10.254.254.254 transport-address=10.254.254.254 +/mpls ldp accept-filter +add +/mpls ldp advertise-filter +add +/mpls ldp interface +add disabled=yes interface=ether1 +add disabled=yes interface=sfp-sfpplus11-preseem transport-address=\ + 10.254.254.254 +add disabled=yes interface=vlan9_sfpplus8 transport-address=10.254.254.254 +add interface=sfp-sfpplus8-server-switch +/routing bfd interface +set [ find default=yes ] disabled=yes +add interface=sfp-sfpplus7-core-direct +add interface=sfp-sfpplus11-preseem +/routing bgp network +add network=204.110.188.0/22 synchronize=no +add network=2606:1c80::/32 synchronize=no +/routing bgp peer +add in-filter=twc-in name=twc out-filter=twc-out remote-address=71.41.226.117 \ + remote-as=11427 ttl=default +add address-families=ipv6 in-filter=twc-in name=twc-v6 out-filter=twc-out \ + remote-address=2605:6000:0:8::f:372 remote-as=11427 ttl=default +add comment="TEAM-CYMRU BOGON Server #1" disabled=yes in-filter=\ + BOGON-SERVER-IN max-prefix-limit=50 multihop=yes name=CYMRU-1 out-filter=\ + BGP-DROP remote-address=38.229.6.20 remote-as=65332 tcp-md5-key=\ + mC9LaaOi0P +add comment="TEAM-CYMRU BOGON Server #2" disabled=yes in-filter=\ + BOGON-SERVER-IN max-prefix-limit=50 multihop=yes name=CYMRU-1 out-filter=\ + BGP-DROP remote-address=38.229.46.20 remote-as=65332 tcp-md5-key=\ + mC9LaaOi0P +add address-families=ip,ipv6 default-originate=always disabled=yes name=\ + edge_core_preseem nexthop-choice=propagate out-filter=bgp-default-only \ + remote-address=204.110.191.185 remote-as=393837 +add address-families=ipv6 comment="iBGP to verona, v4 transport / v6 NLRI" \ + default-originate=always in-filter=ibgp-tower-in-v6 name=ibgp-verona-v6 \ + nexthop-choice=force-self out-filter=ibgp-tower-out-v6 remote-address=\ + 10.254.254.101 remote-as=393837 update-source=loopback +/routing filter +add action=accept chain=twc-out comment=blackhole disabled=yes prefix=\ + 204.110.188.197 prefix-length=32 set-bgp-communities=7486:666 +add action=accept chain=twc-in prefix=0.0.0.0/0 +add action=accept chain=twc-in prefix=0.0.0.0/0 prefix-length=0 +add action=discard chain=twc-in disabled=yes prefix=0.0.0.0 prefix-length=\ + 0-32 protocol="" +add action=accept chain=twc-out prefix=204.110.188.0/22 +add action=accept chain=twc-out prefix=2606:1c80::/32 +add action=discard chain=twc-out +add action=discard chain=BGP-DROP +add action=accept bgp-communities=65333:888 chain=BOGON-SERVER-IN disabled=\ + yes set-type=blackhole +add action=discard chain=BOGON-SERVER-IN disabled=yes +add action=discard chain=BGP-DROP +add action=accept chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \ + prefix-length=0 +add action=discard chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \ + prefix-length=0-32 +add action=accept chain=ibgp-tower-in-v6 comment=\ + "tower /44 customer aggregate" prefix=2606:1c80:1000::/36 prefix-length=\ + 44 +add action=accept chain=ibgp-tower-in-v6 comment="tower v6 loopback" prefix=\ + 2606:1c80:0:10::/64 prefix-length=128 +add action=discard chain=ibgp-tower-in-v6 comment="default deny" +add action=accept chain=ibgp-tower-out-v6 comment="default route to tower" \ + prefix=::/0 prefix-length=0 +add action=discard chain=ibgp-tower-out-v6 comment="default deny" +/routing ospf interface +add interface=sfp-sfpplus12-spectrum network-type=broadcast passive=yes +add interface=sfp-sfpplus11-preseem network-type=point-to-point use-bfd=yes +add cost=20 interface=sfp-sfpplus9 network-type=nbma use-bfd=yes +add interface=sfp-sfpplus10 network-type=nbma passive=yes +add cost=20 interface=ether1 network-type=broadcast +add interface=sfp-sfpplus8-server-switch network-type=broadcast +add cost=100 interface=sfp-sfpplus7-core-direct network-type=point-to-point \ + use-bfd=yes +add interface=vlan9_sfpplus8 network-type=nbma +/routing ospf nbma-neighbor +add address=204.110.191.189 poll-interval=10s +add address=10.250.1.94 +add address=10.250.1.57 +add address=10.250.1.201 +add address=10.250.2.1 +add address=204.110.191.185 poll-interval=10s +add address=204.110.191.252 poll-interval=10s +/routing ospf network +add area=backbone +/routing rip +set distribute-default=always redistribute-connected=yes redistribute-ospf=\ + yes +/routing rip interface +add interface=sfp-sfpplus11-preseem +add interface=sfp-sfpplus7-core-direct +add interface=sfp-sfpplus8-server-switch +/routing rip network +add +/snmp +set contact="Verona Networks" enabled=yes location="Verona Networks" +/system clock +set time-zone-name=America/Chicago +/system identity +set name=edge +/system logging +add action=logs topics=info +/system note +set note="__ __\ + \n\\ \\ / /__ _ __ ___ _ __ __ _\ + \n \\ \\ / / _ \\ '__/ _ \\| '_ \\ / _` |\ + \n \\ V / __/ | | (_) | | | | (_| |\ + \n \\_/ \\___|_| \\___/|_| |_|\\__,_|\ + \n _ _ _ _\ + \n| \\ | | ___| |___ _____ _ __| | _____\ + \n| \\| |/ _ \\ __\\ \\ /\\ / / _ \\| '__| |/ / __|\ + \n| |\\ | __/ |_ \\ V V / (_) | | | <\\__ \\\ + \n|_| \\_|\\___|\\__| \\_/\\_/ \\___/|_| |_|\\_\\___/\ + \n\ + \n###############################################################\ + \n# Welcome to Verona Networks #\ + \n# All connections are monitored and recorded #\ + \n# Disconnect IMMEDIATELY if you are not an authorized user! #\ + \n###############################################################\ + \n\ + \n" show-at-login=no +/system ntp client +set enabled=yes primary-ntp=162.159.200.1 secondary-ntp=45.79.1.70 +/system routerboard settings +set auto-upgrade=yes +/system scheduler +add name=reboot on-event="/system reboot\r\ + \n" policy=\ + ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \ + start-date=jun/14/2023 start-time=03:00:00 +add comment=RWB_IP_RESOLVER interval=5m name=RWB_IP_RESOLVER on-event=\ + RWB_IP_RESOLVER policy=\ + ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \ + start-date=oct/13/2022 start-time=22:59:02 +/tool graphing interface +add allow-address=204.110.188.0/22 +/tool graphing queue +add allow-address=204.110.188.0/22 +/tool graphing resource +add allow-address=204.110.188.0/22 +/tool romon +set enabled=yes +/user aaa +set default-group=full diff --git a/mikrotik-tool/edge.rsc b/mikrotik-tool/edge.rsc index 75f503b..3da967d 100644 --- a/mikrotik-tool/edge.rsc +++ b/mikrotik-tool/edge.rsc @@ -1,4 +1,4 @@ -# may/09/2026 09:37:53 by RouterOS 6.49.18 +# may/09/2026 11:21:08 by RouterOS 6.49.18 # software id = 8XZE-R7EJ # # model = CCR2004-1G-12S+2XS @@ -40,7 +40,8 @@ add burst-limit=1/1 burst-threshold=1/1 burst-time=1s/1s disabled=yes \ limit-at=1/1 max-limit=1/1 name=Inactive packet-marks=Inactive priority=\ 2/2 target="" /routing bgp instance -set default as=393837 out-filter=twc-out router-id=204.110.191.190 +set default as=393837 cluster-id=10.254.254.254 out-filter=twc-out router-id=\ + 204.110.191.190 /routing ospf instance set [ find default=yes ] distribute-default=always-as-type-1 router-id=\ 10.254.254.254 @@ -51,8 +52,7 @@ set [ find default=yes ] distribute-default=always-as-type-1 \ set [ find default=yes ] name=onehuargd4a8974y79a497yi add addresses=204.110.188.0/22,10.0.0.0/8 name=kdyyJrT0Mm /system logging action -add name=logs remote=204.110.191.229 remote-port=1514 src-address=\ - 10.254.254.254 target=remote +add name=logs remote=204.110.191.229 src-address=10.254.254.254 target=remote /user group set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\ sword,web,sniff,sensitive,api,romon,dude,tikapp" @@ -534,9 +534,9 @@ add address=2605:6000:0:8::f:373/127 advertise=no interface=\ add address=2606:1c80::1 interface=vlan9_sfpplus8 add address=2606:1c80:0:10::254/128 advertise=no comment="edge loopback" \ interface=loopback -add address=2606:1c80:0:11::1/127 advertise=no comment=\ +add address=2606:1c80:0:11::1 advertise=no comment=\ "P2P edge<->core direct (backup)" interface=sfp-sfpplus7-core-direct -add address=2606:1c80:0:1002::1/127 advertise=no comment=\ +add address=2606:1c80:0:1002::1 advertise=no comment=\ "P2P edge<->core via preseem (primary)" interface=sfp-sfpplus11-preseem /ipv6 firewall address-list add address=2606:1c80::/32 list=bgp-networks @@ -564,6 +564,8 @@ add action=accept chain=forward comment="icmpv6 forward" protocol=icmpv6 add action=accept chain=forward comment=internal<->internal dst-address=\ 2606:1c80::/32 src-address=2606:1c80::/32 /ipv6 route +add comment="anchor for /32 BGP origination to TWC" distance=1 dst-address=\ + 2606:1c80::/32 type=unreachable add comment="infra: via preseem (primary)" distance=1 dst-address=\ 2606:1c80::/48 gateway=2606:1c80:0:1002::2 add comment="infra: via direct (backup)" distance=2 dst-address=\ @@ -607,10 +609,10 @@ add comment="TEAM-CYMRU BOGON Server #2" disabled=yes in-filter=\ add address-families=ip,ipv6 default-originate=always disabled=yes name=\ edge_core_preseem nexthop-choice=propagate out-filter=bgp-default-only \ remote-address=204.110.191.185 remote-as=393837 -add address-families=ipv6 comment="iBGP to verona, v4 transport / v6 NLRI" \ - default-originate=always in-filter=ibgp-tower-in-v6 name=ibgp-verona-v6 \ - nexthop-choice=force-self out-filter=ibgp-tower-out-v6 remote-address=\ - 10.254.254.101 remote-as=393837 update-source=loopback +add address-families=ipv6 default-originate=always in-filter=ibgp-rr-in \ + multihop=yes name=ibgp-rr-core nexthop-choice=force-self out-filter=\ + ibgp-rr-out remote-address=2606:1c80:0:10::253 remote-as=393837 \ + update-source=loopback /routing filter add action=accept chain=twc-out comment=blackhole disabled=yes prefix=\ 204.110.188.197 prefix-length=32 set-bgp-communities=7486:666 @@ -630,15 +632,13 @@ add action=accept chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \ prefix-length=0 add action=discard chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \ prefix-length=0-32 -add action=accept chain=ibgp-tower-in-v6 comment=\ - "tower /44 customer aggregate" prefix=2606:1c80:1000::/36 prefix-length=\ - 44 -add action=accept chain=ibgp-tower-in-v6 comment="tower v6 loopback" prefix=\ - 2606:1c80:0:10::/64 prefix-length=128 -add action=discard chain=ibgp-tower-in-v6 comment="default deny" -add action=accept chain=ibgp-tower-out-v6 comment="default route to tower" \ - prefix=::/0 prefix-length=0 -add action=discard chain=ibgp-tower-out-v6 comment="default deny" +add action=accept chain=ibgp-rr-in comment=\ + "any reflected infra/customer prefix" prefix=2606:1c80::/32 \ + prefix-length=44-128 +add action=discard chain=ibgp-rr-in comment="default deny" +add action=accept chain=ibgp-rr-out comment="default route to RR" prefix=::/0 \ + prefix-length=0 +add action=discard chain=ibgp-rr-out comment="default deny" /routing ospf interface add interface=sfp-sfpplus12-spectrum network-type=broadcast passive=yes add interface=sfp-sfpplus11-preseem network-type=point-to-point use-bfd=yes diff --git a/mikrotik-tool/home-v6-apply.rsc b/mikrotik-tool/home-v6-apply.rsc new file mode 100644 index 0000000..46adc74 --- /dev/null +++ b/mikrotik-tool/home-v6-apply.rsc @@ -0,0 +1,111 @@ +# ============================================================================= +# graham's home router — IPv6 apply (RB5009UG+S+, ROS 7.22.3) +# ============================================================================= +# +# This is graham's home — connects to verona via ether5-vntx-static carrying +# 204.110.191.0/27 (home .1, verona .30). Multi-WAN: TMO primary, VNTX +# secondary, Starlink last-resort. v6 transit goes via VNTX (only v6-aware +# upstream). +# +# Treated like a regular WISP customer: DHCPv6-PD from verona's customer +# pool. Verona delegates a /56 from `verona-cust-pd-1` (2606:1c80:1001::/48). +# Whatever /56 verona hands us is then split into two /64s for our internal +# LANs: +# * bridge — main home LAN (10.0.16/24, 10.0.19/22) +# * ether3-servers — servers LAN (10.0.15.254/21) +# Both addresses are derived from the local pool `home-pd` populated by the +# DHCPv6 client when the /56 is delegated. If verona reboots and the pool +# happens to give a different /56 next time, both LANs renumber together. +# ============================================================================= + +# ----------------------------------------------------------------------------- +# WIPE — clean prior v6 config (preserve auto-link-local + Starlink ULA) +# ----------------------------------------------------------------------------- +/ipv6 firewall filter remove [find] +/ipv6 nd remove [find !default] +/ipv6 nd prefix remove [find] +/ipv6 dhcp-server remove [find] +/ipv6 dhcp-server option remove [find] +/ipv6 dhcp-client remove [find] +/ipv6 pool remove [find name=home-pd] +/ipv6 route remove [find static=yes] +/ipv6 address remove [find !dynamic and !disabled] + +# ----------------------------------------------------------------------------- +# APPLY — settings +# ----------------------------------------------------------------------------- +# Forward must stay on; do NOT accept RAs as a router would. The dhcp-client +# below enables `add-default-route=yes` to install ::/0 from the server's +# advertisements specifically, separate from the global accept-RA toggle. +/ipv6 settings set forward=yes accept-router-advertisements=no + +# ----------------------------------------------------------------------------- +# APPLY — DHCPv6 client (request prefix delegation from verona) +# ----------------------------------------------------------------------------- +# Treats us as a wired customer: request=prefix asks for a /56, pool-name +# stores the delegation in a local pool we then assign /64s out of. +# add-default-route=yes installs ::/0 via verona's link-local on receipt. +/ipv6 dhcp-client +add interface=ether5-vntx-static request=prefix pool-name=home-pd pool-prefix-length=64 \ + add-default-route=yes default-route-distance=2 \ + use-peer-dns=yes \ + comment="DHCPv6-PD from verona on the wired customer link" + +# ----------------------------------------------------------------------------- +# APPLY — internal LAN addresses pulled from the delegated /56 +# ----------------------------------------------------------------------------- +# from-pool=home-pd grabs a /64 from the delegation; the `address=::1` part +# fills the host bits, so each LAN ends up at ::1. +# bridge gets ::1/64; ether3-servers gets the next /64 at +# ::1/64 — pool allocation is sequential, so /64s in the same /56 +# stay contiguous. +/ipv6 address +add address=::1 from-pool=home-pd interface=bridge advertise=yes comment="home main LAN" +add address=::1 from-pool=home-pd interface=ether3-servers advertise=yes comment="home servers LAN" + +# ----------------------------------------------------------------------------- +# APPLY — neighbour discovery on internal LANs (SLAAC + RDNSS for clients) +# ----------------------------------------------------------------------------- +/ipv6 nd +add interface=bridge ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes +add interface=ether3-servers ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes + +# Stateless DHCPv6 for DNS option (clients still get addresses from SLAAC) +/ipv6 dhcp-server +add interface=bridge name=home-bridge-stateless address-pool=static-only +add interface=ether3-servers name=home-servers-stateless address-pool=static-only + +/ipv6 dhcp-server option +add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" + +# ----------------------------------------------------------------------------- +# APPLY — firewall (mirror v4 hygiene; deny by default on input) +# ----------------------------------------------------------------------------- +/ipv6 firewall filter +add chain=input action=accept connection-state=established,related comment="established" +add chain=input action=drop connection-state=invalid comment="invalid" +add chain=input action=accept protocol=icmpv6 comment="icmpv6" +add chain=input action=accept src-address=fe80::/10 comment="link-local" +add chain=input action=accept src-address=2606:1c80::/32 comment="vntx internal" +add chain=input action=drop comment="default deny input" + +# Forward — let internal LANs reach the world; allow inbound established +# but don't accept arbitrary inbound to home hosts. +add chain=forward action=accept connection-state=established,related comment="established" +add chain=forward action=drop connection-state=invalid comment="invalid" +add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD" +add chain=forward action=accept protocol=icmpv6 comment="icmpv6" +add chain=forward action=accept in-interface=bridge comment="home outbound (bridge)" +add chain=forward action=accept in-interface=ether3-servers comment="home outbound (servers)" +add chain=forward action=drop comment="default deny forward" + +# ----------------------------------------------------------------------------- +# VERIFY (after apply) +# ----------------------------------------------------------------------------- +# /ipv6 dhcp-client print ;; should show status=bound and a /56 prefix +# /ipv6 pool print ;; should show home-pd populated +# /ipv6 address print ;; bridge + ether3-servers each have ::1/64 +# /ipv6 route print where active ;; ::/0 via fe80::xxxx of verona +# /ping 2606:1c80:0:10::101 count=3 ;; verona loopback +# /ping 2606:1c80:0:10::253 count=3 ;; core loopback +# /ping 2606:4700:4700::1111 count=3 ;; cloudflare (works once TWC v6 is solved) diff --git a/mikrotik-tool/home.rsc b/mikrotik-tool/home.rsc index 8d34305..ff179d9 100644 --- a/mikrotik-tool/home.rsc +++ b/mikrotik-tool/home.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:37:54 by RouterOS 7.22.3 +# 2026-05-09 11:21:08 by RouterOS 7.22.3 # software id = ZGNY-ZJW7 # # model = RB5009UG+S+ @@ -38,6 +38,8 @@ add name=dhcp_pool1 ranges=10.0.8.1-10.0.14.254 add add-arp=yes address-pool=home bootp-lease-time=lease-time bootp-support=\ dynamic interface=bridge lease-time=8h name=server1 add address-pool=dhcp_pool1 interface=ether3-servers name=servers +/ipv6 dhcp-server option +add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'" /ipv6 pool add name=tunnerbroker prefix=2001:470:ba50::/48 prefix-length=48 /port @@ -455,16 +457,44 @@ add disabled=yes interface=ether6-tmobile type=external add interface=*14 type=external add interface=bridge type=internal /ipv6 address -add address=2001:470:1f0e:299::2 advertise=no disabled=yes interface=*10 -add address=2001:470:ba50::/48 advertise=no disabled=yes interface=bridge -add address=2001:470:1f0f:29a:: disabled=yes interface=bridge +add address=::1 comment="home main LAN" from-pool=home-pd interface=bridge +add address=::1:0:0:0:1 comment="home servers LAN" from-pool=home-pd \ + interface=ether3-servers /ipv6 dhcp-client add disabled=yes interface=ether6-tmobile pool-name=tmo pool-prefix-length=64 \ request=address add interface=ether7-starlink pool-name=starlink pool-prefix-length=64 \ request=address,prefix +add add-default-route=yes comment="DHCPv6-PD from verona" \ + default-route-distance=2 interface=ether5-vntx-static pool-name=home-pd \ + pool-prefix-length=64 request=prefix +/ipv6 dhcp-server +add interface=bridge name=home-bridge-stateless +add interface=ether3-servers name=home-servers-stateless +/ipv6 firewall filter +add action=accept chain=input comment=established connection-state=\ + established,related +add action=drop chain=input comment=invalid connection-state=invalid +add action=accept chain=input comment=icmpv6 protocol=icmpv6 +add action=accept chain=input comment=link-local src-address=fe80::/10 +add action=accept chain=input comment="vntx internal" src-address=\ + 2606:1c80::/32 +add action=drop chain=input comment="default deny input" +add action=accept chain=forward comment=established connection-state=\ + established,related +add action=drop chain=forward comment=invalid connection-state=invalid +add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\ + icmpv6 +add action=accept chain=forward comment=icmpv6 protocol=icmpv6 +add action=accept chain=forward comment="home outbound (bridge)" \ + in-interface=bridge +add action=accept chain=forward comment="home outbound (servers)" \ + in-interface=ether3-servers +add action=drop chain=forward comment="default deny forward" /ipv6 nd set [ find default=yes ] advertise-dns=yes +add advertise-dns=yes interface=bridge other-configuration=yes +add advertise-dns=yes interface=ether3-servers other-configuration=yes /routing rule add action=lookup-only-in-table disabled=no dst-address=0.0.0.0/0 \ src-address=10.0.16.1 table=*400 diff --git a/mikrotik-tool/lowry-v6-apply.rsc b/mikrotik-tool/lowry-v6-apply.rsc new file mode 100644 index 0000000..1b16ba7 --- /dev/null +++ b/mikrotik-tool/lowry-v6-apply.rsc @@ -0,0 +1,117 @@ +# ============================================================================= +# lowry — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3) +# ============================================================================= +# +# Lowry is a leaf tower. Single backbone P2P: +# * newhope (north) — ether1-newhope, v6 P2P 2606:1c80:0:18::/64 (lowry .2) +# Default upstream toward newhope :18::1, which forwards to core. +# +# Loopback: 2606:1c80:0:10::109/128 +# /44 customer aggregate: 2606:1c80:1900::/44 +# Mgmt LAN: 2606:1c80:1900::1/64 (assumes `mgmt` bridge — verify name first). +# PPPoE profile assumed `pppoe`. Customer interface-list assumed `customer`. +# ============================================================================= + +# ----------------------------------------------------------------------------- +# WIPE +# ----------------------------------------------------------------------------- +/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool="" +/ipv6 dhcp-server remove [find] +/ipv6 dhcp-server option remove [find] +/ipv6 dhcp-client remove [find] +/ipv6 nd prefix remove [find] +/ipv6 nd remove [find !default] +/ipv6 pool remove [find] +/ipv6 route remove [find !dynamic] +/ipv6 firewall filter remove [find] +/ipv6 firewall mangle remove [find] +/ipv6 firewall raw remove [find] +/ipv6 address remove [find !dynamic] + +/routing ospf interface-template remove [find area=backbone-v3] +/routing ospf area remove [find name=backbone-v3] +/routing ospf instance remove [find name=default-v3] + +/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"] + +# ----------------------------------------------------------------------------- +# APPLY — BGP instance +# ----------------------------------------------------------------------------- +/routing bgp instance +add name=bgp-instance-1 as=393837 router-id=10.254.254.109 + +# ----------------------------------------------------------------------------- +# APPLY — addresses +# ----------------------------------------------------------------------------- +/ipv6 settings set forward=yes accept-router-advertisements=no + +/ipv6 address +add address=2606:1c80:0:10::109/128 interface=lo advertise=no comment="loopback" +add address=2606:1c80:0:18::2/64 interface=ether1-newhope advertise=no comment="P2P lowry<->newhope" +add address=2606:1c80:1900::1/64 interface=mgmt advertise=yes comment="lowry mgmt LAN" + +# ----------------------------------------------------------------------------- +# APPLY — static routes +# ----------------------------------------------------------------------------- +/ipv6 route +add dst-address=::/0 gateway=2606:1c80:0:18::1 distance=1 comment="default via newhope" +add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:18::1 distance=1 comment="core loopback (iBGP bootstrap, via newhope)" +add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:18::1 distance=1 comment="edge loopback (via newhope)" +add dst-address=2606:1c80:1900::/44 blackhole distance=200 comment="lowry /44 aggregate (iBGP origin)" + +# ----------------------------------------------------------------------------- +# APPLY — neighbour discovery on the mgmt LAN +# ----------------------------------------------------------------------------- +/ipv6 nd +add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes + +/ipv6 nd prefix +add interface=mgmt prefix=2606:1c80:1900::/64 autonomous=yes on-link=yes + +/ipv6 dhcp-server +add interface=mgmt name=lowry-mgmt-stateless address-pool=static-only + +/ipv6 dhcp-server option +add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" + +# ----------------------------------------------------------------------------- +# APPLY — customer PD pool + bind to PPPoE profile +# ----------------------------------------------------------------------------- +/ipv6 pool +add name=lowry-cust-pd-1 prefix=2606:1c80:1901::/48 prefix-length=56 + +/ppp profile +set [find name=pppoe] remote-ipv6-prefix-pool=lowry-cust-pd-1 dhcpv6-pd-pool=lowry-cust-pd-1 + +# ----------------------------------------------------------------------------- +# APPLY — firewall +# ----------------------------------------------------------------------------- +/ipv6 firewall filter +add chain=input action=accept connection-state=established,related comment="established" +add chain=input action=drop connection-state=invalid comment="invalid" +add chain=input action=accept protocol=icmpv6 comment="icmpv6" +add chain=input action=accept src-address=fe80::/10 comment="link-local" +add chain=input action=accept src-address=2606:1c80::/32 comment="internal" +add chain=input action=drop comment="default deny" + +add chain=forward action=accept connection-state=established,related comment="established" +add chain=forward action=drop connection-state=invalid comment="invalid" +add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD" +add chain=forward action=accept protocol=icmpv6 comment="icmpv6" +add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal" +add chain=forward action=accept src-address=2606:1c80:1900::/44 comment="v6 outbound from lowry customers" +add chain=forward action=drop comment="default deny" + +# ----------------------------------------------------------------------------- +# APPLY — iBGP to core (v6 RR) +# ----------------------------------------------------------------------------- +/routing filter rule +add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1900::/44 || dst==2606:1c80:0:10::109/128 || (dst-len==64 && dst==2606:1c80:0:18::/64)) { accept; } else { reject; }" + +/routing bgp connection +add name=ibgp-rr-core instance=bgp-instance-1 templates=default \ + afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::109 \ + remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \ + nexthop-choice=force-self output.filter-chain=v6-ibgp-out \ + output.redistribute=connected,static \ + comment="iBGP to core (v6 RR), v6 transport" diff --git a/mikrotik-tool/lowry.rsc b/mikrotik-tool/lowry.rsc index 954bcef..0943f47 100644 --- a/mikrotik-tool/lowry.rsc +++ b/mikrotik-tool/lowry.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:37:54 by RouterOS 7.21.4 +# 2026-05-09 11:21:08 by RouterOS 7.21.4 # software id = 2I9X-PQZP # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/main.go b/mikrotik-tool/main.go index f743759..2d6e64a 100644 --- a/mikrotik-tool/main.go +++ b/mikrotik-tool/main.go @@ -22,6 +22,7 @@ package main import ( "bytes" "crypto/tls" + "errors" "fmt" "log" "net" @@ -186,14 +187,13 @@ func sshAuthMethods(password string) []ssh.AuthMethod { return methods } -// runOverSSH opens an SSH connection to host:port, runs cmd non-interactively, -// and returns whatever the router wrote to stdout. -func runOverSSH(r Router, sshPort int, cmd string) ([]byte, error) { +// dialSSH opens an authenticated SSH connection. The KEX list is widened +// because some RouterOS boxes (notably edge) only offer +// diffie-hellman-group-exchange-sha256, which x/crypto/ssh doesn't enable +// by default. +func dialSSH(r Router, sshPort int) (*ssh.Client, error) { addr := net.JoinHostPort(r.Host, strconv.Itoa(sshPort)) - // Some RouterOS boxes (notably the edge router) only offer - // diffie-hellman-group-exchange-sha256 for KEX, which x/crypto/ssh keeps - // out of its defaults. Opt back in by appending it to the supported list. algos := ssh.SupportedAlgorithms() kex := append(algos.KeyExchanges, ssh.KeyExchangeDHGEXSHA256) @@ -217,6 +217,16 @@ func runOverSSH(r Router, sshPort int, cmd string) ([]byte, error) { } return nil, fmt.Errorf("ssh dial %s: %w", addr, err) } + return client, nil +} + +// runOverSSH opens an SSH connection to host:port, runs cmd non-interactively, +// and returns whatever the router wrote to stdout. +func runOverSSH(r Router, sshPort int, cmd string) ([]byte, error) { + client, err := dialSSH(r, sshPort) + if err != nil { + return nil, err + } defer client.Close() session, err := client.NewSession() @@ -235,6 +245,51 @@ func runOverSSH(r Router, sshPort int, cmd string) ([]byte, error) { return stdout.Bytes(), nil } +// runScriptOverSSH pipes a multi-line .rsc script through an SSH session as +// if the user had typed it. Each line is parsed by RouterOS's CLI, exactly +// like /import does — section paths persist across lines, errors print but +// don't abort the rest of the script. A trailing "/quit\n" is appended so +// the shell exits cleanly when the file ends. +func runScriptOverSSH(r Router, sshPort int, script []byte) ([]byte, error) { + client, err := dialSSH(r, sshPort) + if err != nil { + return nil, err + } + defer client.Close() + + session, err := client.NewSession() + if err != nil { + return nil, fmt.Errorf("ssh session: %w", err) + } + defer session.Close() + + var stdout, stderr bytes.Buffer + session.Stdout = &stdout + session.Stderr = &stderr + + body := append([]byte{}, script...) + if len(body) == 0 || body[len(body)-1] != '\n' { + body = append(body, '\n') + } + body = append(body, []byte("/quit\n")...) + session.Stdin = bytes.NewReader(body) + + if err := session.Shell(); err != nil { + return nil, fmt.Errorf("ssh shell: %w", err) + } + + if err := session.Wait(); err != nil { + // Wait returns *ssh.ExitMissingError if the server didn't send an + // exit status — common for ROS shells that close the channel + // without one. Treat as success if we got output. + var exitMissing *ssh.ExitMissingError + if !errors.As(err, &exitMissing) { + return stdout.Bytes(), fmt.Errorf("ssh wait: %w (stderr: %s)", err, stderr.String()) + } + } + return stdout.Bytes(), nil +} + // exportRouter logs in over the API to discover the SSH port, then SSHes in // and runs "/export", writing stdout to .rsc locally. func exportRouter(cfg *Config, r Router) error { @@ -452,6 +507,47 @@ func runSchema(cfg *Config, routerName, path string) { } } +// runScript pushes a local .rsc file to one router and runs it line-by-line +// over SSH. Same login flow as `export` (API → discover SSH port → SSH). +// The file is fed to the RouterOS shell exactly as if the user pasted it +// in WinBox/SSH; section paths persist across lines, comments are ignored +// by RouterOS, and an error on one line doesn't abort the rest. +func runScript(cfg *Config, routerName, scriptPath string) { + target := findRouter(cfg, routerName) + if target == nil { + log.Fatalf("no router named %q in config", routerName) + } + r := cfg.resolve(*target) + + body, err := os.ReadFile(scriptPath) + if err != nil { + log.Fatalf("read %s: %v", scriptPath, err) + } + + log.Printf("[%s] api %s@%s:%d (look up ssh port)", r.Name, r.Username, r.Host, r.Port) + api, err := dialAPI(r) + if err != nil { + log.Fatalf("[%s] %v", r.Name, err) + } + sshPort, err := lookupSSHPort(api) + api.Close() + if err != nil { + log.Fatalf("[%s] %v", r.Name, err) + } + + log.Printf("[%s] ssh %s:%d running %s (%d bytes)", r.Name, r.Host, sshPort, scriptPath, len(body)) + out, err := runScriptOverSSH(r, sshPort, body) + if len(out) > 0 { + os.Stdout.Write(out) + if !bytes.HasSuffix(out, []byte("\n")) { + fmt.Println() + } + } + if err != nil { + log.Fatalf("[%s] %v", r.Name, err) + } +} + func runList(cfg *Config) { for _, r := range cfg.Routers { r2 := cfg.resolve(r) diff --git a/mikrotik-tool/netbox_v6_sync.py b/mikrotik-tool/netbox_v6_sync.py index fb5b335..e7f6f1c 100644 --- a/mikrotik-tool/netbox_v6_sync.py +++ b/mikrotik-tool/netbox_v6_sync.py @@ -126,6 +126,40 @@ def find_interface_id(device_name, interface_name): return data["results"][0]["id"] +def ensure_interface(device_name, interface_name): + """Get or create a NetBox interface for this device. Picks a sensible + type based on the interface name pattern. Returns the interface id.""" + iface_id = find_interface_id(device_name, interface_name) + if iface_id is not None: + return iface_id + device_id = find_device_id(device_name) + if device_id is None: + return None + # Pick type from name + nm = interface_name.lower() + if nm == "lo" or nm == "loopback" or nm.startswith("vlan") \ + or nm in ("verona", "mgmt") or nm.endswith("-bridge"): + if_type = "virtual" + elif nm.startswith("sfp"): + if_type = "10gbase-x-sfpp" + else: + if_type = "1000base-t" + payload = { + "device": device_id, + "name": interface_name, + "type": if_type, + "description": f"auto-created by netbox_v6_sync.py", + } + if DRY_RUN: + print(f" would CREATE iface {interface_name} ({if_type})") + return None + code, body = nb("POST", "/dcim/interfaces/", payload) + if code >= 400: + print(f" iface CREATE failed: {code} {body}") + return None + return body["id"] + + def find_device_id(device_name): code, data = nb("GET", f"/dcim/devices/?name={device_name}") if code != 200 or not data["results"]: @@ -140,11 +174,9 @@ def upsert_ip(address, device_name, interface_name, description): code, data = nb("GET", f"/ipam/ip-addresses/?address={address}") if code != 200: return f"GET failed: {code}" - iface_id = find_interface_id(device_name, interface_name) + iface_id = ensure_interface(device_name, interface_name) if iface_id is None: - # Try to find the interface even if the device has no interface entry - # for it (sometimes NetBox doesn't have all interfaces declared) - return f"interface {device_name}:{interface_name} not in NetBox — skipped" + return f"interface {device_name}:{interface_name} could not be created" payload = { "address": address, "status": "active", diff --git a/mikrotik-tool/newhope-v6-apply.rsc b/mikrotik-tool/newhope-v6-apply.rsc new file mode 100644 index 0000000..18299b3 --- /dev/null +++ b/mikrotik-tool/newhope-v6-apply.rsc @@ -0,0 +1,132 @@ +# ============================================================================= +# newhope — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3) +# ============================================================================= +# +# Newhope is a relay tower. P2Ps: +# * core (north) — ether2-380, v6 P2P 2606:1c80:0:13::/64 (newhope .2) +# * lowry (south) — ether6-lowrycrossing, v6 P2P 2606:1c80:0:18::/64 (newhope .1) +# Default upstream toward core via :13::1. +# Lowry's loopback :10::109 is reachable through the :18::/64 link (lowry +# is dual-homed only via newhope today). +# +# Loopback: 2606:1c80:0:10::108/128 +# /44 customer aggregate: 2606:1c80:1800::/44 +# Mgmt LAN: 2606:1c80:1800::1/64 — assumes a `mgmt` bridge (verify with +# /interface/print before applying). +# PPPoE profile assumed `pppoe`. Customer interface-list assumed `customer`. +# ============================================================================= + +# ----------------------------------------------------------------------------- +# WIPE — drop OSPFv3 + stale internal v6 +# ----------------------------------------------------------------------------- +/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool="" +/ipv6 dhcp-server remove [find] +/ipv6 dhcp-server option remove [find] +/ipv6 dhcp-client remove [find] +/ipv6 nd prefix remove [find] +/ipv6 nd remove [find !default] +/ipv6 pool remove [find] +/ipv6 route remove [find !dynamic] +/ipv6 firewall filter remove [find] +/ipv6 firewall mangle remove [find] +/ipv6 firewall raw remove [find] +/ipv6 address remove [find !dynamic] + +/routing ospf interface-template remove [find area=backbone-v3] +/routing ospf area remove [find name=backbone-v3] +/routing ospf instance remove [find name=default-v3] + +/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"] + +# ----------------------------------------------------------------------------- +# APPLY — BGP instance +# ----------------------------------------------------------------------------- +/routing bgp instance +add name=bgp-instance-1 as=393837 router-id=10.254.254.108 + +# ----------------------------------------------------------------------------- +# APPLY — addresses +# ----------------------------------------------------------------------------- +/ipv6 settings set forward=yes accept-router-advertisements=no + +/ipv6 address +add address=2606:1c80:0:10::108/128 interface=lo advertise=no comment="loopback" +add address=2606:1c80:0:13::2/64 interface=ether2-380 advertise=no comment="P2P newhope<->core" +add address=2606:1c80:0:18::1/64 interface=ether6-lowrycrossing advertise=no comment="P2P newhope<->lowry" +add address=2606:1c80:1800::1/64 interface=mgmt advertise=yes comment="newhope mgmt LAN" + +# ----------------------------------------------------------------------------- +# APPLY — static routes +# ----------------------------------------------------------------------------- +/ipv6 route +add dst-address=::/0 gateway=2606:1c80:0:13::1 distance=1 comment="default via core" +add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:13::1 distance=1 comment="core loopback (iBGP bootstrap)" +add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:13::1 distance=1 comment="edge loopback via core" +add dst-address=2606:1c80:1800::/44 blackhole distance=200 comment="newhope /44 aggregate (iBGP origin)" + +# ----------------------------------------------------------------------------- +# APPLY — neighbour discovery on the mgmt LAN +# ----------------------------------------------------------------------------- +/ipv6 nd +add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes + +/ipv6 nd prefix +add interface=mgmt prefix=2606:1c80:1800::/64 autonomous=yes on-link=yes + +/ipv6 dhcp-server +add interface=mgmt name=newhope-mgmt-stateless address-pool=static-only + +/ipv6 dhcp-server option +add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" + +# ----------------------------------------------------------------------------- +# APPLY — customer PD pool + bind to PPPoE profile +# ----------------------------------------------------------------------------- +/ipv6 pool +add name=newhope-cust-pd-1 prefix=2606:1c80:1801::/48 prefix-length=56 + +/ppp profile +set [find name=pppoe] remote-ipv6-prefix-pool=newhope-cust-pd-1 dhcpv6-pd-pool=newhope-cust-pd-1 + +# ----------------------------------------------------------------------------- +# APPLY — firewall +# ----------------------------------------------------------------------------- +/ipv6 firewall filter +add chain=input action=accept connection-state=established,related comment="established" +add chain=input action=drop connection-state=invalid comment="invalid" +add chain=input action=accept protocol=icmpv6 comment="icmpv6" +add chain=input action=accept src-address=fe80::/10 comment="link-local" +add chain=input action=accept src-address=2606:1c80::/32 comment="internal" +add chain=input action=drop comment="default deny" + +add chain=forward action=accept connection-state=established,related comment="established" +add chain=forward action=drop connection-state=invalid comment="invalid" +add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD" +add chain=forward action=accept protocol=icmpv6 comment="icmpv6" +add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal" +add chain=forward action=accept src-address=2606:1c80:1800::/44 comment="v6 outbound from newhope customers" +add chain=forward action=accept src-address=2606:1c80:1900::/44 comment="v6 outbound from lowry customers (transit)" +add chain=forward action=drop comment="default deny" + +# ----------------------------------------------------------------------------- +# APPLY — iBGP to core (v6 RR) +# ----------------------------------------------------------------------------- +/routing filter rule +add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1800::/44 || dst==2606:1c80:0:10::108/128 || (dst-len==64 && (dst==2606:1c80:0:13::/64 || dst==2606:1c80:0:18::/64))) { accept; } else { reject; }" + +/routing bgp connection +add name=ibgp-rr-core instance=bgp-instance-1 templates=default \ + afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::108 \ + remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \ + nexthop-choice=force-self output.filter-chain=v6-ibgp-out \ + output.redistribute=connected,static \ + comment="iBGP to core (v6 RR), v6 transport" + +# ----------------------------------------------------------------------------- +# VERIFY +# ----------------------------------------------------------------------------- +# /ipv6 address print +# /ipv6 route print where active +# /routing bgp session print +# /ping 2606:1c80:0:10::253 count=3 ;; core +# /ping 2606:1c80:0:10::109 count=3 ;; lowry (after lowry applies) diff --git a/mikrotik-tool/newhope.rsc b/mikrotik-tool/newhope.rsc index b90d68a..b173d41 100644 --- a/mikrotik-tool/newhope.rsc +++ b/mikrotik-tool/newhope.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:37:54 by RouterOS 7.21.4 +# 2026-05-09 11:21:08 by RouterOS 7.21.4 # software id = 5HTF-YFWV # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/verona-v6-apply.rsc b/mikrotik-tool/verona-v6-apply.rsc index cfe19fc..c8ef357 100644 --- a/mikrotik-tool/verona-v6-apply.rsc +++ b/mikrotik-tool/verona-v6-apply.rsc @@ -51,6 +51,7 @@ /ipv6 address add address=2606:1c80:0:10::101/128 interface=lo advertise=no comment="loopback" add address=2606:1c80:0:20::1/64 interface=ether3-climax-11ghz advertise=no comment="P2P verona<->climax" +add address=2606:1c80:0:30::1/64 interface=vlan9_sfpplus1 advertise=no comment="P2P verona<->graham home" add address=2606:1c80:1000::1/64 interface=verona advertise=yes comment="verona mgmt LAN" add address=2606:1c80:1500::1/64 interface=ether6-switch advertise=yes comment="altoga mgmt LAN" @@ -82,6 +83,20 @@ add interface=ether6-switch prefix=2606:1c80:1500::/64 autonomous=yes on-link=ye add interface=verona name=verona-mgmt-stateless address-pool=static-only add interface=ether6-switch name=altoga-mgmt-stateless address-pool=static-only +# DHCPv6 PD server on vlan9_sfpplus1 — graham's home router connects there +# and is treated like a regular customer: it requests prefix delegation, +# receives a /56 from verona-cust-pd-1, and the dynamic route to that /56 +# is created automatically with gateway=client-link-local. +add interface=vlan9_sfpplus1 name=verona-wired-pd address-pool=static-only prefix-pool=verona-cust-pd-1 + +# RA on vlan9_sfpplus1 advertises the link /64 + DNS option so the home +# router learns the default route via verona's link-local automatically. +/ipv6 nd +add interface=vlan9_sfpplus1 ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes + +/ipv6 nd prefix +add interface=vlan9_sfpplus1 prefix=2606:1c80:0:30::/64 autonomous=no on-link=yes + /ipv6 dhcp-server option add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" @@ -122,19 +137,29 @@ add chain=forward action=drop # - parameter is `afi=ip,ipv6` NOT `address-families=...` # - need a `/routing bgp instance` to reference (carries the local AS) # - `templates=default` ties it to the existing /routing/bgp/template -# Output filter: only advertise verona+altoga /44 aggregates over this session. +# Output filter: advertise verona's own routes — verona+altoga /44 customer +# aggregates, verona loopback /128, and connected /64 P2Ps to climax (:20) +# and graham's home (:30). Core (the v6 RR) reflects these to every other +# client. Anything else is rejected so we don't leak customer LANs etc. /routing filter rule -add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1000::/44 || dst==2606:1c80:1500::/44) { accept; } else { reject; }" +add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1000::/44 || dst==2606:1c80:1500::/44 || dst==2606:1c80:0:10::101/128 || (dst-len==64 && (dst==2606:1c80:0:20::/64 || dst==2606:1c80:0:30::/64))) { accept; } else { reject; }" /routing bgp instance add name=bgp-instance-1 as=393837 router-id=10.254.254.101 +# Single iBGP session to CORE (which is the v6 route reflector for the fleet). +# v6 transport (loopback-to-loopback) — sidesteps the v4-mapped-next-hop bug +# we saw with v4 transport carrying v6 NLRI. +# output.redistribute=connected,static picks up the loopback /128 (connected) +# and the customer /44 blackhole aggregates (static); the filter chain narrows +# to just those three prefixes. /routing bgp connection -add name=ibgp-edge-v6 instance=bgp-instance-1 templates=default \ - afi=ip,ipv6 local.role=ibgp local.address=10.254.254.101 \ - remote.address=10.254.254.254 remote.as=393837 multihop=yes \ +add name=ibgp-rr-core instance=bgp-instance-1 templates=default \ + afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::101 \ + remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \ nexthop-choice=force-self output.filter-chain=v6-ibgp-out \ - comment="iBGP to edge, v4 transport / v6 NLRI" + output.redistribute=connected,static \ + comment="iBGP to core (v6 RR), v6 transport" # ----------------------------------------------------------------------------- # VERIFY — paste these after the apply diff --git a/mikrotik-tool/verona.rsc b/mikrotik-tool/verona.rsc index c4fa974..55eb5a2 100644 --- a/mikrotik-tool/verona.rsc +++ b/mikrotik-tool/verona.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:37:54 by RouterOS 7.21.4 +# 2026-05-09 11:21:08 by RouterOS 7.21.4 # software id = Y1CT-1WB1 # # model = CCR2004-16G-2S+ @@ -174,6 +174,12 @@ add address-pool=verona-cgnat addresses-per-mac=unlimited interface=verona \ name=hotspot1 profile=hsprof1 /ip smb users set [ find default=yes ] disabled=yes +/ipv6 dhcp-server +add address-pool=verona-cust-pd-1 interface=verona name=verona-cust-pd-server +add address-pool=altoga-cust-pd-1 interface=ether6-switch name=\ + altoga-cust-pd-server +add interface=vlan9_sfpplus1 name=verona-wired-pd prefix-pool=\ + verona-cust-pd-1 /ipv6 dhcp-server option add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'" /ipv6 pool @@ -441,8 +447,7 @@ set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\ kdyyJrT0Mm /system logging action set 3 remote=204.110.191.208 src-address=10.254.254.101 -add name=logs remote=204.110.191.229 remote-port=1514 src-address=\ - 10.254.254.101 target=remote +add name=logs remote=204.110.191.229 src-address=10.254.254.101 target=remote /interface bridge port add bridge=verona ingress-filtering=no interface=ether6-switch \ internal-path-cost=10 path-cost=10 @@ -903,12 +908,12 @@ add disabled=no dst-address=10.0.16.84/32 gateway=204.110.188.225 /ipv6 route add comment="default via climax P2P" distance=1 dst-address=::/0 gateway=\ 2606:1c80:0:20::2 -add comment="edge loopback (iBGP target reachability fallback)" distance=1 \ - dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:20::2 add blackhole comment="verona /44 aggregate (iBGP origin)" distance=200 \ dst-address=2606:1c80:1000::/44 add blackhole comment="altoga /44 aggregate (iBGP origin)" distance=200 \ dst-address=2606:1c80:1500::/44 +add comment="core loopback via climax" dst-address=2606:1c80:0:10::253/128 \ + gateway=2606:1c80:0:20::2 /ip service set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes @@ -928,9 +933,8 @@ add address=2606:1c80:0:20::1 advertise=no comment="P2P verona<->climax" \ add address=2606:1c80:1000::1 comment="verona mgmt LAN" interface=verona add address=2606:1c80:1500::1 comment="altoga mgmt LAN" interface=\ ether6-switch -/ipv6 dhcp-server -add interface=verona name=verona-mgmt-stateless -add interface=ether6-switch name=altoga-mgmt-stateless +add address=2606:1c80:0:30::1 advertise=no comment="P2P verona<->graham home" \ + interface=vlan9_sfpplus1 /ipv6 firewall filter add action=accept chain=input comment=established connection-state=\ established,related @@ -953,8 +957,10 @@ set [ find default=yes ] advertise-dns=yes add advertise-dns=yes interface=verona managed-address-configuration=yes \ other-configuration=yes add advertise-dns=yes interface=ether6-switch other-configuration=yes +add advertise-dns=yes interface=vlan9_sfpplus1 other-configuration=yes /ipv6 nd prefix add interface=ether6-switch prefix=2606:1c80:1500::/64 +add autonomous=no interface=vlan9_sfpplus1 prefix=2606:1c80:0:30::/64 /mpls interface add interface=ether3-climax-11ghz mpls-mtu=1508 /mpls ldp @@ -977,15 +983,18 @@ set accept=yes /routing bfd configuration add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5 /routing bgp connection -add afi=ip,ipv6 comment="iBGP to edge, v4 transport / v6 NLRI" instance=\ - bgp-instance-1 local.address=10.254.254.101 .role=ibgp multihop=yes name=\ - ibgp-edge-v6 nexthop-choice=force-self output.filter-chain=v6-ibgp-out \ - remote.address=10.254.254.254 .as=393837 templates=default +add afi=ip,ipv6 as=393837 comment="iBGP to core (v6 RR), v6 transport" \ + instance=bgp-instance-1 local.address=2606:1c80:0:10::101 .role=ibgp \ + multihop=yes name=ibgp-rr-core nexthop-choice=force-self \ + output.filter-chain=v6-ibgp-out .redistribute=connected,static \ + remote.address=2606:1c80:0:10::253 .as=393837 templates=default /routing filter rule add chain=ospf-in disabled=no rule="accept;" add chain=ospf-out disabled=no rule="accept;" add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1000::/44 || dst==2\ - 606:1c80:1500::/44) { accept; } else { reject; }" + 606:1c80:1500::/44 || dst==2606:1c80:0:10::101/128 || (dst-len==64 && (dst\ + ==2606:1c80:0:20::/64 || dst==2606:1c80:0:30::/64))) { accept; } else { re\ + ject; }" /routing ospf interface-template add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\ ether3-climax-11ghz priority=1 type=ptp use-bfd=no @@ -1003,6 +1012,7 @@ set name=Verona add action=remote topics=info add disabled=yes topics=ospf add action=disk prefix=gtemp topics=firewall +add action=logs topics=info /system note set show-at-login=no /system ntp client