routers update
This commit is contained in:
parent
7f915408d2
commit
fdba19899f
21 changed files with 10 additions and 2254 deletions
|
|
@ -1,119 +0,0 @@
|
|||
# =============================================================================
|
||||
# 494 — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
|
||||
# =============================================================================
|
||||
#
|
||||
# 494 is a leaf tower. Single backbone P2P:
|
||||
# * climax (north) — ether2-climax (AF11), v6 P2P 2606:1c80:0:17::/64 (494 .2)
|
||||
# Default upstream toward climax via :17::1 — climax forwards to core.
|
||||
#
|
||||
# Loopback: 2606:1c80:0:10::111/128
|
||||
# /44 customer aggregate: 2606:1c80:1A00::/44
|
||||
# Mgmt LAN: 2606:1c80:1A00::1/64 (assumes `mgmt` bridge — verify name first).
|
||||
# PPPoE profile assumed `pppoe`. Customer interface-list assumed `customer`.
|
||||
# =============================================================================
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# WIPE
|
||||
# -----------------------------------------------------------------------------
|
||||
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
|
||||
/ipv6 dhcp-server remove [find]
|
||||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find default=no]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find dynamic=no]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find dynamic=no]
|
||||
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — BGP instance
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing bgp template set [find name=default] disabled=no
|
||||
|
||||
/routing bgp instance
|
||||
add name=bgp-instance-1 as=393837 router-id=10.254.254.111
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — addresses
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:10::111/128 interface=lo advertise=no comment="loopback"
|
||||
add address=2606:1c80:0:17::2/64 interface=ether2-climax advertise=no comment="P2P 494<->climax"
|
||||
add address=2606:1c80:1A00::1/64 interface=management advertise=yes comment="494 mgmt LAN"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — static routes
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 route
|
||||
add dst-address=::/0 gateway=2606:1c80:0:17::1 distance=1 comment="default via climax"
|
||||
add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:17::1 distance=1 comment="core loopback (iBGP bootstrap, via climax)"
|
||||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:17::1 distance=1 comment="edge loopback (via climax)"
|
||||
add dst-address=2606:1c80:1A00::/44 blackhole distance=200 comment="494 /44 aggregate (iBGP origin)"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — neighbour discovery on the mgmt LAN
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 nd
|
||||
add interface=management ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
/ipv6 nd prefix
|
||||
add interface=management prefix=2606:1c80:1A00::/64 autonomous=yes on-link=yes
|
||||
|
||||
/ipv6 dhcp-server
|
||||
add interface=management name=494-mgmt-stateless address-pool=static-only
|
||||
|
||||
/ipv6 dhcp-server option
|
||||
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — customer PD pool + bind to PPPoE profile
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 pool
|
||||
add name=494-cust-pd-1 prefix=2606:1c80:1A01::/48 prefix-length=56
|
||||
|
||||
/ppp profile
|
||||
set [find name=494] remote-ipv6-prefix-pool=494-cust-pd-1 dhcpv6-pd-pool=494-cust-pd-1
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 firewall filter
|
||||
add chain=input action=accept connection-state=established,related comment="established"
|
||||
add chain=input action=drop connection-state=invalid comment="invalid"
|
||||
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
||||
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
|
||||
add chain=input action=drop comment="default deny"
|
||||
|
||||
add chain=forward action=accept connection-state=established,related comment="established"
|
||||
add chain=forward action=drop connection-state=invalid comment="invalid"
|
||||
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
||||
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
|
||||
add chain=forward action=accept src-address=2606:1c80:1A00::/44 comment="v6 outbound from 494 customers"
|
||||
add chain=forward action=drop comment="default deny"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP to core (v6 RR)
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing filter rule
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1A00::/44 || dst==2606:1c80:0:10::111/128 || (dst-len==64 && dst==2606:1c80:0:17::/64)) { accept; } else { reject; }"
|
||||
|
||||
/routing bgp connection
|
||||
add name=ibgp-rr-core instance=bgp-instance-1 templates=default \
|
||||
afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::111 \
|
||||
remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \
|
||||
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
output.redistribute=connected,static \
|
||||
comment="iBGP to core (v6 RR), v6 transport"
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-11 16:45:08 by RouterOS 7.21.4
|
||||
# 2026-05-11 16:47:21 by RouterOS 7.21.4
|
||||
# software id = K4QG-8NQV
|
||||
#
|
||||
# model = RB5009UG+S+
|
||||
|
|
|
|||
|
|
@ -1,119 +0,0 @@
|
|||
# =============================================================================
|
||||
# 982 — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
|
||||
# =============================================================================
|
||||
#
|
||||
# 982 is a leaf tower. Single backbone P2P:
|
||||
# * core (north) — ether7-380 (60 GHz), v6 P2P 2606:1c80:0:14::/64 (982 .2)
|
||||
# Default upstream toward core via :14::1.
|
||||
#
|
||||
# Loopback: 2606:1c80:0:10::110/128
|
||||
# /44 customer aggregate: 2606:1c80:1300::/44
|
||||
# Mgmt LAN: 2606:1c80:1300::1/64 (assumes `mgmt` bridge — verify name first).
|
||||
# PPPoE profile assumed `pppoe`. Customer interface-list assumed `customer`.
|
||||
# =============================================================================
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# WIPE
|
||||
# -----------------------------------------------------------------------------
|
||||
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
|
||||
/ipv6 dhcp-server remove [find]
|
||||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find default=no]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find dynamic=no]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find dynamic=no]
|
||||
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — BGP instance
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing bgp template set [find name=default] disabled=no
|
||||
|
||||
/routing bgp instance
|
||||
add name=bgp-instance-1 as=393837 router-id=10.254.254.110
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — addresses
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:10::110/128 interface=lo advertise=no comment="loopback"
|
||||
add address=2606:1c80:0:14::2/64 interface=ether7-380 advertise=no comment="P2P 982<->core (60GHz)"
|
||||
add address=2606:1c80:1300::1/64 interface=mgmt advertise=yes comment="982 mgmt LAN"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — static routes
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 route
|
||||
add dst-address=::/0 gateway=2606:1c80:0:14::1 distance=1 comment="default via core"
|
||||
add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:14::1 distance=1 comment="core loopback (iBGP bootstrap)"
|
||||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:14::1 distance=1 comment="edge loopback via core"
|
||||
add dst-address=2606:1c80:1300::/44 blackhole distance=200 comment="982 /44 aggregate (iBGP origin)"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — neighbour discovery on the mgmt LAN
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 nd
|
||||
add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
/ipv6 nd prefix
|
||||
add interface=mgmt prefix=2606:1c80:1300::/64 autonomous=yes on-link=yes
|
||||
|
||||
/ipv6 dhcp-server
|
||||
add interface=mgmt name=982-mgmt-stateless address-pool=static-only
|
||||
|
||||
/ipv6 dhcp-server option
|
||||
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — customer PD pool + bind to PPPoE profile
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 pool
|
||||
add name=982-cust-pd-1 prefix=2606:1c80:1301::/48 prefix-length=56
|
||||
|
||||
/ppp profile
|
||||
set [find name=982] remote-ipv6-prefix-pool=982-cust-pd-1 dhcpv6-pd-pool=982-cust-pd-1
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 firewall filter
|
||||
add chain=input action=accept connection-state=established,related comment="established"
|
||||
add chain=input action=drop connection-state=invalid comment="invalid"
|
||||
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
||||
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
|
||||
add chain=input action=drop comment="default deny"
|
||||
|
||||
add chain=forward action=accept connection-state=established,related comment="established"
|
||||
add chain=forward action=drop connection-state=invalid comment="invalid"
|
||||
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
||||
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
|
||||
add chain=forward action=accept src-address=2606:1c80:1300::/44 comment="v6 outbound from 982 customers"
|
||||
add chain=forward action=drop comment="default deny"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP to core (v6 RR)
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing filter rule
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1300::/44 || dst==2606:1c80:0:10::110/128 || (dst-len==64 && dst==2606:1c80:0:14::/64)) { accept; } else { reject; }"
|
||||
|
||||
/routing bgp connection
|
||||
add name=ibgp-rr-core instance=bgp-instance-1 templates=default \
|
||||
afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::110 \
|
||||
remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \
|
||||
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
output.redistribute=connected,static \
|
||||
comment="iBGP to core (v6 RR), v6 transport"
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-11 16:45:08 by RouterOS 7.21.4
|
||||
# 2026-05-11 16:47:21 by RouterOS 7.21.4
|
||||
# software id = FUVS-HCM5
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
|
|||
|
|
@ -1,170 +0,0 @@
|
|||
# =============================================================================
|
||||
# climax — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
|
||||
# =============================================================================
|
||||
#
|
||||
# Climax sits between verona (south-west) and the rest of the network
|
||||
# (via core). One v6 default upstream — toward core via :12::1.
|
||||
#
|
||||
# P2P interfaces:
|
||||
# ether4-380-airfiber24 :12::/64 (climax .2, core .1)
|
||||
# ether6-verona-11ghz :20::/64 (verona .1, climax .2)
|
||||
# ether3-culleoka-11ghz :21::/64 (climax .1, culleoka .2)
|
||||
# ether5-494 :17::/64 (climax .1, 494 .2)
|
||||
#
|
||||
# Mgmt LAN: bridge `mgmt`, v6 = 2606:1c80:1100::1/64
|
||||
# PPPoE customers: profile name `pppoe`, customer pool 2606:1c80:1101::/48 → /56
|
||||
#
|
||||
# BFD on wireless OSPFv2 templates was already turned off on this router
|
||||
# earlier today (2026-05-09) — verified via the freshly-pulled climax.rsc.
|
||||
# No BFD changes here.
|
||||
# =============================================================================
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# WIPE — drop OSPFv3 + stale internal v6
|
||||
# -----------------------------------------------------------------------------
|
||||
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
|
||||
/ipv6 dhcp-server remove [find]
|
||||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find default=no]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find dynamic=no]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find dynamic=no]
|
||||
|
||||
# OSPFv3 — instance, area, and the orphan culleoka-11ghz template entry
|
||||
# (currently lives under area=backbone-v3) all get removed.
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
# Drop any stale internal v6 iBGP peers (none present, but defensive).
|
||||
/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — BGP instance (climax has none today)
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing bgp instance
|
||||
add name=bgp-instance-1 as=393837 router-id=10.254.254.102
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — addresses
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:10::102/128 interface=lo advertise=no comment="loopback"
|
||||
add address=2606:1c80:0:12::2/64 interface=ether4-380-airfiber24 advertise=no comment="P2P climax<->core"
|
||||
add address=2606:1c80:0:20::2/64 interface=ether6-verona-11ghz advertise=no comment="P2P climax<->verona"
|
||||
add address=2606:1c80:0:21::1/64 interface=ether3-culleoka-11ghz advertise=no comment="P2P climax<->culleoka"
|
||||
add address=2606:1c80:0:17::1/64 interface=ether5-494 advertise=no comment="P2P climax<->494"
|
||||
add address=2606:1c80:1100::1/64 interface=mgmt advertise=yes comment="climax mgmt LAN"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — static routes (replace what an IGP would have learned)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 route
|
||||
# Default upstream toward core (only one path from climax — core forwards
|
||||
# upward via preseem/direct).
|
||||
add dst-address=::/0 gateway=2606:1c80:0:12::1 distance=1 comment="default via core"
|
||||
|
||||
# Edge loopback explicit (recursively resolved through default; explicit
|
||||
# entry helps iBGP control plane converge quickly on first bring-up).
|
||||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:12::1 distance=1 comment="edge loopback via core"
|
||||
|
||||
# 494 sits one hop further out via the climax<->494 P2P; climax is the
|
||||
# only neighbour that can deliver to its loopback. Without this, return
|
||||
# traffic for 494's /128 from core/edge loops at climax.
|
||||
add dst-address=2606:1c80:0:10::111/128 gateway=2606:1c80:0:17::2 distance=1 comment="494 loopback via P2P"
|
||||
|
||||
# verona's loopback is reachable through verona's own P2P side. Adding
|
||||
# this static beats the BGP-learned next-hop during convergence and
|
||||
# avoids the stale-next-hop loop we hit on 2026-05-09.
|
||||
add dst-address=2606:1c80:0:10::101/128 gateway=2606:1c80:0:20::1 distance=1 comment="verona loopback via P2P"
|
||||
|
||||
# Blackhole climax's /44 aggregate so iBGP has the prefix to advertise.
|
||||
add dst-address=2606:1c80:1100::/44 blackhole distance=200 comment="climax /44 aggregate (iBGP origin)"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — neighbour discovery on the mgmt LAN (SLAAC + RDNSS)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 nd
|
||||
add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
/ipv6 nd prefix
|
||||
add interface=mgmt prefix=2606:1c80:1100::/64 autonomous=yes on-link=yes
|
||||
|
||||
/ipv6 dhcp-server
|
||||
add interface=mgmt name=climax-mgmt-stateless address-pool=static-only
|
||||
|
||||
/ipv6 dhcp-server option
|
||||
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — customer PD pool + bind to the climax PPPoE profile
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 pool
|
||||
add name=climax-cust-pd-1 prefix=2606:1c80:1101::/48 prefix-length=56
|
||||
|
||||
/ppp profile
|
||||
set [find name=pppoe] remote-ipv6-prefix-pool=climax-cust-pd-1 dhcpv6-pd-pool=climax-cust-pd-1
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall (mirrors v4 hygiene; deny by default)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 firewall filter
|
||||
add chain=input action=accept connection-state=established,related comment="established"
|
||||
add chain=input action=drop connection-state=invalid comment="invalid"
|
||||
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
||||
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
|
||||
add chain=input action=drop comment="default deny"
|
||||
|
||||
add chain=forward action=accept connection-state=established,related comment="established"
|
||||
add chain=forward action=drop connection-state=invalid comment="invalid"
|
||||
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
||||
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
|
||||
add chain=forward action=accept in-interface-list=customer comment="v6 outbound from customers"
|
||||
add chain=forward action=drop comment="default deny"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP to edge (v4 transport / v6 NLRI)
|
||||
# -----------------------------------------------------------------------------
|
||||
# Output filter: advertise climax's own routes — /44 customer aggregate,
|
||||
# loopback /128, and connected /64 P2Ps toward verona, core, culleoka, 494.
|
||||
# Core (v6 RR) reflects these to every other client.
|
||||
/routing filter rule
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1100::/44 || dst==2606:1c80:0:10::102/128 || (dst-len==64 && (dst==2606:1c80:0:12::/64 || dst==2606:1c80:0:17::/64 || dst==2606:1c80:0:20::/64 || dst==2606:1c80:0:21::/64))) { accept; } else { reject; }"
|
||||
|
||||
# Single iBGP session to CORE (which is the v6 route reflector for the fleet).
|
||||
# v6 transport (loopback-to-loopback). output.redistribute=connected,static
|
||||
# picks up the loopback /128 (connected) and the /44 blackhole aggregate
|
||||
# (static); the filter chain narrows the set.
|
||||
/routing bgp connection
|
||||
add name=ibgp-rr-core instance=bgp-instance-1 templates=default \
|
||||
afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::102 \
|
||||
remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \
|
||||
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
output.redistribute=connected,static \
|
||||
comment="iBGP to core (v6 RR), v6 transport"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# VERIFY (paste after apply)
|
||||
# -----------------------------------------------------------------------------
|
||||
# /ipv6 address print
|
||||
# /ipv6 route print where active
|
||||
# /routing ospf neighbor print ;; only OSPFv2 should remain
|
||||
# /routing bgp instance print
|
||||
# /routing bgp connection print
|
||||
# /routing bgp session print
|
||||
#
|
||||
# After core + edge have applied:
|
||||
# /ping 2606:1c80:0:12::1 count=3 ;; core P2P side
|
||||
# /ping 2606:1c80:0:10::253 count=3 ;; core loopback
|
||||
# /ping 2606:1c80:0:10::254 count=3 ;; edge loopback
|
||||
# /ping 2606:4700:4700::1111 count=3 ;; cloudflare end-to-end
|
||||
# /routing bgp session print ;; ibgp-edge-v6 should be Established
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-11 16:45:07 by RouterOS 7.21.4
|
||||
# 2026-05-11 16:47:21 by RouterOS 7.21.4
|
||||
# software id = UETF-WF31
|
||||
#
|
||||
# model = CCR2004-16G-2S+
|
||||
|
|
|
|||
|
|
@ -1,224 +0,0 @@
|
|||
# =============================================================================
|
||||
# core (380) — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
|
||||
# =============================================================================
|
||||
#
|
||||
# Core sits between edge and the towers. Two paths to edge mirror v4:
|
||||
# 1. PRIMARY: sfp-sfpplus1-edge-preseem, /127 :1002::2 — edge cost 10
|
||||
# 2. BACKUP: ether3-edge-direct, /127 :11::2 — OSPFv2 cost 100 on both
|
||||
# ends; v6 mirrors via static distance.
|
||||
#
|
||||
# Tower-facing P2Ps (per ipv6.md):
|
||||
# ether5-climax :12::/64 (core .1, climax .2)
|
||||
# ether4-newhope :13::/64 (core .1, newhope .2)
|
||||
# ether1-982-60ghz :14::/64 (core .1, 982 .2)
|
||||
# ether6-culleoka-11ghz :15::/64 (core .1, culleoka .2)
|
||||
#
|
||||
# Mgmt LAN: vlan10_combo1 (vlan 10 on combo1-380), v6 = 2606:1c80:1400::1/64
|
||||
# PPPoE customers: profile name `380`, customer pool 2606:1c80:1401::/48 → /56
|
||||
#
|
||||
# Two pre-apply fixes required on core:
|
||||
# (a) /routing/bgp/instance bgp-instance-1 currently has as=65530 — must
|
||||
# be 393837 to peer iBGP with edge. We update it in place.
|
||||
# (b) BFD is currently on for ether5-climax (AF24), ether4-newhope, and
|
||||
# ether6-culleoka-11ghz (AF11). Per fleet policy (no BFD on
|
||||
# wireless), we set use-bfd=no on those three OSPFv2 templates.
|
||||
# Wired backbone (sfp-sfpplus1-edge-preseem, ether3-edge-direct)
|
||||
# keeps BFD as-is.
|
||||
# =============================================================================
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# WIPE — drop OSPFv3 + stale internal v6
|
||||
# -----------------------------------------------------------------------------
|
||||
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
|
||||
/ipv6 dhcp-server remove [find]
|
||||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find default=no]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find dynamic=no]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find dynamic=no]
|
||||
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
|
||||
# also remove the disabled placeholder climax connection (will be replaced
|
||||
# by the future climax tower's own iBGP-to-edge session).
|
||||
/routing bgp connection remove [find name=climax and disabled=yes]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — fix BGP instance AS (65530 → 393837 to match the fleet)
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing bgp instance set [find name=bgp-instance-1] as=393837
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — turn off BFD on wireless backbone OSPFv2 templates
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing ospf interface-template set [find interfaces=ether5-climax] use-bfd=no
|
||||
/routing ospf interface-template set [find interfaces=ether4-newhope] use-bfd=no
|
||||
/routing ospf interface-template set [find interfaces=ether6-culleoka-11ghz] use-bfd=no
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — addresses
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:10::253/128 interface=lo advertise=no comment="loopback"
|
||||
add address=2606:1c80:0:11::2/64 interface=ether3-edge-direct advertise=no comment="P2P core<->edge direct (backup)"
|
||||
add address=2606:1c80:0:1002::2/64 interface=sfp-sfpplus1-edge-preseem advertise=no comment="P2P core<->edge via preseem (primary)"
|
||||
add address=2606:1c80:0:12::1/64 interface=ether5-climax advertise=no comment="P2P core<->climax"
|
||||
add address=2606:1c80:0:13::1/64 interface=ether4-newhope advertise=no comment="P2P core<->newhope"
|
||||
add address=2606:1c80:0:14::1/64 interface=ether1-982-60ghz advertise=no comment="P2P core<->982 60GHz"
|
||||
add address=2606:1c80:0:15::1/64 interface=ether6-culleoka-11ghz advertise=no comment="P2P core<->culleoka"
|
||||
add address=2606:1c80:1400::1/64 interface=vlan10_combo1 advertise=yes comment="380 mgmt LAN"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — static routes (replace what an IGP would have learned)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 route
|
||||
# v6 default toward edge — preseem primary, direct backup (mirrors v4 cost relationship).
|
||||
add dst-address=::/0 gateway=2606:1c80:0:1002::1 distance=1 comment="default via preseem (primary)"
|
||||
add dst-address=::/0 gateway=2606:1c80:0:11::1 distance=2 comment="default via direct (backup)"
|
||||
|
||||
# Edge loopback static fallback (so iBGP TCP control plane can reach edge
|
||||
# even before BGP populates anything beyond defaults).
|
||||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:1002::1 distance=1 comment="edge loopback via preseem"
|
||||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:11::1 distance=2 comment="edge loopback via direct"
|
||||
|
||||
# Per-tower /128 bootstrap statics. Every iBGP RR client needs core to be
|
||||
# able to reach its loopback BEFORE the iBGP session is up — chicken/egg
|
||||
# otherwise. distance=1 wins until BGP comes up; once it does, the session
|
||||
# itself reflects the same /128 with the same forwarding outcome, so these
|
||||
# statics stay harmlessly more-specific. Towers reached *through* climax
|
||||
# (494) or *through* newhope (lowry) take the long way; directly-attached
|
||||
# towers (982, culleoka, newhope) use the matching P2P.
|
||||
add dst-address=2606:1c80:0:10::101/128 gateway=2606:1c80:0:12::2 distance=1 comment="verona loopback (via climax)"
|
||||
add dst-address=2606:1c80:0:10::102/128 gateway=2606:1c80:0:12::2 distance=1 comment="climax loopback"
|
||||
add dst-address=2606:1c80:0:10::104/128 gateway=2606:1c80:0:15::2 distance=1 comment="culleoka loopback"
|
||||
add dst-address=2606:1c80:0:10::108/128 gateway=2606:1c80:0:13::2 distance=1 comment="newhope loopback"
|
||||
add dst-address=2606:1c80:0:10::109/128 gateway=2606:1c80:0:13::2 distance=1 comment="lowry loopback (via newhope)"
|
||||
add dst-address=2606:1c80:0:10::110/128 gateway=2606:1c80:0:14::2 distance=1 comment="982 loopback"
|
||||
add dst-address=2606:1c80:0:10::111/128 gateway=2606:1c80:0:12::2 distance=1 comment="494 loopback (via climax)"
|
||||
|
||||
# Blackhole core's /44 aggregate so iBGP has the prefix to advertise upward.
|
||||
add dst-address=2606:1c80:1400::/44 blackhole distance=200 comment="core /44 aggregate (iBGP origin)"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — neighbour discovery on the 380 mgmt LAN (SLAAC + RDNSS)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 nd
|
||||
add interface=vlan10_combo1 ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
/ipv6 nd prefix
|
||||
add interface=vlan10_combo1 prefix=2606:1c80:1400::/64 autonomous=yes on-link=yes
|
||||
|
||||
/ipv6 dhcp-server
|
||||
add interface=vlan10_combo1 name=core-mgmt-stateless address-pool=static-only
|
||||
|
||||
/ipv6 dhcp-server option
|
||||
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — customer PD pool + bind to the 380 PPPoE profile
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 pool
|
||||
add name=core-cust-pd-1 prefix=2606:1c80:1401::/48 prefix-length=56
|
||||
|
||||
/ppp profile
|
||||
set [find name=380] remote-ipv6-prefix-pool=core-cust-pd-1 dhcpv6-pd-pool=core-cust-pd-1
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall (mirrors v4 hygiene; deny by default)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 firewall filter
|
||||
add chain=input action=accept connection-state=established,related comment="established"
|
||||
add chain=input action=drop connection-state=invalid comment="invalid"
|
||||
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
||||
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
|
||||
add chain=input action=drop comment="default deny"
|
||||
|
||||
add chain=forward action=accept connection-state=established,related comment="established"
|
||||
add chain=forward action=drop connection-state=invalid comment="invalid"
|
||||
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
||||
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
|
||||
add chain=forward action=accept in-interface-list=customer comment="v6 outbound from customers"
|
||||
add chain=forward action=drop comment="default deny"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP route reflector (core is RR; edge + every tower are RR clients)
|
||||
# -----------------------------------------------------------------------------
|
||||
# Why core (not edge) is the RR: ROS 6.49 on edge does not properly reflect v6
|
||||
# NLRI even with all RR settings (cluster-id, route-reflect, multihop, correct
|
||||
# in/out filters). ROS7 on core does. So core takes the RR role and edge is
|
||||
# just another iBGP client — it learns tower /44s + /128 loopbacks reflected
|
||||
# from core, and supplies the v6 default that core reflects back to towers.
|
||||
#
|
||||
# cluster-id on the bgp-instance turns this router into a route reflector.
|
||||
# It must be set BEFORE adding the client connections.
|
||||
/routing bgp instance set [find name=bgp-instance-1] cluster-id=10.254.254.253
|
||||
|
||||
# Filter for RR-reflected traffic (in & out): allow ::/0, any /44 (customer
|
||||
# aggregates), any /64 (P2P backbone links + per-tower customer LANs), any
|
||||
# /128 (router loopbacks). Reject everything else (defense in depth — keeps
|
||||
# random connected /80 etc. from leaking).
|
||||
# NOTE on syntax: ROS 7.21 routing-filter language doesn't accept range
|
||||
# matchers like `dst-in <prefix>` or `dst > <addr>` — only `dst==<exact>`
|
||||
# and length comparisons. So we match by length-class, not by sub-range.
|
||||
# The /48 covering customer-vs-infra distinction is enforced by the
|
||||
# ORIGINATING router's own narrower filter (v6-ibgp-out below).
|
||||
/routing filter rule
|
||||
add chain=v6-rr-out disabled=no rule="if (dst==::/0 || dst-len==44 || dst-len==64 || dst-len==128) { accept; } else { reject; }"
|
||||
add chain=v6-rr-in disabled=no rule="if (dst==::/0 || dst-len==44 || dst-len==64 || dst-len==128) { accept; } else { reject; }"
|
||||
|
||||
# Filter for advertising CORE'S OWN connected/static routes outbound (this
|
||||
# filter runs on each connection's output.filter-chain — what core ORIGINATES
|
||||
# rather than what it REFLECTS). Narrow by exact prefix so only core's /44
|
||||
# customer aggregate, /128 loopback, and /64 P2P links toward each neighbour
|
||||
# escape into iBGP.
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1400::/44 || dst==2606:1c80:0:10::253/128 || (dst-len==64 && (dst==2606:1c80:0:11::/64 || dst==2606:1c80:0:12::/64 || dst==2606:1c80:0:13::/64 || dst==2606:1c80:0:14::/64 || dst==2606:1c80:0:15::/64 || dst==2606:1c80:0:1002::/64))) { accept; } else { reject; }"
|
||||
|
||||
# All client connections share these settings:
|
||||
# templates=default inherits keepalive/holdtime/timers
|
||||
# afi=ip,ipv6 carry both v4 and v6 NLRI (v4 unused on these but harmless)
|
||||
# local.role=ibgp same-AS = iBGP
|
||||
# multihop=yes loopback-to-loopback (more than one hop)
|
||||
# nexthop-choice=force-self pin next-hop to core's v6 loopback
|
||||
# cluster=yes marks the peer as an RR client
|
||||
# input.filter=v6-rr-in limit what we accept
|
||||
# output.filter-chain=v6-rr-out limit what we send (covers reflected + originated)
|
||||
# output.redistribute=connected,static pick up our own /44 + /128
|
||||
/routing bgp connection
|
||||
add name=ibgp-rr-edge instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::254 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: edge"
|
||||
add name=ibgp-rr-verona instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::101 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: verona"
|
||||
add name=ibgp-rr-climax instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::102 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: climax"
|
||||
add name=ibgp-rr-culleoka instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::104 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: culleoka"
|
||||
add name=ibgp-rr-newhope instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::108 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: newhope"
|
||||
add name=ibgp-rr-lowry instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::109 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: lowry"
|
||||
add name=ibgp-rr-982 instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::110 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: 982"
|
||||
add name=ibgp-rr-494 instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::111 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: 494"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# VERIFY (paste after apply)
|
||||
# -----------------------------------------------------------------------------
|
||||
# /ipv6 address print
|
||||
# /ipv6 route print where active
|
||||
# /routing ospf neighbor print
|
||||
# /routing ospf interface-template print where use-bfd=yes ;; should be wired-only
|
||||
# /routing bgp instance print
|
||||
# /routing bgp connection print
|
||||
# /routing bgp session print
|
||||
#
|
||||
# After edge has applied:
|
||||
# /ping 2606:1c80:0:1002::1 count=3 ;; edge preseem-side
|
||||
# /ping 2606:1c80:0:11::1 count=3 ;; edge direct-side
|
||||
# /ping 2606:1c80:0:10::254 count=3 ;; edge loopback
|
||||
# /ping 2606:4700:4700::1111 count=3 ;; cloudflare end-to-end
|
||||
# /routing bgp session print ;; ibgp-edge-v6 should be Established
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-11 16:45:08 by RouterOS 7.21.4
|
||||
# 2026-05-11 16:47:21 by RouterOS 7.21.4
|
||||
# software id = XS5B-41QR
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
|
|||
|
|
@ -1,149 +0,0 @@
|
|||
# =============================================================================
|
||||
# culleoka — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
|
||||
# =============================================================================
|
||||
#
|
||||
# Culleoka has two upstream paths:
|
||||
# * core (primary) — ether6-380-11ghz, v6 P2P 2606:1c80:0:15::/64
|
||||
# * climax (backup) — ether1-climax-11ghz, v6 P2P 2606:1c80:0:21::/64
|
||||
# The climax-↔-culleoka 11 GHz radio link is currently DOWN at the radio
|
||||
# (power injector unplugged); the v6 P2P is configured but inactive until
|
||||
# the radio comes back up. v4 transit currently goes via core.
|
||||
#
|
||||
# Loopback: 2606:1c80:0:10::104/128
|
||||
# /44 customer aggregate: 2606:1c80:1600::/44
|
||||
# Mgmt LAN: 2606:1c80:1600::1/64 — assumes a `mgmt` bridge similar to
|
||||
# climax. If culleoka uses a different name (e.g. `bridge1`, `lan`),
|
||||
# substitute on apply. PPPoE profile assumed `pppoe` — verify with
|
||||
# /ppp profile print before applying.
|
||||
#
|
||||
# Customer interface-list assumed `customer` (same as climax).
|
||||
# =============================================================================
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# WIPE — drop OSPFv3 + stale internal v6
|
||||
# -----------------------------------------------------------------------------
|
||||
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
|
||||
/ipv6 dhcp-server remove [find]
|
||||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find default=no]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find dynamic=no]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find dynamic=no]
|
||||
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — BGP instance
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing bgp template set [find name=default] disabled=no
|
||||
|
||||
/routing bgp instance
|
||||
add name=bgp-instance-1 as=393837 router-id=10.254.254.104
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — addresses
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:10::104/128 interface=lo advertise=no comment="loopback"
|
||||
add address=2606:1c80:0:15::2/64 interface=ether6-380-11ghz advertise=no comment="P2P culleoka<->core"
|
||||
add address=2606:1c80:0:21::2/64 interface=ether1-climax-11ghz advertise=no comment="P2P culleoka<->climax (radio DOWN)"
|
||||
add address=2606:1c80:1600::1/64 interface=mgmt advertise=yes comment="culleoka mgmt LAN"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — static routes
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 route
|
||||
# Default upstream toward core (climax path stays as a higher-distance backup
|
||||
# that becomes active automatically when the climax 11 GHz radio is brought
|
||||
# back up — same shape as v4 OSPF cost relationship in CLAUDE.md).
|
||||
add dst-address=::/0 gateway=2606:1c80:0:15::1 distance=1 comment="default via core (primary)"
|
||||
add dst-address=::/0 gateway=2606:1c80:0:21::1 distance=100 comment="default via climax (backup, radio down)"
|
||||
|
||||
# Bootstrap: reach core's v6 loopback before iBGP comes up. Distance=1 wins
|
||||
# over the BGP-learned /128 (distance=200) once the session is up; both
|
||||
# routes have the same forwarding outcome.
|
||||
add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:15::1 distance=1 comment="core loopback (iBGP bootstrap)"
|
||||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:15::1 distance=1 comment="edge loopback via core"
|
||||
|
||||
# Blackhole the /44 so output.redistribute=static picks it up for iBGP.
|
||||
add dst-address=2606:1c80:1600::/44 blackhole distance=200 comment="culleoka /44 aggregate (iBGP origin)"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — neighbour discovery on the mgmt LAN (SLAAC + RDNSS)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 nd
|
||||
add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
/ipv6 nd prefix
|
||||
add interface=mgmt prefix=2606:1c80:1600::/64 autonomous=yes on-link=yes
|
||||
|
||||
/ipv6 dhcp-server
|
||||
add interface=mgmt name=culleoka-mgmt-stateless address-pool=static-only
|
||||
|
||||
/ipv6 dhcp-server option
|
||||
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — customer PD pool + bind to PPPoE profile
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 pool
|
||||
add name=culleoka-cust-pd-1 prefix=2606:1c80:1601::/48 prefix-length=56
|
||||
|
||||
/ppp profile
|
||||
set [find name=pppoe] remote-ipv6-prefix-pool=culleoka-cust-pd-1 dhcpv6-pd-pool=culleoka-cust-pd-1
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 firewall filter
|
||||
add chain=input action=accept connection-state=established,related comment="established"
|
||||
add chain=input action=drop connection-state=invalid comment="invalid"
|
||||
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
||||
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
|
||||
add chain=input action=drop comment="default deny"
|
||||
|
||||
add chain=forward action=accept connection-state=established,related comment="established"
|
||||
add chain=forward action=drop connection-state=invalid comment="invalid"
|
||||
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
||||
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
|
||||
add chain=forward action=accept src-address=2606:1c80:1600::/44 comment="v6 outbound from culleoka customers"
|
||||
add chain=forward action=drop comment="default deny"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP to core (v6 RR)
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing filter rule
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1600::/44 || dst==2606:1c80:0:10::104/128 || (dst-len==64 && (dst==2606:1c80:0:15::/64 || dst==2606:1c80:0:21::/64))) { accept; } else { reject; }"
|
||||
|
||||
/routing bgp connection
|
||||
add name=ibgp-rr-core instance=bgp-instance-1 templates=default \
|
||||
afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::104 \
|
||||
remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \
|
||||
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
output.redistribute=connected,static \
|
||||
comment="iBGP to core (v6 RR), v6 transport"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# VERIFY (paste after apply)
|
||||
# -----------------------------------------------------------------------------
|
||||
# /ipv6 address print
|
||||
# /ipv6 route print where active
|
||||
# /routing bgp session print ;; ibgp-rr-core should be Established
|
||||
#
|
||||
# After session is up:
|
||||
# /ping 2606:1c80:0:10::253 count=3 ;; core loopback
|
||||
# /ping 2606:1c80:0:10::254 count=3 ;; edge loopback (via core)
|
||||
# /ping 2606:4700:4700::1111 count=3 ;; cloudflare (needs working TWC v6)
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-11 16:45:08 by RouterOS 7.21.4
|
||||
# 2026-05-11 16:47:21 by RouterOS 7.21.4
|
||||
# software id = HVP9-3G0K
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
|
|||
|
|
@ -1,173 +0,0 @@
|
|||
# =============================================================================
|
||||
# edge — IPv6 apply script (ROS 6.49.18, BGP-only / no OSPFv3)
|
||||
# =============================================================================
|
||||
#
|
||||
# Edge is the iBGP hub: it terminates the TWC v6 eBGP peering and the v4
|
||||
# transport iBGP sessions to every tower. v6 NLRI rides v4 transport (so the
|
||||
# existing v4 OSPF reachability between loopbacks is reused; no v6 IGP is
|
||||
# needed). This matches the verona-v6-apply.rsc design choice.
|
||||
#
|
||||
# Two paths edge<->core:
|
||||
# 1. PRIMARY: sfp-sfpplus11-preseem via the Preseem shaper (transparent
|
||||
# L2). OSPFv2 cost on edge is the default 10. v6 P2P:
|
||||
# 2606:1c80:0:1002::/64 (edge .1, core .2)
|
||||
# 2. BACKUP: sfp-sfpplus7-core-direct direct fiber. OSPFv2 cost on edge
|
||||
# is 100 (same on core's side). v6 P2P:
|
||||
# 2606:1c80:0:11::/64 (edge .1, core .2)
|
||||
# NOTE: P2P prefix is /64 not /127 — picking ::1/127 + ::2/127 puts the
|
||||
# two ends in *different* /127 networks (verified live 2026-05-09). /64
|
||||
# matches the per-link allocation in ipv6.md.
|
||||
# Static v6 routes for the infra /48 mirror that cost relationship by
|
||||
# distance (lower = preferred): preseem at distance=1, direct at
|
||||
# distance=2.
|
||||
#
|
||||
# What this script DOES NOT touch (USER CONSTRAINT 2026-05-09):
|
||||
# * TWC v6 eBGP peer `twc-v6` (remote 2605:6000:0:8::f:372, AS11427) —
|
||||
# name doesn't match the ^ibgp- wipe pattern, so it survives.
|
||||
# * The 2606:1c80::/32 BGP network announcement upstream.
|
||||
# * The TWC P2P address 2605:6000:0:8::f:373/127 on sfp-sfpplus12-spectrum
|
||||
# — enabled, so it survives the [find disabled=yes] wipe.
|
||||
# * The existing server LAN address 2606:1c80::1 on vlan9_sfpplus8 —
|
||||
# enabled, so it survives. We only ADD a per-interface ND override
|
||||
# to suppress RA there; the IP and prefix are unmodified.
|
||||
# * v4 OSPFv2 / RIP / firewall rules — v4 control plane is unchanged.
|
||||
#
|
||||
# Apply order: review -> paste in winbox/SSH on edge -> verify with checks
|
||||
# at the bottom -> only then run the matching `core-v6-apply.rsc` so the
|
||||
# preseem and direct /127 endpoints come up symmetrically.
|
||||
# =============================================================================
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# WIPE — only the stale internal-only v6 state on edge. Leaves TWC peering,
|
||||
# the upstream /32 announcement, the server LAN address, and v4 alone.
|
||||
# -----------------------------------------------------------------------------
|
||||
# Drop any disabled placeholder v6 internal addresses (none on edge today,
|
||||
# but harmless if present).
|
||||
/ipv6 address remove [find disabled=yes]
|
||||
|
||||
# Drop any leftover OSPFv3 interface entries (we are committing to BGP-only
|
||||
# for v6; any v3 instances on edge have been minimal/stub).
|
||||
/routing ospf-v3 interface remove [find]
|
||||
|
||||
# Drop only internal iBGP v6 peers if any exist; never touch twc-v6.
|
||||
/routing bgp peer remove [find name~"^ibgp-" and address-families~"ipv6"]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — addresses
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:10::254/128 interface=loopback advertise=no comment="edge loopback"
|
||||
add address=2606:1c80:0:11::1/64 interface=sfp-sfpplus7-core-direct advertise=no comment="P2P edge<->core direct (backup)"
|
||||
add address=2606:1c80:0:1002::1/64 interface=sfp-sfpplus11-preseem advertise=no comment="P2P edge<->core via preseem (primary)"
|
||||
|
||||
# NOTE: the server LAN address 2606:1c80::1 on vlan9_sfpplus8 is left
|
||||
# untouched per user constraint. The ND override below makes it RA-free
|
||||
# without modifying the address itself.
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — neighbour discovery: SUPPRESS RA on the server LAN
|
||||
# -----------------------------------------------------------------------------
|
||||
# Server LAN is static-only per the IPv6 plan — disable RA + DHCPv6 hints.
|
||||
# A per-interface entry overrides the global default.
|
||||
/ipv6 nd
|
||||
add interface=vlan9_sfpplus8 disabled=no advertise=no managed-address-configuration=no other-configuration=no comment="server LAN: static only, no SLAAC"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — static routes (replace what an IGP would have learned)
|
||||
# -----------------------------------------------------------------------------
|
||||
# Infra /48 covers all router loopbacks (2606:1c80:0:10::/64), all P2P
|
||||
# /64s, and any future infra slots. Two entries with different distances
|
||||
# pin preseem as primary and direct as backup. The connected /64 server
|
||||
# LAN at 2606:1c80::/64 wins by longest-prefix-match, so this /48 doesn't
|
||||
# steal local server traffic.
|
||||
/ipv6 route
|
||||
add dst-address=2606:1c80::/48 gateway=2606:1c80:0:1002::2 distance=1 comment="infra: via preseem (primary)"
|
||||
add dst-address=2606:1c80::/48 gateway=2606:1c80:0:11::2 distance=2 comment="infra: via direct (backup)"
|
||||
|
||||
# Tower /44s are learned via iBGP from each tower (next-hop = tower's v6
|
||||
# loopback inside :10::/64, recursively resolved through the /48 above).
|
||||
# No static needed for them.
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall (extend the existing minimal v6 ruleset)
|
||||
# -----------------------------------------------------------------------------
|
||||
# The existing v6 firewall already accepts BGP (179) and established. Add
|
||||
# the rules required for internal-network forwarding + ICMPv6 / link-local.
|
||||
/ipv6 firewall filter
|
||||
add chain=input action=accept protocol=icmpv6 comment="icmpv6 input"
|
||||
add chain=input action=accept src-address=fe80::/10 comment="link-local input"
|
||||
add chain=input action=accept src-address=2606:1c80::/32 comment="internal input"
|
||||
|
||||
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD forward"
|
||||
add chain=forward action=accept protocol=icmpv6 comment="icmpv6 forward"
|
||||
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal<->internal"
|
||||
|
||||
# (we do not add a default-deny; edge has long-running customer transit
|
||||
# paths and a sudden v6 default-deny would break them. existing rules at
|
||||
# the bottom of /ipv6 firewall filter remain authoritative.)
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP route filters (v6)
|
||||
# -----------------------------------------------------------------------------
|
||||
# Edge has ONE iBGP v6 peer: core, which is the v6 RR for the fleet. Edge is
|
||||
# an RR client of core (no `route-reflect=yes` — that flag would mark the
|
||||
# OTHER side as a client, but edge has no clients). Edge sends ::/0 to core
|
||||
# (which reflects it to towers) and learns tower /44s + /128 loopbacks from
|
||||
# core (reflected from each tower).
|
||||
#
|
||||
# in-filter: accept any infra/customer prefix that core (v6 RR) reflects to
|
||||
# us. Length 44 = customer aggregates, 64 = backbone P2Ps + per-tower LAN /64s,
|
||||
# 128 = router loopbacks. Anything else within 2606:1c80::/32 is rejected
|
||||
# (defense in depth — keeps random connected /80 etc. from leaking).
|
||||
/routing filter
|
||||
add chain=ibgp-rr-in prefix=2606:1c80::/32 prefix-length=44-128 action=accept comment="any reflected infra/customer prefix"
|
||||
add chain=ibgp-rr-in action=discard comment="default deny"
|
||||
|
||||
# out-filter: edge sends only the v6 default to core (which the RR fans
|
||||
# out to every tower). Anything else stays inside edge.
|
||||
add chain=ibgp-rr-out prefix=::/0 prefix-length=0 action=accept comment="default route"
|
||||
add chain=ibgp-rr-out action=discard comment="default deny"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP peer to core (v6 transport, carrying v6 NLRI)
|
||||
# -----------------------------------------------------------------------------
|
||||
# v6 transport (loopback-to-loopback over 2606:1c80:0:10::254 ↔ ::253) avoids
|
||||
# the v4-mapped-next-hop bug we hit with v4 transport carrying v6 NLRI. Core
|
||||
# (ROS7) is the route reflector — edge is an RR client and, importantly, NOT
|
||||
# a reflector itself (ROS 6.49 does not properly reflect v6 NLRI even with
|
||||
# all RR settings; that's the entire reason core has the role).
|
||||
# update-source=loopback sources the TCP session from edge's loopback iface
|
||||
# (which holds both 10.254.254.254 and 2606:1c80:0:10::254).
|
||||
# nexthop-choice=force-self pins the next-hop edge advertises (::/0) to
|
||||
# edge's own v6 loopback so towers can resolve it via the RR-reflected
|
||||
# /128 path.
|
||||
/routing bgp peer
|
||||
add name=ibgp-rr-core remote-address=2606:1c80:0:10::253 remote-as=393837 update-source=loopback address-families=ipv6 nexthop-choice=force-self ttl=255 in-filter=ibgp-rr-in out-filter=ibgp-rr-out default-originate=always comment="iBGP to core (v6 RR), v6 transport"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# VERIFY (paste after apply)
|
||||
# -----------------------------------------------------------------------------
|
||||
# /ipv6 address print
|
||||
# /ipv6 route print where active
|
||||
# /ipv6 nd print
|
||||
# /routing bgp peer print where name~"v6"
|
||||
# /routing bgp advertisements print peer=ibgp-verona-v6
|
||||
#
|
||||
# Expected immediately:
|
||||
# * /ipv6 address print shows 2606:1c80:0:10::254/128 (loopback),
|
||||
# :11::1/127 (direct), :1002::1/127 (preseem), :1::/64 server LAN
|
||||
# * /ipv6 nd print shows the vlan9_sfpplus8 entry with advertise=no
|
||||
# * the new /48 routes show as inactive (gateway unreachable until core
|
||||
# applies), which is fine
|
||||
# * ibgp-verona-v6 is in `connecting` state until verona reaches edge's
|
||||
# v6 loopback (which needs core configured) — for the bare TCP
|
||||
# session, v4 loopback reachability is enough so the session SHOULD
|
||||
# come up immediately. confirm with /routing bgp peer print.
|
||||
#
|
||||
# Once core has its matching v6 apply:
|
||||
# /ping 2606:1c80:0:1002::2 count=3 ;; core preseem-side
|
||||
# /ping 2606:1c80:0:11::2 count=3 ;; core direct-side
|
||||
# /ping 2606:1c80:0:10::253 count=3 ;; core loopback (via preseem)
|
||||
# /ip route check dst=2606:1c80:0:10::101 ;; verona loopback path
|
||||
|
|
@ -1,720 +0,0 @@
|
|||
# may/09/2026 09:37:53 by RouterOS 6.49.18
|
||||
# software id = 8XZE-R7EJ
|
||||
#
|
||||
# model = CCR2004-1G-12S+2XS
|
||||
# serial number = C8A70C55A930
|
||||
/interface bridge
|
||||
add name=cgnat
|
||||
add fast-forward=no name=loopback
|
||||
/interface ethernet
|
||||
set [ find default-name=ether1 ] rx-flow-control=auto tx-flow-control=auto
|
||||
set [ find default-name=sfp-sfpplus7 ] auto-negotiation=no name=\
|
||||
sfp-sfpplus7-core-direct
|
||||
set [ find default-name=sfp-sfpplus8 ] name=sfp-sfpplus8-server-switch \
|
||||
rx-flow-control=auto tx-flow-control=auto
|
||||
set [ find default-name=sfp-sfpplus10 ] rx-flow-control=auto tx-flow-control=\
|
||||
auto
|
||||
set [ find default-name=sfp-sfpplus11 ] name=sfp-sfpplus11-preseem \
|
||||
rx-flow-control=auto tx-flow-control=auto
|
||||
set [ find default-name=sfp-sfpplus12 ] l2mtu=1500 name=\
|
||||
sfp-sfpplus12-spectrum rx-flow-control=auto tx-flow-control=auto
|
||||
/interface vlan
|
||||
add interface=sfp-sfpplus8-server-switch name=vlan9_sfpplus8 vlan-id=9
|
||||
/interface wireless security-profiles
|
||||
set [ find default=yes ] supplicant-identity=MikroTik
|
||||
/ip dhcp-server
|
||||
add disabled=no interface=vlan9_sfpplus8 name=servers-public
|
||||
/ip pool
|
||||
add name=380building ranges=10.0.0.150-10.0.0.239
|
||||
add name=servers-public ranges=204.110.191.193-204.110.191.217
|
||||
/ip dhcp-server
|
||||
add address-pool=380building disabled=no interface=sfp-sfpplus8-server-switch \
|
||||
name=380-building
|
||||
/ppp profile
|
||||
add name=RWB_sstp_profile
|
||||
/queue simple
|
||||
add burst-limit=1M/1M burst-threshold=1M/1M burst-time=1s/1s disabled=yes \
|
||||
limit-at=1M/1M max-limit=1M/1M name=Delinquent packet-marks=Delenquent \
|
||||
priority=2/2 target=""
|
||||
add burst-limit=1/1 burst-threshold=1/1 burst-time=1s/1s disabled=yes \
|
||||
limit-at=1/1 max-limit=1/1 name=Inactive packet-marks=Inactive priority=\
|
||||
2/2 target=""
|
||||
/routing bgp instance
|
||||
set default as=393837 out-filter=twc-out router-id=204.110.191.190
|
||||
/routing ospf instance
|
||||
set [ find default=yes ] distribute-default=always-as-type-1 router-id=\
|
||||
10.254.254.254
|
||||
/routing ospf-v3 instance
|
||||
set [ find default=yes ] distribute-default=always-as-type-1 \
|
||||
redistribute-connected=as-type-1 router-id=10.254.254.254
|
||||
/snmp community
|
||||
set [ find default=yes ] name=onehuargd4a8974y79a497yi
|
||||
add addresses=204.110.188.0/22,10.0.0.0/8 name=kdyyJrT0Mm
|
||||
/system logging action
|
||||
add name=logs remote=204.110.191.229 remote-port=1514 src-address=\
|
||||
10.254.254.254 target=remote
|
||||
/user group
|
||||
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\
|
||||
sword,web,sniff,sensitive,api,romon,dude,tikapp"
|
||||
/ip firewall connection tracking
|
||||
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
|
||||
tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
|
||||
tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
|
||||
tcp-time-wait-timeout=2m udp-stream-timeout=2m udp-timeout=30s
|
||||
/ip neighbor discovery-settings
|
||||
set discover-interface-list=!dynamic
|
||||
/ip settings
|
||||
set rp-filter=strict tcp-syncookies=yes
|
||||
/ipv6 settings
|
||||
set accept-router-advertisements=no
|
||||
/ip address
|
||||
add address=71.41.226.118/30 interface=sfp-sfpplus12-spectrum network=\
|
||||
71.41.226.116
|
||||
add address=204.110.191.186/30 interface=sfp-sfpplus11-preseem network=\
|
||||
204.110.191.184
|
||||
add address=204.110.191.254/26 interface=vlan9_sfpplus8 network=\
|
||||
204.110.191.192
|
||||
add address=10.254.254.254 interface=loopback network=10.254.254.254
|
||||
add address=204.110.191.182/30 interface=sfp-sfpplus7-core-direct network=\
|
||||
204.110.191.180
|
||||
add address=10.0.0.254/24 interface=sfp-sfpplus8-server-switch network=\
|
||||
10.0.0.0
|
||||
add address=204.110.190.129/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.130/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.131/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.132/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.133/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.134/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.135/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.136/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.137/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.138/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.139/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.140/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.141/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.142/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.143/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.144/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.145/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.146/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.147/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.148/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.149/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.150/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.151/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.152/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.153/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.154/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.155/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.156/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.157/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.158/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.159/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.160/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.161/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.162/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.163/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.164/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.165/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.166/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.167/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.168/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.169/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.170/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.171/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.172/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.173/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.174/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.175/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.176/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.177/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.178/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.179/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.180/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.181/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.182/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.183/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.184/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.185/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.186/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.187/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.188/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.189/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.190/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.191/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.192/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.193/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.194/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.195/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.196/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.197/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.198/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.199/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.200/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.201/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.202/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.203/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.204/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.205/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.206/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.207/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.208/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.209/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.210/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.211/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.212/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.213/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.214/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.215/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.216/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.217/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.218/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.219/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.220/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.221/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.222/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.223/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.224/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.225/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.226/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.227/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.228/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.229/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.230/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.231/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.232/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.233/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.234/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.235/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.236/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.237/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.238/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.239/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.240/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.241/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.242/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.243/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.244/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.245/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.246/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.247/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.248/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.249/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.250/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.251/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.252/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.253/25 interface=cgnat network=204.110.190.128
|
||||
add address=204.110.190.254/25 interface=cgnat network=204.110.190.128
|
||||
/ip dhcp-server lease
|
||||
add address=10.0.0.249 client-id=1:0:21:9b:91:5c:b6 mac-address=\
|
||||
00:21:9B:91:5C:B6 server=380-building
|
||||
add address=204.110.191.205 mac-address=BC:24:11:8B:C0:9C
|
||||
add address=10.0.0.250 client-id=1:48:a9:8a:38:3b:2d mac-address=\
|
||||
48:A9:8A:38:3B:2D server=380-building
|
||||
add address=10.0.0.253 client-id=\
|
||||
ff:ca:53:9:5a:0:2:0:0:ab:11:2c:53:dd:b2:c1:50:9a:35 comment=truenas \
|
||||
mac-address=BC:24:11:29:2B:5A server=380-building
|
||||
add address=10.0.0.252 client-id=1:bc:24:11:f5:81:d6 mac-address=\
|
||||
BC:24:11:F5:81:D6 server=380-building
|
||||
add address=10.0.0.251 client-id=1:bc:24:11:6b:73:53 mac-address=\
|
||||
BC:24:11:6B:73:53 server=380-building
|
||||
/ip dhcp-server network
|
||||
add address=10.0.0.0/24 dns-server=9.9.9.9,1.1.1.1 domain=vntx.net gateway=\
|
||||
10.0.0.254 ntp-server=23.150.41.122
|
||||
add address=204.110.191.192/26 dns-server=\
|
||||
204.110.191.240,204.110.191.250,1.1.1.1 gateway=204.110.191.254
|
||||
/ip dns
|
||||
set servers=204.110.191.240,204.110.191.250
|
||||
/ip firewall address-list
|
||||
add address=204.110.188.0/22 list=trusted
|
||||
add address=100.64.0.0/10 list=trusted
|
||||
add address=10.0.0.0/8 list=trusted
|
||||
add address=35.197.73.77 list=preseem
|
||||
add address=35.199.29.237 list=preseem
|
||||
add address=98.97.82.0/24 comment=starlink list=trusted
|
||||
add address=129.222.72.0/24 comment=starlink list=trusted
|
||||
add address=129.222.73.0/24 comment=starlink list=trusted
|
||||
add address=129.222.74.0/24 comment=starlink list=trusted
|
||||
add address=129.222.75.0/24 comment=starlink list=trusted
|
||||
add address=129.222.76.0/24 comment=starlink list=trusted
|
||||
add address=129.222.77.0/24 comment=starlink list=trusted
|
||||
add address=129.222.78.0/24 comment=starlink list=trusted
|
||||
add address=129.222.79.0/24 comment=starlink list=trusted
|
||||
add address=98.97.80.0/24 comment=starlink list=trusted
|
||||
add address=98.97.81.0/24 comment=starlink list=trusted
|
||||
add address=98.97.83.0/24 comment=starlink list=trusted
|
||||
add address=98.97.84.0/24 comment=starlink list=trusted
|
||||
add address=98.97.85.0/24 comment=starlink list=trusted
|
||||
add address=98.97.86.0/24 comment=starlink list=trusted
|
||||
add address=98.97.87.0/24 comment=starlink list=trusted
|
||||
add address=98.97.88.0/24 comment=starlink list=trusted
|
||||
add address=98.97.89.0/24 comment=starlink list=trusted
|
||||
add address=98.97.90.0/24 comment=starlink list=trusted
|
||||
add address=98.97.91.0/24 comment=starlink list=trusted
|
||||
add address=98.97.92.0/24 comment=starlink list=trusted
|
||||
add address=98.97.93.0/24 comment=starlink list=trusted
|
||||
add address=98.97.94.0/24 comment=starlink list=trusted
|
||||
add address=98.97.95.0/24 comment=starlink list=trusted
|
||||
add address=52.158.209.86 list=trusted
|
||||
add address=3.210.85.72 list=gaiia
|
||||
add address=3.81.237.51 list=gaiia
|
||||
add address=3.215.70.188 list=gaiia
|
||||
add address=3.228.90.246 list=gaiia
|
||||
add address=47.147.43.145 list=trusted
|
||||
add address=71.41.226.117 comment=TWC list=BGP-NEIGHBORS
|
||||
add address=204.110.191.185 comment=Preseem list=BGP-NEIGHBORS
|
||||
add address=204.110.191.252 comment="Virtual RouterOS" list=BGP-NEIGHBORS
|
||||
add address=204.110.188.0/22 list=bgp-networks
|
||||
add address=151.243.11.0/24 list=abusive
|
||||
add address=172.245.56.83 list=trusted
|
||||
/ip firewall filter
|
||||
add action=accept chain=input comment="BGP Input" dst-port=179 protocol=tcp
|
||||
add action=accept chain=output comment="BGP Output" protocol=tcp src-port=179
|
||||
add action=accept chain=forward comment="BGP Forward" dst-port=179 protocol=\
|
||||
tcp
|
||||
add action=accept chain=forward comment="BGP Forward Reply" protocol=tcp \
|
||||
src-port=179
|
||||
add action=accept chain=input comment="OSPF Input" protocol=ospf
|
||||
add action=accept chain=output comment="OSPF Output" protocol=ospf
|
||||
add action=accept chain=forward comment="OSPF Forward" protocol=ospf
|
||||
add action=accept chain=input comment="Established Input" connection-state=\
|
||||
established,related
|
||||
add action=accept chain=forward comment="Established Forward" \
|
||||
connection-state=established,related
|
||||
add action=accept chain=input comment="Allow Remote Winbox" disabled=yes \
|
||||
in-interface=*18
|
||||
add action=fasttrack-connection chain=forward comment=\
|
||||
"fasttrack established/related" connection-state=established,related
|
||||
add action=accept chain=forward comment="accept established/related" \
|
||||
connection-state=established,related
|
||||
add action=drop chain=forward dst-address=91.190.98.0/24 log=yes
|
||||
add action=accept chain=forward dst-port=23 protocol=tcp src-address=\
|
||||
204.110.190.208
|
||||
add action=accept chain=forward dst-address=204.110.191.219
|
||||
add action=accept chain=forward dst-address=204.110.191.222
|
||||
add action=accept chain=forward dst-address=204.110.191.252
|
||||
add action=accept chain=forward dst-address=204.110.191.8
|
||||
add action=accept chain=forward dst-address=204.110.191.192/26 src-address=\
|
||||
52.158.209.86
|
||||
add action=accept chain=forward dst-address=204.110.191.210
|
||||
add action=accept chain=forward disabled=yes dst-address=204.110.191.248 \
|
||||
dst-port=3306 log=yes protocol=tcp
|
||||
add action=accept chain=forward dst-address=204.110.191.248 dst-port=3306 \
|
||||
protocol=tcp src-address-list=gaiia
|
||||
add action=accept chain=forward disabled=yes dst-address=204.110.191.248
|
||||
add action=accept chain=forward dst-address=204.110.191.231
|
||||
add action=accept chain=forward dst-address=204.110.191.232 in-interface=\
|
||||
sfp-sfpplus12-spectrum
|
||||
add action=tarpit chain=input protocol=tcp src-address-list=abusive
|
||||
add action=drop chain=forward src-address-list=abusive
|
||||
add action=accept chain=forward connection-state=established,related \
|
||||
disabled=yes
|
||||
add action=accept chain=input connection-state=established,related,untracked \
|
||||
disabled=yes
|
||||
add action=drop chain=forward disabled=yes dst-port=3389 in-interface=\
|
||||
sfp-sfpplus12-spectrum protocol=tcp
|
||||
add action=drop chain=forward disabled=yes dst-port=3389 in-interface=\
|
||||
sfp-sfpplus12-spectrum protocol=udp
|
||||
add action=drop chain=forward comment="Drop anyone in Black List (SSH)." \
|
||||
in-interface=sfp-sfpplus12-spectrum log-prefix="BL_Black List (SSH)" \
|
||||
src-address-list="Black List (SSH)"
|
||||
add action=drop chain=forward comment="block incoming ftp" disabled=yes \
|
||||
dst-port=21 in-interface=sfp-sfpplus12-spectrum protocol=tcp
|
||||
add action=drop chain=forward comment="block incoming telnet" dst-port=23 \
|
||||
in-interface=sfp-sfpplus12-spectrum protocol=tcp
|
||||
add action=drop chain=input comment="Drop all packets from public internet whi\
|
||||
ch should not exist in public network" in-interface=\
|
||||
sfp-sfpplus12-spectrum src-address-list=NotPublic
|
||||
add action=drop chain=input disabled=yes dst-port=3784 in-interface=\
|
||||
sfp-sfpplus12-spectrum log=yes protocol=udp
|
||||
add action=drop chain=forward comment=bfd dst-port=3784 in-interface=\
|
||||
sfp-sfpplus12-spectrum protocol=udp
|
||||
add action=drop chain=input comment=bfd dst-port=3784 in-interface=\
|
||||
sfp-sfpplus12-spectrum protocol=udp
|
||||
add action=drop chain=input comment="Drop Invalid connections" \
|
||||
connection-state=invalid
|
||||
add action=add-src-to-address-list address-list=winbox_blacklist \
|
||||
address-list-timeout=4w3d chain=input connection-state=new disabled=yes \
|
||||
dst-port=8291 log=yes protocol=tcp src-address-list=winbox_stage3
|
||||
add action=add-src-to-address-list address-list=winbox_stage3 \
|
||||
address-list-timeout=1m chain=input connection-state=new disabled=yes \
|
||||
dst-port=8291 protocol=tcp src-address-list=winbox_stage2
|
||||
add action=add-src-to-address-list address-list=winbox_stage2 \
|
||||
address-list-timeout=1m chain=input connection-state=new disabled=yes \
|
||||
dst-port=8291 protocol=tcp src-address-list=winbox_stage1
|
||||
add action=add-src-to-address-list address-list=winbox_stage1 \
|
||||
address-list-timeout=1m chain=input connection-state=new disabled=yes \
|
||||
dst-port=8291 protocol=tcp src-address-list=!vntx
|
||||
add action=drop chain=forward comment="drop winbox brute downstream" \
|
||||
disabled=yes dst-port=8291 protocol=tcp src-address-list=winbox_blacklist
|
||||
add action=accept chain=input comment="BGP Neighbors" dst-port=179 protocol=\
|
||||
tcp src-address-list=BGP-NEIGHBORS
|
||||
add action=drop chain=input comment="Drop anyone in Black List (SSH)." \
|
||||
disabled=yes in-interface=sfp-sfpplus12-spectrum log-prefix=\
|
||||
"BL_Black List (SSH)" src-address-list="Black List (SSH)"
|
||||
add action=jump chain=input comment="Jump to Black List (SSH) chain." \
|
||||
dst-port=22 in-interface=sfp-sfpplus12-spectrum jump-target=\
|
||||
"Black List (SSH) Chain" protocol=tcp
|
||||
add action=drop chain=input comment=. dst-port=23 in-interface=\
|
||||
sfp-sfpplus12-spectrum protocol=tcp
|
||||
add action=drop chain=forward comment=. dst-port=23 in-interface=\
|
||||
sfp-sfpplus12-spectrum protocol=tcp
|
||||
add action=jump chain=forward comment="Jump to Black List (SSH) chain." \
|
||||
dst-port=22 in-interface=sfp-sfpplus12-spectrum jump-target=\
|
||||
"Black List (SSH) Chain" protocol=tcp
|
||||
add action=add-src-to-address-list address-list="Black List (SSH)" \
|
||||
address-list-timeout=4w2d chain="Black List (SSH) Chain" comment="Transfer\
|
||||
\_repeated attempts from Black List (SSH) Stage 3 to Black List (SSH)." \
|
||||
connection-state=new in-interface=sfp-sfpplus12-spectrum log-prefix=\
|
||||
"Add_Black List (SSH)" src-address-list="Black List (SSH) Stage 3"
|
||||
add action=add-src-to-address-list address-list="Black List (SSH) Stage 3" \
|
||||
address-list-timeout=1m chain="Black List (SSH) Chain" comment=\
|
||||
"Add successive attempts to Black List (SSH) Stage 3." connection-state=\
|
||||
new in-interface=sfp-sfpplus12-spectrum log-prefix=\
|
||||
"Add_Black List (SSH) S3" src-address-list="Black List (SSH) Stage 2"
|
||||
add action=add-src-to-address-list address-list="Black List (SSH) Stage 2" \
|
||||
address-list-timeout=1m chain="Black List (SSH) Chain" comment=\
|
||||
"Add successive attempts to Black List (SSH) Stage 2." connection-state=\
|
||||
new in-interface=sfp-sfpplus12-spectrum log-prefix=\
|
||||
"Add_Black List (SSH) S2" src-address-list="Black List (SSH) Stage 1"
|
||||
add action=add-src-to-address-list address-list="Black List (SSH) Stage 1" \
|
||||
address-list-timeout=1m chain="Black List (SSH) Chain" comment=\
|
||||
"Add initial attempt to Black List (SSH) Stage 1." connection-state=new \
|
||||
in-interface=sfp-sfpplus12-spectrum log-prefix="Add_Black List (SSH) S1" \
|
||||
src-address-list=!trusted
|
||||
add action=return chain="Black List (SSH) Chain" comment=\
|
||||
"Return From Black List (SSH) chain."
|
||||
add action=accept chain=forward disabled=yes dst-address=204.110.191.192/26 \
|
||||
dst-port=3306 log=yes protocol=tcp src-address=162.243.131.32
|
||||
add action=accept chain=forward dst-address=204.110.191.197
|
||||
add action=accept chain=forward comment=micromirror dst-address=\
|
||||
204.110.191.235
|
||||
add action=accept chain=forward dst-address=204.110.191.219
|
||||
add action=accept chain=forward dst-address=204.110.191.8
|
||||
add action=accept chain=forward dst-address=204.110.191.192/26 protocol=icmp
|
||||
add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=80 \
|
||||
protocol=tcp
|
||||
add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=443 \
|
||||
protocol=tcp
|
||||
add action=accept chain=forward dst-address=204.110.191.232 dst-port=14580 \
|
||||
protocol=tcp
|
||||
add action=accept chain=forward dst-address=204.110.191.232 dst-port=14501 \
|
||||
protocol=tcp
|
||||
add action=accept chain=forward comment=wireguard dst-address=204.110.191.247 \
|
||||
dst-port=51820 protocol=udp
|
||||
add action=accept chain=forward dst-address=204.110.191.247 dst-port=22 \
|
||||
protocol=tcp
|
||||
add action=drop chain=forward disabled=yes dst-address=204.110.191.192/26 \
|
||||
dst-port=3306 log=yes protocol=tcp
|
||||
add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=53 \
|
||||
protocol=udp src-address-list=trusted
|
||||
add action=accept chain=forward comment=ns2 dst-address=204.110.191.239 \
|
||||
dst-port=53 protocol=udp
|
||||
add action=accept chain=forward comment=ns1 dst-address=204.110.191.249 \
|
||||
dst-port=53 protocol=udp
|
||||
add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=22 \
|
||||
protocol=tcp src-address-list=trusted
|
||||
add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=22 \
|
||||
protocol=tcp src-address-list=preseem
|
||||
add action=accept chain=forward dst-address=204.110.191.192/26 \
|
||||
src-address-list=trusted
|
||||
add action=drop chain=forward dst-address=204.110.191.192/26 \
|
||||
src-address-list=!trusted
|
||||
add action=drop chain=input dst-port=8921 protocol=tcp src-address-list=\
|
||||
!trusted
|
||||
add action=drop chain=forward dst-port=8921 protocol=tcp src-address-list=\
|
||||
!trusted
|
||||
add action=drop chain=input disabled=yes in-interface=sfp-sfpplus12-spectrum \
|
||||
src-address=100.64.0.0/10
|
||||
add action=drop chain=output disabled=yes dst-address=100.64.0.0/10 \
|
||||
out-interface=sfp-sfpplus12-spectrum
|
||||
add action=drop chain=forward disabled=yes in-interface=\
|
||||
sfp-sfpplus12-spectrum src-address=100.64.0.0/10
|
||||
add action=drop chain=forward disabled=yes out-interface=\
|
||||
sfp-sfpplus12-spectrum src-address=100.64.0.0/10
|
||||
add action=drop chain=forward disabled=yes dst-address=100.64.0.0/10 \
|
||||
out-interface=sfp-sfpplus12-spectrum
|
||||
add action=accept chain=input comment="Established Input" connection-state=\
|
||||
established,related
|
||||
add action=accept chain=forward comment="Established Forward" \
|
||||
connection-state=established,related
|
||||
add action=accept chain=input comment=BGP dst-port=179 protocol=tcp
|
||||
add action=accept chain=output comment=BGP protocol=tcp src-port=179
|
||||
add action=accept chain=forward comment=BGP dst-port=179 protocol=tcp
|
||||
add action=accept chain=forward comment=BGP protocol=tcp src-port=179
|
||||
add action=accept chain=input comment=OSPF protocol=ospf
|
||||
add action=accept chain=output comment=OSPF protocol=ospf
|
||||
add action=accept chain=forward comment=OSPF protocol=ospf
|
||||
add action=drop chain=forward dst-port=23 log-prefix=TELNET protocol=tcp
|
||||
/ip firewall mangle
|
||||
add action=mark-packet chain=prerouting disabled=yes new-packet-mark=Inactive \
|
||||
passthrough=no src-address-list=Inactive
|
||||
add action=mark-packet chain=prerouting disabled=yes dst-address-list=\
|
||||
Inactive new-packet-mark=Inactive passthrough=no
|
||||
add action=accept chain=postrouting disabled=yes protocol=tcp tcp-flags=ack
|
||||
/ip firewall nat
|
||||
add action=src-nat chain=srcnat comment="Internal NAT catch-all" \
|
||||
out-interface=sfp-sfpplus12-spectrum src-address=10.0.0.0/8 to-addresses=\
|
||||
204.110.191.190
|
||||
add action=src-nat chain=srcnat out-interface=sfp-sfpplus12-spectrum \
|
||||
src-address=10.0.0.0/24 to-addresses=204.110.190.254
|
||||
add action=src-nat chain=srcnat comment="Loopback NAT" out-interface=\
|
||||
sfp-sfpplus12-spectrum src-address=10.254.254.0/24 to-addresses=\
|
||||
204.110.191.190
|
||||
add action=src-nat chain=srcnat comment="Loopback NAT" out-interface=\
|
||||
sfp-sfpplus12-spectrum src-address=10.254.254.0/24 to-addresses=\
|
||||
204.110.191.190
|
||||
add action=src-nat chain=srcnat out-interface=sfp-sfpplus12-spectrum \
|
||||
src-address=10.0.0.0/8 to-addresses=204.110.191.190
|
||||
add action=src-nat chain=srcnat comment="Internal Network NAT" out-interface=\
|
||||
sfp-sfpplus12-spectrum src-address=10.250.1.0/24 to-addresses=\
|
||||
204.110.191.190
|
||||
add action=src-nat chain=srcnat comment="Internal Network NAT" out-interface=\
|
||||
sfp-sfpplus12-spectrum src-address=10.250.1.0/24 to-addresses=\
|
||||
204.110.191.190
|
||||
add action=src-nat chain=srcnat comment="fallthrough CGNAT" disabled=yes \
|
||||
out-interface=sfp-sfpplus12-spectrum src-address=100.64.0.0/10 \
|
||||
to-addresses=204.110.190.254
|
||||
add action=netmap chain=srcnat ipsec-policy=out,none out-interface=\
|
||||
sfp-sfpplus12-spectrum src-address=100.64.0.0/10 to-addresses=\
|
||||
204.110.190.128/25
|
||||
add action=netmap chain=dstmap comment=\
|
||||
"Port Forwarding Solution for CGNAT (TCP)" dst-address=204.110.190.128/25 \
|
||||
dst-port=1024-65535 protocol=tcp to-addresses=100.64.0.0/10
|
||||
add action=netmap chain=dstmap comment=\
|
||||
"Port Forwarding Solution for CGNAT (UDP)" dst-address=204.110.190.128/25 \
|
||||
dst-port=1024-65535 protocol=udp to-addresses=100.64.0.0/10
|
||||
/ip firewall raw
|
||||
add action=drop chain=prerouting src-address-list="Black List (SSH)"
|
||||
add action=drop chain=prerouting disabled=yes src-address-list=abusive
|
||||
add action=drop chain=prerouting disabled=yes src-address-list=\
|
||||
winbox_blacklist
|
||||
/ip proxy
|
||||
set port=23435
|
||||
/ip proxy access
|
||||
add src-address=204.110.188.0/22
|
||||
/ip route
|
||||
add distance=1 gateway=71.41.226.117
|
||||
add distance=1 dst-address=10.10.0.0/20 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.10.16.0/20 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.8/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.8/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.24/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.64/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.64/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.88/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.250.1.88/29 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.254.254.101/32 gateway=204.110.191.185
|
||||
add distance=1 dst-address=10.254.254.102/32 gateway=204.110.191.185
|
||||
add distance=1 dst-address=100.64.0.0/10 gateway=204.110.191.185
|
||||
add distance=1 dst-address=100.64.0.0/22 gateway=204.110.191.185
|
||||
add distance=1 dst-address=100.64.4.0/22 gateway=204.110.191.185
|
||||
add distance=1 dst-address=100.64.4.0/22 gateway=204.110.191.185
|
||||
add distance=1 dst-address=100.64.12.0/22 gateway=204.110.191.185
|
||||
add distance=1 dst-address=172.63.0.0/20 gateway=204.110.191.253
|
||||
add distance=1 dst-address=204.110.188.0/22 gateway=204.110.191.181
|
||||
add distance=1 dst-address=204.110.188.0/27 gateway=204.110.191.253
|
||||
add distance=1 dst-address=204.110.188.32/27 gateway=204.110.191.185
|
||||
add distance=1 dst-address=204.110.188.32/27 gateway=204.110.191.185
|
||||
add distance=1 dst-address=204.110.188.224/27 gateway=204.110.191.185
|
||||
add distance=1 dst-address=204.110.191.0/27 gateway=204.110.191.185
|
||||
/ip service
|
||||
set telnet disabled=yes
|
||||
set ftp disabled=yes
|
||||
set www address=204.110.188.0/22 port=2080
|
||||
set ssh address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10 port=1022
|
||||
set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10
|
||||
set api-ssl address=0.0.0.0/0 certificate=server
|
||||
/ip ssh
|
||||
set always-allow-password-login=yes forwarding-enabled=remote strong-crypto=\
|
||||
yes
|
||||
/ipv6 address
|
||||
add address=2605:6000:0:8::f:373/127 advertise=no interface=\
|
||||
sfp-sfpplus12-spectrum
|
||||
add address=2606:1c80::1 interface=vlan9_sfpplus8
|
||||
add address=2606:1c80:0:10::254/128 advertise=no comment="edge loopback" \
|
||||
interface=loopback
|
||||
add address=2606:1c80:0:11::1/127 advertise=no comment=\
|
||||
"P2P edge<->core direct (backup)" interface=sfp-sfpplus7-core-direct
|
||||
add address=2606:1c80:0:1002::1/127 advertise=no comment=\
|
||||
"P2P edge<->core via preseem (primary)" interface=sfp-sfpplus11-preseem
|
||||
/ipv6 firewall address-list
|
||||
add address=2606:1c80::/32 list=bgp-networks
|
||||
/ipv6 firewall filter
|
||||
add action=accept chain=input comment="IPv6 BGP Input" dst-port=179 protocol=\
|
||||
tcp
|
||||
add action=accept chain=output comment="IPv6 BGP Output" protocol=tcp \
|
||||
src-port=179
|
||||
add action=accept chain=forward comment="IPv6 BGP Forward" dst-port=179 \
|
||||
protocol=tcp
|
||||
add action=accept chain=forward comment="IPv6 BGP Forward Reply" protocol=tcp \
|
||||
src-port=179
|
||||
add action=accept chain=input comment="IPv6 Established Input" \
|
||||
connection-state=established,related
|
||||
add action=accept chain=forward comment="IPv6 Established Forward" \
|
||||
connection-state=established,related
|
||||
add action=accept chain=input comment="icmpv6 input" protocol=icmpv6
|
||||
add action=accept chain=input comment="link-local input" src-address=\
|
||||
fe80::/10
|
||||
add action=accept chain=input comment="internal input" src-address=\
|
||||
2606:1c80::/32
|
||||
add action=accept chain=forward comment="PMTUD forward" hop-limit=equal:1 \
|
||||
protocol=icmpv6
|
||||
add action=accept chain=forward comment="icmpv6 forward" protocol=icmpv6
|
||||
add action=accept chain=forward comment=internal<->internal dst-address=\
|
||||
2606:1c80::/32 src-address=2606:1c80::/32
|
||||
/ipv6 route
|
||||
add comment="infra: via preseem (primary)" distance=1 dst-address=\
|
||||
2606:1c80::/48 gateway=2606:1c80:0:1002::2
|
||||
add comment="infra: via direct (backup)" distance=2 dst-address=\
|
||||
2606:1c80::/48 gateway=2606:1c80:0:11::2
|
||||
/mpls interface
|
||||
set [ find default=yes ] mpls-mtu=1530
|
||||
add interface=sfp-sfpplus8-server-switch mpls-mtu=1530
|
||||
/mpls ldp
|
||||
set distribute-for-default-route=yes enabled=yes loop-detect=yes lsr-id=\
|
||||
10.254.254.254 transport-address=10.254.254.254
|
||||
/mpls ldp accept-filter
|
||||
add
|
||||
/mpls ldp advertise-filter
|
||||
add
|
||||
/mpls ldp interface
|
||||
add disabled=yes interface=ether1
|
||||
add disabled=yes interface=sfp-sfpplus11-preseem transport-address=\
|
||||
10.254.254.254
|
||||
add disabled=yes interface=vlan9_sfpplus8 transport-address=10.254.254.254
|
||||
add interface=sfp-sfpplus8-server-switch
|
||||
/routing bfd interface
|
||||
set [ find default=yes ] disabled=yes
|
||||
add interface=sfp-sfpplus7-core-direct
|
||||
add interface=sfp-sfpplus11-preseem
|
||||
/routing bgp network
|
||||
add network=204.110.188.0/22 synchronize=no
|
||||
add network=2606:1c80::/32 synchronize=no
|
||||
/routing bgp peer
|
||||
add in-filter=twc-in name=twc out-filter=twc-out remote-address=71.41.226.117 \
|
||||
remote-as=11427 ttl=default
|
||||
add address-families=ipv6 in-filter=twc-in name=twc-v6 out-filter=twc-out \
|
||||
remote-address=2605:6000:0:8::f:372 remote-as=11427 ttl=default
|
||||
add comment="TEAM-CYMRU BOGON Server #1" disabled=yes in-filter=\
|
||||
BOGON-SERVER-IN max-prefix-limit=50 multihop=yes name=CYMRU-1 out-filter=\
|
||||
BGP-DROP remote-address=38.229.6.20 remote-as=65332 tcp-md5-key=\
|
||||
mC9LaaOi0P
|
||||
add comment="TEAM-CYMRU BOGON Server #2" disabled=yes in-filter=\
|
||||
BOGON-SERVER-IN max-prefix-limit=50 multihop=yes name=CYMRU-1 out-filter=\
|
||||
BGP-DROP remote-address=38.229.46.20 remote-as=65332 tcp-md5-key=\
|
||||
mC9LaaOi0P
|
||||
add address-families=ip,ipv6 default-originate=always disabled=yes name=\
|
||||
edge_core_preseem nexthop-choice=propagate out-filter=bgp-default-only \
|
||||
remote-address=204.110.191.185 remote-as=393837
|
||||
add address-families=ipv6 comment="iBGP to verona, v4 transport / v6 NLRI" \
|
||||
default-originate=always in-filter=ibgp-tower-in-v6 name=ibgp-verona-v6 \
|
||||
nexthop-choice=force-self out-filter=ibgp-tower-out-v6 remote-address=\
|
||||
10.254.254.101 remote-as=393837 update-source=loopback
|
||||
/routing filter
|
||||
add action=accept chain=twc-out comment=blackhole disabled=yes prefix=\
|
||||
204.110.188.197 prefix-length=32 set-bgp-communities=7486:666
|
||||
add action=accept chain=twc-in prefix=0.0.0.0/0
|
||||
add action=accept chain=twc-in prefix=0.0.0.0/0 prefix-length=0
|
||||
add action=discard chain=twc-in disabled=yes prefix=0.0.0.0 prefix-length=\
|
||||
0-32 protocol=""
|
||||
add action=accept chain=twc-out prefix=204.110.188.0/22
|
||||
add action=accept chain=twc-out prefix=2606:1c80::/32
|
||||
add action=discard chain=twc-out
|
||||
add action=discard chain=BGP-DROP
|
||||
add action=accept bgp-communities=65333:888 chain=BOGON-SERVER-IN disabled=\
|
||||
yes set-type=blackhole
|
||||
add action=discard chain=BOGON-SERVER-IN disabled=yes
|
||||
add action=discard chain=BGP-DROP
|
||||
add action=accept chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \
|
||||
prefix-length=0
|
||||
add action=discard chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \
|
||||
prefix-length=0-32
|
||||
add action=accept chain=ibgp-tower-in-v6 comment=\
|
||||
"tower /44 customer aggregate" prefix=2606:1c80:1000::/36 prefix-length=\
|
||||
44
|
||||
add action=accept chain=ibgp-tower-in-v6 comment="tower v6 loopback" prefix=\
|
||||
2606:1c80:0:10::/64 prefix-length=128
|
||||
add action=discard chain=ibgp-tower-in-v6 comment="default deny"
|
||||
add action=accept chain=ibgp-tower-out-v6 comment="default route to tower" \
|
||||
prefix=::/0 prefix-length=0
|
||||
add action=discard chain=ibgp-tower-out-v6 comment="default deny"
|
||||
/routing ospf interface
|
||||
add interface=sfp-sfpplus12-spectrum network-type=broadcast passive=yes
|
||||
add interface=sfp-sfpplus11-preseem network-type=point-to-point use-bfd=yes
|
||||
add cost=20 interface=sfp-sfpplus9 network-type=nbma use-bfd=yes
|
||||
add interface=sfp-sfpplus10 network-type=nbma passive=yes
|
||||
add cost=20 interface=ether1 network-type=broadcast
|
||||
add interface=sfp-sfpplus8-server-switch network-type=broadcast
|
||||
add cost=100 interface=sfp-sfpplus7-core-direct network-type=point-to-point \
|
||||
use-bfd=yes
|
||||
add interface=vlan9_sfpplus8 network-type=nbma
|
||||
/routing ospf nbma-neighbor
|
||||
add address=204.110.191.189 poll-interval=10s
|
||||
add address=10.250.1.94
|
||||
add address=10.250.1.57
|
||||
add address=10.250.1.201
|
||||
add address=10.250.2.1
|
||||
add address=204.110.191.185 poll-interval=10s
|
||||
add address=204.110.191.252 poll-interval=10s
|
||||
/routing ospf network
|
||||
add area=backbone
|
||||
/routing rip
|
||||
set distribute-default=always redistribute-connected=yes redistribute-ospf=\
|
||||
yes
|
||||
/routing rip interface
|
||||
add interface=sfp-sfpplus11-preseem
|
||||
add interface=sfp-sfpplus7-core-direct
|
||||
add interface=sfp-sfpplus8-server-switch
|
||||
/routing rip network
|
||||
add
|
||||
/snmp
|
||||
set contact="Verona Networks" enabled=yes location="Verona Networks"
|
||||
/system clock
|
||||
set time-zone-name=America/Chicago
|
||||
/system identity
|
||||
set name=edge
|
||||
/system logging
|
||||
add action=logs topics=info
|
||||
/system note
|
||||
set note="__ __\
|
||||
\n\\ \\ / /__ _ __ ___ _ __ __ _\
|
||||
\n \\ \\ / / _ \\ '__/ _ \\| '_ \\ / _` |\
|
||||
\n \\ V / __/ | | (_) | | | | (_| |\
|
||||
\n \\_/ \\___|_| \\___/|_| |_|\\__,_|\
|
||||
\n _ _ _ _\
|
||||
\n| \\ | | ___| |___ _____ _ __| | _____\
|
||||
\n| \\| |/ _ \\ __\\ \\ /\\ / / _ \\| '__| |/ / __|\
|
||||
\n| |\\ | __/ |_ \\ V V / (_) | | | <\\__ \\\
|
||||
\n|_| \\_|\\___|\\__| \\_/\\_/ \\___/|_| |_|\\_\\___/\
|
||||
\n\
|
||||
\n###############################################################\
|
||||
\n# Welcome to Verona Networks #\
|
||||
\n# All connections are monitored and recorded #\
|
||||
\n# Disconnect IMMEDIATELY if you are not an authorized user! #\
|
||||
\n###############################################################\
|
||||
\n\
|
||||
\n" show-at-login=no
|
||||
/system ntp client
|
||||
set enabled=yes primary-ntp=162.159.200.1 secondary-ntp=45.79.1.70
|
||||
/system routerboard settings
|
||||
set auto-upgrade=yes
|
||||
/system scheduler
|
||||
add name=reboot on-event="/system reboot\r\
|
||||
\n" policy=\
|
||||
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
|
||||
start-date=jun/14/2023 start-time=03:00:00
|
||||
add comment=RWB_IP_RESOLVER interval=5m name=RWB_IP_RESOLVER on-event=\
|
||||
RWB_IP_RESOLVER policy=\
|
||||
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
|
||||
start-date=oct/13/2022 start-time=22:59:02
|
||||
/tool graphing interface
|
||||
add allow-address=204.110.188.0/22
|
||||
/tool graphing queue
|
||||
add allow-address=204.110.188.0/22
|
||||
/tool graphing resource
|
||||
add allow-address=204.110.188.0/22
|
||||
/tool romon
|
||||
set enabled=yes
|
||||
/user aaa
|
||||
set default-group=full
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# may/11/2026 16:45:07 by RouterOS 6.49.18
|
||||
# may/11/2026 16:47:21 by RouterOS 6.49.18
|
||||
# software id = 8XZE-R7EJ
|
||||
#
|
||||
# model = CCR2004-1G-12S+2XS
|
||||
|
|
|
|||
|
|
@ -1,129 +0,0 @@
|
|||
# =============================================================================
|
||||
# graham's home router — IPv6 apply (RB5009UG+S+, ROS 7.22.3)
|
||||
# =============================================================================
|
||||
#
|
||||
# This is graham's home — multi-WAN: TMHI primary, VNTX secondary, Starlink
|
||||
# last-resort. v6 source is T-Mobile Home Internet's gateway via DHCPv6-PD
|
||||
# on ether6-tmobile. Switched off the verona-PD path on 2026-05-09 because
|
||||
# TWC isn't accepting our 2606:1c80::/32 yet (separate ticket); TMHI gives
|
||||
# us a globally-reachable v6 prefix today, even if it rotates.
|
||||
#
|
||||
# Whatever TMHI delegates (typically /64 on residential, sometimes /60 on
|
||||
# the newer gateways) populates the local `home-pd` pool. Internal LANs
|
||||
# pull /64s from it:
|
||||
# * bridge — main home LAN (10.0.16/24, 10.0.19/22)
|
||||
# * ether3-servers — servers LAN (10.0.15.254/21)
|
||||
# If TMHI only delegates a single /64, only `bridge` gets v6; the second
|
||||
# `from-pool=` add will error harmlessly. If they hand out a /60 or /56,
|
||||
# both LANs come up.
|
||||
# =============================================================================
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# WIPE — clean prior v6 config (preserve auto-link-local + Starlink ULA)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 nd remove [find default=no]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 dhcp-server remove [find]
|
||||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 pool remove [find name=home-pd]
|
||||
/ipv6 route remove [find static=yes]
|
||||
/ipv6 address remove [find dynamic=no and disabled=no]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — settings
|
||||
# -----------------------------------------------------------------------------
|
||||
# Forward stays on (we're a router). accept-router-advertisements=yes is
|
||||
# REQUIRED on this router because TMHI only provides v6 via SLAAC — no
|
||||
# DHCPv6 server, no PD downstream. Without this we wouldn't even get a
|
||||
# global v6 address on ether6-tmobile. RAs we send on bridge/ether3-servers
|
||||
# are not received by ourselves so this is safe to leave global.
|
||||
/ipv6 settings set forward=yes accept-router-advertisements=yes
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — DHCPv6 client (request prefix delegation from TMHI gateway)
|
||||
# -----------------------------------------------------------------------------
|
||||
# request=address,prefix asks for both an IA_NA address on the WAN and a
|
||||
# delegated prefix (IA_PD) for downstream LANs. pool-name stores the PD in
|
||||
# a local pool we then carve /64s out of. add-default-route=yes installs
|
||||
# ::/0 via TMHI's gateway link-local on receipt. Distance 1 matches the v4
|
||||
# default priority for TMHI.
|
||||
# Disabled — TMHI Sagemcom 5688W gateway runs no DHCPv6 server, only
|
||||
# SLAAC. Verified 2026-05-09: client stays in status=searching... forever
|
||||
# even with prefix-hint=::/56. The ROUTER itself gets v6 from RAs (above).
|
||||
# Internal LANs can't get native PD from TMHI. To get v6 on internal LANs
|
||||
# while routing via TMHI: add NAT66 with a ULA prefix (see notes in
|
||||
# CLAUDE.md / memory). Kept here disabled so we remember the attempt.
|
||||
/ipv6 dhcp-client
|
||||
add interface=ether6-tmobile request=address,prefix pool-name=home-pd pool-prefix-length=64 \
|
||||
add-default-route=yes default-route-distance=1 \
|
||||
use-peer-dns=yes disabled=yes \
|
||||
comment="DHCPv6-PD from TMHI (disabled - TMHI runs SLAAC only, no PD server)"
|
||||
|
||||
# Disabled fallback — re-enable manually if TMHI v6 dies and verona is up
|
||||
# AND TWC has accepted our 2606:1c80::/32 (separate ticket).
|
||||
add interface=ether5-vntx-static request=prefix pool-name=home-pd-vntx pool-prefix-length=64 \
|
||||
add-default-route=yes default-route-distance=2 \
|
||||
use-peer-dns=yes disabled=yes \
|
||||
comment="DHCPv6-PD from verona (disabled, fallback)"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — internal LAN addresses
|
||||
# -----------------------------------------------------------------------------
|
||||
# Currently no internal v6 — TMHI doesn't delegate a prefix and the verona
|
||||
# path is held until TWC accepts our /32. When PD is restored, re-enable
|
||||
# whichever dhcp-client is appropriate above and uncomment these:
|
||||
#
|
||||
# /ipv6 address
|
||||
# add address=::1 from-pool=home-pd interface=bridge advertise=yes comment="home main LAN"
|
||||
# add address=::1 from-pool=home-pd interface=ether3-servers advertise=yes comment="home servers LAN"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — neighbour discovery on internal LANs (SLAAC + RDNSS for clients)
|
||||
# -----------------------------------------------------------------------------
|
||||
# Skipped while no internal v6 prefix exists — RAs without a global prefix
|
||||
# would just announce the router as a default gateway with no on-link
|
||||
# prefix, which doesn't help clients. Re-enable along with the address
|
||||
# block above when PD is back.
|
||||
#
|
||||
# /ipv6 nd
|
||||
# add interface=bridge ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
# add interface=ether3-servers ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
#
|
||||
# /ipv6 dhcp-server
|
||||
# add interface=bridge name=home-bridge-stateless address-pool=static-only
|
||||
# add interface=ether3-servers name=home-servers-stateless address-pool=static-only
|
||||
#
|
||||
# /ipv6 dhcp-server option
|
||||
# add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall (mirror v4 hygiene; deny by default on input)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 firewall filter
|
||||
add chain=input action=accept connection-state=established,related comment="established"
|
||||
add chain=input action=drop connection-state=invalid comment="invalid"
|
||||
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
||||
add chain=input action=accept src-address=2606:1c80::/32 comment="vntx internal"
|
||||
add chain=input action=drop comment="default deny input"
|
||||
|
||||
# Forward — let internal LANs reach the world; allow inbound established
|
||||
# but don't accept arbitrary inbound to home hosts.
|
||||
add chain=forward action=accept connection-state=established,related comment="established"
|
||||
add chain=forward action=drop connection-state=invalid comment="invalid"
|
||||
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
||||
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=forward action=accept in-interface=bridge comment="home outbound (bridge)"
|
||||
add chain=forward action=accept in-interface=ether3-servers comment="home outbound (servers)"
|
||||
add chain=forward action=drop comment="default deny forward"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# VERIFY (after apply)
|
||||
# -----------------------------------------------------------------------------
|
||||
# /ipv6 dhcp-client print ;; should show status=bound on ether6-tmobile
|
||||
# /ipv6 pool print ;; should show home-pd populated (whatever TMHI delegated)
|
||||
# /ipv6 address print ;; bridge gets ::1/64; servers gets one too if TMHI gave /60+
|
||||
# /ipv6 route print where active ;; ::/0 via fe80::xxxx of TMHI gateway
|
||||
# /ping 2606:4700:4700::1111 count=3 ;; cloudflare — should work once dhcp-client is bound
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-11 16:45:08 by RouterOS 7.22.3
|
||||
# 2026-05-11 16:47:21 by RouterOS 7.22.3
|
||||
# software id = ZGNY-ZJW7
|
||||
#
|
||||
# model = RB5009UG+S+
|
||||
|
|
|
|||
|
|
@ -1,119 +0,0 @@
|
|||
# =============================================================================
|
||||
# lowry — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
|
||||
# =============================================================================
|
||||
#
|
||||
# Lowry is a leaf tower. Single backbone P2P:
|
||||
# * newhope (north) — ether1-newhope, v6 P2P 2606:1c80:0:18::/64 (lowry .2)
|
||||
# Default upstream toward newhope :18::1, which forwards to core.
|
||||
#
|
||||
# Loopback: 2606:1c80:0:10::109/128
|
||||
# /44 customer aggregate: 2606:1c80:1900::/44
|
||||
# Mgmt LAN: 2606:1c80:1900::1/64 (assumes `mgmt` bridge — verify name first).
|
||||
# PPPoE profile assumed `pppoe`. Customer interface-list assumed `customer`.
|
||||
# =============================================================================
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# WIPE
|
||||
# -----------------------------------------------------------------------------
|
||||
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
|
||||
/ipv6 dhcp-server remove [find]
|
||||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find default=no]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find dynamic=no]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find dynamic=no]
|
||||
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — BGP instance
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing bgp template set [find name=default] disabled=no
|
||||
|
||||
/routing bgp instance
|
||||
add name=bgp-instance-1 as=393837 router-id=10.254.254.109
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — addresses
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:10::109/128 interface=lo advertise=no comment="loopback"
|
||||
add address=2606:1c80:0:18::2/64 interface=ether1-newhope advertise=no comment="P2P lowry<->newhope"
|
||||
add address=2606:1c80:1900::1/64 interface=management advertise=yes comment="lowry mgmt LAN"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — static routes
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 route
|
||||
add dst-address=::/0 gateway=2606:1c80:0:18::1 distance=1 comment="default via newhope"
|
||||
add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:18::1 distance=1 comment="core loopback (iBGP bootstrap, via newhope)"
|
||||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:18::1 distance=1 comment="edge loopback (via newhope)"
|
||||
add dst-address=2606:1c80:1900::/44 blackhole distance=200 comment="lowry /44 aggregate (iBGP origin)"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — neighbour discovery on the mgmt LAN
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 nd
|
||||
add interface=management ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
/ipv6 nd prefix
|
||||
add interface=management prefix=2606:1c80:1900::/64 autonomous=yes on-link=yes
|
||||
|
||||
/ipv6 dhcp-server
|
||||
add interface=management name=lowry-mgmt-stateless address-pool=static-only
|
||||
|
||||
/ipv6 dhcp-server option
|
||||
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — customer PD pool + bind to PPPoE profile
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 pool
|
||||
add name=lowry-cust-pd-1 prefix=2606:1c80:1901::/48 prefix-length=56
|
||||
|
||||
/ppp profile
|
||||
set [find name=pppoe] remote-ipv6-prefix-pool=lowry-cust-pd-1 dhcpv6-pd-pool=lowry-cust-pd-1
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 firewall filter
|
||||
add chain=input action=accept connection-state=established,related comment="established"
|
||||
add chain=input action=drop connection-state=invalid comment="invalid"
|
||||
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
||||
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
|
||||
add chain=input action=drop comment="default deny"
|
||||
|
||||
add chain=forward action=accept connection-state=established,related comment="established"
|
||||
add chain=forward action=drop connection-state=invalid comment="invalid"
|
||||
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
||||
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
|
||||
add chain=forward action=accept src-address=2606:1c80:1900::/44 comment="v6 outbound from lowry customers"
|
||||
add chain=forward action=drop comment="default deny"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP to core (v6 RR)
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing filter rule
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1900::/44 || dst==2606:1c80:0:10::109/128 || (dst-len==64 && dst==2606:1c80:0:18::/64)) { accept; } else { reject; }"
|
||||
|
||||
/routing bgp connection
|
||||
add name=ibgp-rr-core instance=bgp-instance-1 templates=default \
|
||||
afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::109 \
|
||||
remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \
|
||||
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
output.redistribute=connected,static \
|
||||
comment="iBGP to core (v6 RR), v6 transport"
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-11 16:45:08 by RouterOS 7.21.4
|
||||
# 2026-05-11 16:47:21 by RouterOS 7.21.4
|
||||
# software id = 2I9X-PQZP
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
|
|||
|
|
@ -1,141 +0,0 @@
|
|||
# =============================================================================
|
||||
# newhope — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
|
||||
# =============================================================================
|
||||
#
|
||||
# Newhope is a relay tower. P2Ps:
|
||||
# * core (north) — ether2-380, v6 P2P 2606:1c80:0:13::/64 (newhope .2)
|
||||
# * lowry (south) — ether6-lowrycrossing, v6 P2P 2606:1c80:0:18::/64 (newhope .1)
|
||||
# Default upstream toward core via :13::1.
|
||||
# Lowry's loopback :10::109 is reachable through the :18::/64 link (lowry
|
||||
# is dual-homed only via newhope today).
|
||||
#
|
||||
# Loopback: 2606:1c80:0:10::108/128
|
||||
# /44 customer aggregate: 2606:1c80:1800::/44
|
||||
# Mgmt LAN: 2606:1c80:1800::1/64 — assumes a `mgmt` bridge (verify with
|
||||
# /interface/print before applying).
|
||||
# PPPoE profile assumed `pppoe`. Customer interface-list assumed `customer`.
|
||||
# =============================================================================
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# WIPE — drop OSPFv3 + stale internal v6
|
||||
# -----------------------------------------------------------------------------
|
||||
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
|
||||
/ipv6 dhcp-server remove [find]
|
||||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find default=no]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find dynamic=no]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find dynamic=no]
|
||||
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — BGP instance
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing bgp template set [find name=default] disabled=no
|
||||
|
||||
/routing bgp instance
|
||||
add name=bgp-instance-1 as=393837 router-id=10.254.254.108
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — addresses
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:10::108/128 interface=lo advertise=no comment="loopback"
|
||||
add address=2606:1c80:0:13::2/64 interface=ether2-380 advertise=no comment="P2P newhope<->core"
|
||||
add address=2606:1c80:0:18::1/64 interface=ether6-lowrycrossing advertise=no comment="P2P newhope<->lowry"
|
||||
add address=2606:1c80:1800::1/64 interface=bridge_cpe_mgmt advertise=yes comment="newhope mgmt LAN"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — static routes
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 route
|
||||
add dst-address=::/0 gateway=2606:1c80:0:13::1 distance=1 comment="default via core"
|
||||
add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:13::1 distance=1 comment="core loopback (iBGP bootstrap)"
|
||||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:13::1 distance=1 comment="edge loopback via core"
|
||||
|
||||
# Lowry sits one hop further out via the newhope<->lowry P2P. newhope is
|
||||
# the only neighbour that can deliver to lowry's loopback, so we hold a
|
||||
# static for it; without this, traffic for :10::109 from core/edge loops
|
||||
# at newhope until iBGP fully converges.
|
||||
add dst-address=2606:1c80:0:10::109/128 gateway=2606:1c80:0:18::2 distance=1 comment="lowry loopback via P2P"
|
||||
|
||||
add dst-address=2606:1c80:1800::/44 blackhole distance=200 comment="newhope /44 aggregate (iBGP origin)"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — neighbour discovery on the mgmt LAN
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 nd
|
||||
add interface=bridge_cpe_mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
/ipv6 nd prefix
|
||||
add interface=bridge_cpe_mgmt prefix=2606:1c80:1800::/64 autonomous=yes on-link=yes
|
||||
|
||||
/ipv6 dhcp-server
|
||||
add interface=bridge_cpe_mgmt name=newhope-mgmt-stateless address-pool=static-only
|
||||
|
||||
/ipv6 dhcp-server option
|
||||
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — customer PD pool + bind to PPPoE profile
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 pool
|
||||
add name=newhope-cust-pd-1 prefix=2606:1c80:1801::/48 prefix-length=56
|
||||
|
||||
/ppp profile
|
||||
set [find name=newhope] remote-ipv6-prefix-pool=newhope-cust-pd-1 dhcpv6-pd-pool=newhope-cust-pd-1
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 firewall filter
|
||||
add chain=input action=accept connection-state=established,related comment="established"
|
||||
add chain=input action=drop connection-state=invalid comment="invalid"
|
||||
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
||||
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
|
||||
add chain=input action=drop comment="default deny"
|
||||
|
||||
add chain=forward action=accept connection-state=established,related comment="established"
|
||||
add chain=forward action=drop connection-state=invalid comment="invalid"
|
||||
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
||||
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
|
||||
add chain=forward action=accept src-address=2606:1c80:1800::/44 comment="v6 outbound from newhope customers"
|
||||
add chain=forward action=accept src-address=2606:1c80:1900::/44 comment="v6 outbound from lowry customers (transit)"
|
||||
add chain=forward action=drop comment="default deny"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP to core (v6 RR)
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing filter rule
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1800::/44 || dst==2606:1c80:0:10::108/128 || (dst-len==64 && (dst==2606:1c80:0:13::/64 || dst==2606:1c80:0:18::/64))) { accept; } else { reject; }"
|
||||
|
||||
/routing bgp connection
|
||||
add name=ibgp-rr-core instance=bgp-instance-1 templates=default \
|
||||
afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::108 \
|
||||
remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \
|
||||
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
output.redistribute=connected,static \
|
||||
comment="iBGP to core (v6 RR), v6 transport"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# VERIFY
|
||||
# -----------------------------------------------------------------------------
|
||||
# /ipv6 address print
|
||||
# /ipv6 route print where active
|
||||
# /routing bgp session print
|
||||
# /ping 2606:1c80:0:10::253 count=3 ;; core
|
||||
# /ping 2606:1c80:0:10::109 count=3 ;; lowry (after lowry applies)
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-11 16:45:08 by RouterOS 7.21.4
|
||||
# 2026-05-11 16:47:21 by RouterOS 7.21.4
|
||||
# software id = 5HTF-YFWV
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
|
|||
|
|
@ -1,181 +0,0 @@
|
|||
# =============================================================================
|
||||
# verona — IPv6 apply script (v4-transport iBGP, no OSPFv3)
|
||||
# =============================================================================
|
||||
#
|
||||
# Design choices vs ipv6.md plan:
|
||||
# * Drops OSPFv3 entirely. iBGP TCP session runs over the existing v4
|
||||
# loopback (10.254.254.101 ↔ 10.254.254.254) — v4 OSPF already provides
|
||||
# reachability between v4 loopbacks, so no v6 IGP is needed for the
|
||||
# session itself. The session carries IPv6 NLRI (MP-BGP, RFC 4760).
|
||||
# * v6 forwarding uses a static default route via climax's v6 P2P side
|
||||
# (2606:1c80:0:20::2). That gateway becomes reachable when climax's
|
||||
# v6 apply runs; until then v6 customer traffic will fail past verona
|
||||
# — known and accepted while the rollout proceeds tower-by-tower.
|
||||
# * iBGP next-hop is forced to self (verona's v6 loopback). Edge will
|
||||
# need a route to 2606:1c80:0:10::101/128 once edge is configured;
|
||||
# handled in the edge apply step.
|
||||
#
|
||||
# Apply order: review → paste into a winbox/SSH session on verona →
|
||||
# verify with the checks at the bottom.
|
||||
# =============================================================================
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# WIPE — remove all existing internal v6 + OSPFv3 state. Leaves v4 alone.
|
||||
# -----------------------------------------------------------------------------
|
||||
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
|
||||
/ipv6 dhcp-server remove [find]
|
||||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find default=no]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find dynamic=no]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find dynamic=no]
|
||||
|
||||
# OSPFv3 — remove the v3 instance, area, interface-template entry, leave v2 alone.
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
# Any leftover v6 BGP — wipe internal-only, never touch upstream peers.
|
||||
/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — addresses
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:10::101/128 interface=lo advertise=no comment="loopback"
|
||||
add address=2606:1c80:0:20::1/64 interface=ether3-climax-11ghz advertise=no comment="P2P verona<->climax"
|
||||
add address=2606:1c80:0:30::1/64 interface=vlan9_sfpplus1 advertise=no comment="P2P verona<->graham home"
|
||||
add address=2606:1c80:1000::1/64 interface=verona advertise=yes comment="verona mgmt LAN"
|
||||
add address=2606:1c80:1500::1/64 interface=ether6-switch advertise=yes comment="altoga mgmt LAN"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — static routes (replaces what OSPFv3 would have done)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 route
|
||||
add dst-address=::/0 gateway=2606:1c80:0:20::2 distance=1 comment="default via climax P2P"
|
||||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:20::2 distance=1 comment="edge loopback (iBGP target reachability fallback)"
|
||||
|
||||
# Blackhole the /44 aggregates so iBGP has something to advertise.
|
||||
# (ROS7 syntax: `blackhole` is a flag, not a `type=` value.)
|
||||
add dst-address=2606:1c80:1000::/44 blackhole distance=200 comment="verona /44 aggregate (iBGP origin)"
|
||||
add dst-address=2606:1c80:1500::/44 blackhole distance=200 comment="altoga /44 aggregate (iBGP origin)"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — neighbour discovery / RA on mgmt LANs (SLAAC + RDNSS)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 nd
|
||||
add interface=verona ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
add interface=ether6-switch ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
/ipv6 nd prefix
|
||||
add interface=verona prefix=2606:1c80:1000::/64 autonomous=yes on-link=yes
|
||||
add interface=ether6-switch prefix=2606:1c80:1500::/64 autonomous=yes on-link=yes
|
||||
|
||||
# Stateless DHCPv6 on each mgmt LAN — only carries DNS + search-domain options.
|
||||
/ipv6 dhcp-server
|
||||
add interface=verona name=verona-mgmt-stateless address-pool=static-only
|
||||
add interface=ether6-switch name=altoga-mgmt-stateless address-pool=static-only
|
||||
|
||||
# DHCPv6 PD server on vlan9_sfpplus1 — graham's home router connects there
|
||||
# and is treated like a regular customer: it requests prefix delegation,
|
||||
# receives a /56 from verona-cust-pd-1, and the dynamic route to that /56
|
||||
# is created automatically with gateway=client-link-local.
|
||||
add interface=vlan9_sfpplus1 name=verona-wired-pd address-pool=static-only prefix-pool=verona-cust-pd-1
|
||||
|
||||
# RA on vlan9_sfpplus1 advertises the link /64 + DNS option so the home
|
||||
# router learns the default route via verona's link-local automatically.
|
||||
/ipv6 nd
|
||||
add interface=vlan9_sfpplus1 ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
/ipv6 nd prefix
|
||||
add interface=vlan9_sfpplus1 prefix=2606:1c80:0:30::/64 autonomous=no on-link=yes
|
||||
|
||||
/ipv6 dhcp-server option
|
||||
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — customer PD pools and PPP profile bindings
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 pool
|
||||
add name=verona-cust-pd-1 prefix=2606:1c80:1001::/48 prefix-length=56
|
||||
add name=altoga-cust-pd-1 prefix=2606:1c80:1501::/48 prefix-length=56
|
||||
|
||||
/ppp profile
|
||||
set [find name=pppoe-verona] remote-ipv6-prefix-pool=verona-cust-pd-1 dhcpv6-pd-pool=verona-cust-pd-1
|
||||
set [find name=pppoe-altoga] remote-ipv6-prefix-pool=altoga-cust-pd-1 dhcpv6-pd-pool=altoga-cust-pd-1
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall (mirror v4 hygiene; deny by default)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 firewall filter
|
||||
add chain=input action=accept connection-state=established,related comment="established"
|
||||
add chain=input action=drop connection-state=invalid comment="invalid"
|
||||
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
||||
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
|
||||
add chain=input action=drop comment="default deny"
|
||||
|
||||
add chain=forward action=accept connection-state=established,related comment="established"
|
||||
add chain=forward action=drop connection-state=invalid comment="invalid"
|
||||
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
||||
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
|
||||
add chain=forward action=accept in-interface-list=customer comment="v6 outbound from customers"
|
||||
add chain=forward action=drop comment="default deny"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP to edge over v4 transport, carrying v6 NLRI
|
||||
# -----------------------------------------------------------------------------
|
||||
# ROS 7.21.4 syntax notes (verified live on verona 2026-05-09):
|
||||
# - parameter is `afi=ip,ipv6` NOT `address-families=...`
|
||||
# - need a `/routing bgp instance` to reference (carries the local AS)
|
||||
# - `templates=default` ties it to the existing /routing/bgp/template
|
||||
# Output filter: advertise verona's own routes — verona+altoga /44 customer
|
||||
# aggregates, verona loopback /128, and connected /64 P2Ps to climax (:20)
|
||||
# and graham's home (:30). Core (the v6 RR) reflects these to every other
|
||||
# client. Anything else is rejected so we don't leak customer LANs etc.
|
||||
/routing filter rule
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1000::/44 || dst==2606:1c80:1500::/44 || dst==2606:1c80:0:10::101/128 || (dst-len==64 && (dst==2606:1c80:0:20::/64 || dst==2606:1c80:0:30::/64))) { accept; } else { reject; }"
|
||||
|
||||
/routing bgp instance
|
||||
add name=bgp-instance-1 as=393837 router-id=10.254.254.101
|
||||
|
||||
# Single iBGP session to CORE (which is the v6 route reflector for the fleet).
|
||||
# v6 transport (loopback-to-loopback) — sidesteps the v4-mapped-next-hop bug
|
||||
# we saw with v4 transport carrying v6 NLRI.
|
||||
# output.redistribute=connected,static picks up the loopback /128 (connected)
|
||||
# and the customer /44 blackhole aggregates (static); the filter chain narrows
|
||||
# to just those three prefixes.
|
||||
/routing bgp connection
|
||||
add name=ibgp-rr-core instance=bgp-instance-1 templates=default \
|
||||
afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::101 \
|
||||
remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \
|
||||
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
output.redistribute=connected,static \
|
||||
comment="iBGP to core (v6 RR), v6 transport"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# VERIFY — paste these after the apply
|
||||
# -----------------------------------------------------------------------------
|
||||
# /ipv6 address print
|
||||
# /ipv6 route print where active
|
||||
# /ipv6 nd print
|
||||
# /ipv6 pool print
|
||||
# /ppp profile print where name~"pppoe-"
|
||||
# /routing bgp connection print
|
||||
# /routing bgp session print
|
||||
#
|
||||
# Once climax has its v6 apply done:
|
||||
# /ping 2606:1c80:0:20::2 count=3 ;; climax P2P side
|
||||
# /ping 2606:1c80:0:10::102 count=3 ;; climax loopback
|
||||
# Once edge is done end-to-end:
|
||||
# /ping 2606:1c80:0:10::254 count=3 ;; edge loopback
|
||||
# /ping 2606:4700:4700::1111 count=3 ;; cloudflare end-to-end
|
||||
# /routing bgp session print ;; ibgp-edge-v6 should be Established
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-11 16:45:08 by RouterOS 7.21.4
|
||||
# 2026-05-11 16:47:21 by RouterOS 7.21.4
|
||||
# software id = Y1CT-1WB1
|
||||
#
|
||||
# model = CCR2004-16G-2S+
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue