From fdba19899fe5904251a13cb466d710a282753cc4 Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Mon, 11 May 2026 16:47:40 -0500 Subject: [PATCH] routers update --- mikrotik-tool/494-v6-apply.rsc | 119 ----- mikrotik-tool/494.rsc | 2 +- mikrotik-tool/982-v6-apply.rsc | 119 ----- mikrotik-tool/982.rsc | 2 +- mikrotik-tool/climax-v6-apply.rsc | 170 ------- mikrotik-tool/climax.rsc | 2 +- mikrotik-tool/core-v6-apply.rsc | 224 --------- mikrotik-tool/core.rsc | 2 +- mikrotik-tool/culleoka-v6-apply.rsc | 149 ------ mikrotik-tool/culleoka.rsc | 2 +- mikrotik-tool/edge-v6-apply.rsc | 173 ------- mikrotik-tool/edge-working.rsc | 720 ---------------------------- mikrotik-tool/edge.rsc | 2 +- mikrotik-tool/home-v6-apply.rsc | 129 ----- mikrotik-tool/home.rsc | 2 +- mikrotik-tool/lowry-v6-apply.rsc | 119 ----- mikrotik-tool/lowry.rsc | 2 +- mikrotik-tool/newhope-v6-apply.rsc | 141 ------ mikrotik-tool/newhope.rsc | 2 +- mikrotik-tool/verona-v6-apply.rsc | 181 ------- mikrotik-tool/verona.rsc | 2 +- 21 files changed, 10 insertions(+), 2254 deletions(-) delete mode 100644 mikrotik-tool/494-v6-apply.rsc delete mode 100644 mikrotik-tool/982-v6-apply.rsc delete mode 100644 mikrotik-tool/climax-v6-apply.rsc delete mode 100644 mikrotik-tool/core-v6-apply.rsc delete mode 100644 mikrotik-tool/culleoka-v6-apply.rsc delete mode 100644 mikrotik-tool/edge-v6-apply.rsc delete mode 100644 mikrotik-tool/edge-working.rsc delete mode 100644 mikrotik-tool/home-v6-apply.rsc delete mode 100644 mikrotik-tool/lowry-v6-apply.rsc delete mode 100644 mikrotik-tool/newhope-v6-apply.rsc delete mode 100644 mikrotik-tool/verona-v6-apply.rsc diff --git a/mikrotik-tool/494-v6-apply.rsc b/mikrotik-tool/494-v6-apply.rsc deleted file mode 100644 index da44f2f..0000000 --- a/mikrotik-tool/494-v6-apply.rsc +++ /dev/null @@ -1,119 +0,0 @@ -# ============================================================================= -# 494 — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3) -# ============================================================================= -# -# 494 is a leaf tower. Single backbone P2P: -# * climax (north) — ether2-climax (AF11), v6 P2P 2606:1c80:0:17::/64 (494 .2) -# Default upstream toward climax via :17::1 — climax forwards to core. -# -# Loopback: 2606:1c80:0:10::111/128 -# /44 customer aggregate: 2606:1c80:1A00::/44 -# Mgmt LAN: 2606:1c80:1A00::1/64 (assumes `mgmt` bridge — verify name first). -# PPPoE profile assumed `pppoe`. Customer interface-list assumed `customer`. -# ============================================================================= - -# ----------------------------------------------------------------------------- -# WIPE -# ----------------------------------------------------------------------------- -/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool="" -/ipv6 dhcp-server remove [find] -/ipv6 dhcp-server option remove [find] -/ipv6 dhcp-client remove [find] -/ipv6 nd prefix remove [find] -/ipv6 nd remove [find default=no] -/ipv6 pool remove [find] -/ipv6 route remove [find dynamic=no] -/ipv6 firewall filter remove [find] -/ipv6 firewall mangle remove [find] -/ipv6 firewall raw remove [find] -/ipv6 address remove [find dynamic=no] - -/routing ospf interface-template remove [find area=backbone-v3] -/routing ospf area remove [find name=backbone-v3] -/routing ospf instance remove [find name=default-v3] - -/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")] - -# ----------------------------------------------------------------------------- -# APPLY — BGP instance -# ----------------------------------------------------------------------------- -/routing bgp template set [find name=default] disabled=no - -/routing bgp instance -add name=bgp-instance-1 as=393837 router-id=10.254.254.111 - -# ----------------------------------------------------------------------------- -# APPLY — addresses -# ----------------------------------------------------------------------------- -/ipv6 settings set forward=yes accept-router-advertisements=no - -/ipv6 address -add address=2606:1c80:0:10::111/128 interface=lo advertise=no comment="loopback" -add address=2606:1c80:0:17::2/64 interface=ether2-climax advertise=no comment="P2P 494<->climax" -add address=2606:1c80:1A00::1/64 interface=management advertise=yes comment="494 mgmt LAN" - -# ----------------------------------------------------------------------------- -# APPLY — static routes -# ----------------------------------------------------------------------------- -/ipv6 route -add dst-address=::/0 gateway=2606:1c80:0:17::1 distance=1 comment="default via climax" -add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:17::1 distance=1 comment="core loopback (iBGP bootstrap, via climax)" -add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:17::1 distance=1 comment="edge loopback (via climax)" -add dst-address=2606:1c80:1A00::/44 blackhole distance=200 comment="494 /44 aggregate (iBGP origin)" - -# ----------------------------------------------------------------------------- -# APPLY — neighbour discovery on the mgmt LAN -# ----------------------------------------------------------------------------- -/ipv6 nd -add interface=management ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes - -/ipv6 nd prefix -add interface=management prefix=2606:1c80:1A00::/64 autonomous=yes on-link=yes - -/ipv6 dhcp-server -add interface=management name=494-mgmt-stateless address-pool=static-only - -/ipv6 dhcp-server option -add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" - -# ----------------------------------------------------------------------------- -# APPLY — customer PD pool + bind to PPPoE profile -# ----------------------------------------------------------------------------- -/ipv6 pool -add name=494-cust-pd-1 prefix=2606:1c80:1A01::/48 prefix-length=56 - -/ppp profile -set [find name=494] remote-ipv6-prefix-pool=494-cust-pd-1 dhcpv6-pd-pool=494-cust-pd-1 - -# ----------------------------------------------------------------------------- -# APPLY — firewall -# ----------------------------------------------------------------------------- -/ipv6 firewall filter -add chain=input action=accept connection-state=established,related comment="established" -add chain=input action=drop connection-state=invalid comment="invalid" -add chain=input action=accept protocol=icmpv6 comment="icmpv6" -add chain=input action=accept src-address=fe80::/10 comment="link-local" -add chain=input action=accept src-address=2606:1c80::/32 comment="internal" -add chain=input action=drop comment="default deny" - -add chain=forward action=accept connection-state=established,related comment="established" -add chain=forward action=drop connection-state=invalid comment="invalid" -add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD" -add chain=forward action=accept protocol=icmpv6 comment="icmpv6" -add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal" -add chain=forward action=accept src-address=2606:1c80:1A00::/44 comment="v6 outbound from 494 customers" -add chain=forward action=drop comment="default deny" - -# ----------------------------------------------------------------------------- -# APPLY — iBGP to core (v6 RR) -# ----------------------------------------------------------------------------- -/routing filter rule -add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1A00::/44 || dst==2606:1c80:0:10::111/128 || (dst-len==64 && dst==2606:1c80:0:17::/64)) { accept; } else { reject; }" - -/routing bgp connection -add name=ibgp-rr-core instance=bgp-instance-1 templates=default \ - afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::111 \ - remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \ - nexthop-choice=force-self output.filter-chain=v6-ibgp-out \ - output.redistribute=connected,static \ - comment="iBGP to core (v6 RR), v6 transport" diff --git a/mikrotik-tool/494.rsc b/mikrotik-tool/494.rsc index a6e876a..931801d 100644 --- a/mikrotik-tool/494.rsc +++ b/mikrotik-tool/494.rsc @@ -1,4 +1,4 @@ -# 2026-05-11 16:45:08 by RouterOS 7.21.4 +# 2026-05-11 16:47:21 by RouterOS 7.21.4 # software id = K4QG-8NQV # # model = RB5009UG+S+ diff --git a/mikrotik-tool/982-v6-apply.rsc b/mikrotik-tool/982-v6-apply.rsc deleted file mode 100644 index 70f2472..0000000 --- a/mikrotik-tool/982-v6-apply.rsc +++ /dev/null @@ -1,119 +0,0 @@ -# ============================================================================= -# 982 — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3) -# ============================================================================= -# -# 982 is a leaf tower. Single backbone P2P: -# * core (north) — ether7-380 (60 GHz), v6 P2P 2606:1c80:0:14::/64 (982 .2) -# Default upstream toward core via :14::1. -# -# Loopback: 2606:1c80:0:10::110/128 -# /44 customer aggregate: 2606:1c80:1300::/44 -# Mgmt LAN: 2606:1c80:1300::1/64 (assumes `mgmt` bridge — verify name first). -# PPPoE profile assumed `pppoe`. Customer interface-list assumed `customer`. -# ============================================================================= - -# ----------------------------------------------------------------------------- -# WIPE -# ----------------------------------------------------------------------------- -/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool="" -/ipv6 dhcp-server remove [find] -/ipv6 dhcp-server option remove [find] -/ipv6 dhcp-client remove [find] -/ipv6 nd prefix remove [find] -/ipv6 nd remove [find default=no] -/ipv6 pool remove [find] -/ipv6 route remove [find dynamic=no] -/ipv6 firewall filter remove [find] -/ipv6 firewall mangle remove [find] -/ipv6 firewall raw remove [find] -/ipv6 address remove [find dynamic=no] - -/routing ospf interface-template remove [find area=backbone-v3] -/routing ospf area remove [find name=backbone-v3] -/routing ospf instance remove [find name=default-v3] - -/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")] - -# ----------------------------------------------------------------------------- -# APPLY — BGP instance -# ----------------------------------------------------------------------------- -/routing bgp template set [find name=default] disabled=no - -/routing bgp instance -add name=bgp-instance-1 as=393837 router-id=10.254.254.110 - -# ----------------------------------------------------------------------------- -# APPLY — addresses -# ----------------------------------------------------------------------------- -/ipv6 settings set forward=yes accept-router-advertisements=no - -/ipv6 address -add address=2606:1c80:0:10::110/128 interface=lo advertise=no comment="loopback" -add address=2606:1c80:0:14::2/64 interface=ether7-380 advertise=no comment="P2P 982<->core (60GHz)" -add address=2606:1c80:1300::1/64 interface=mgmt advertise=yes comment="982 mgmt LAN" - -# ----------------------------------------------------------------------------- -# APPLY — static routes -# ----------------------------------------------------------------------------- -/ipv6 route -add dst-address=::/0 gateway=2606:1c80:0:14::1 distance=1 comment="default via core" -add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:14::1 distance=1 comment="core loopback (iBGP bootstrap)" -add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:14::1 distance=1 comment="edge loopback via core" -add dst-address=2606:1c80:1300::/44 blackhole distance=200 comment="982 /44 aggregate (iBGP origin)" - -# ----------------------------------------------------------------------------- -# APPLY — neighbour discovery on the mgmt LAN -# ----------------------------------------------------------------------------- -/ipv6 nd -add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes - -/ipv6 nd prefix -add interface=mgmt prefix=2606:1c80:1300::/64 autonomous=yes on-link=yes - -/ipv6 dhcp-server -add interface=mgmt name=982-mgmt-stateless address-pool=static-only - -/ipv6 dhcp-server option -add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" - -# ----------------------------------------------------------------------------- -# APPLY — customer PD pool + bind to PPPoE profile -# ----------------------------------------------------------------------------- -/ipv6 pool -add name=982-cust-pd-1 prefix=2606:1c80:1301::/48 prefix-length=56 - -/ppp profile -set [find name=982] remote-ipv6-prefix-pool=982-cust-pd-1 dhcpv6-pd-pool=982-cust-pd-1 - -# ----------------------------------------------------------------------------- -# APPLY — firewall -# ----------------------------------------------------------------------------- -/ipv6 firewall filter -add chain=input action=accept connection-state=established,related comment="established" -add chain=input action=drop connection-state=invalid comment="invalid" -add chain=input action=accept protocol=icmpv6 comment="icmpv6" -add chain=input action=accept src-address=fe80::/10 comment="link-local" -add chain=input action=accept src-address=2606:1c80::/32 comment="internal" -add chain=input action=drop comment="default deny" - -add chain=forward action=accept connection-state=established,related comment="established" -add chain=forward action=drop connection-state=invalid comment="invalid" -add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD" -add chain=forward action=accept protocol=icmpv6 comment="icmpv6" -add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal" -add chain=forward action=accept src-address=2606:1c80:1300::/44 comment="v6 outbound from 982 customers" -add chain=forward action=drop comment="default deny" - -# ----------------------------------------------------------------------------- -# APPLY — iBGP to core (v6 RR) -# ----------------------------------------------------------------------------- -/routing filter rule -add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1300::/44 || dst==2606:1c80:0:10::110/128 || (dst-len==64 && dst==2606:1c80:0:14::/64)) { accept; } else { reject; }" - -/routing bgp connection -add name=ibgp-rr-core instance=bgp-instance-1 templates=default \ - afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::110 \ - remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \ - nexthop-choice=force-self output.filter-chain=v6-ibgp-out \ - output.redistribute=connected,static \ - comment="iBGP to core (v6 RR), v6 transport" diff --git a/mikrotik-tool/982.rsc b/mikrotik-tool/982.rsc index 52a7df4..b85e5d6 100644 --- a/mikrotik-tool/982.rsc +++ b/mikrotik-tool/982.rsc @@ -1,4 +1,4 @@ -# 2026-05-11 16:45:08 by RouterOS 7.21.4 +# 2026-05-11 16:47:21 by RouterOS 7.21.4 # software id = FUVS-HCM5 # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/climax-v6-apply.rsc b/mikrotik-tool/climax-v6-apply.rsc deleted file mode 100644 index 5aa0db9..0000000 --- a/mikrotik-tool/climax-v6-apply.rsc +++ /dev/null @@ -1,170 +0,0 @@ -# ============================================================================= -# climax — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3) -# ============================================================================= -# -# Climax sits between verona (south-west) and the rest of the network -# (via core). One v6 default upstream — toward core via :12::1. -# -# P2P interfaces: -# ether4-380-airfiber24 :12::/64 (climax .2, core .1) -# ether6-verona-11ghz :20::/64 (verona .1, climax .2) -# ether3-culleoka-11ghz :21::/64 (climax .1, culleoka .2) -# ether5-494 :17::/64 (climax .1, 494 .2) -# -# Mgmt LAN: bridge `mgmt`, v6 = 2606:1c80:1100::1/64 -# PPPoE customers: profile name `pppoe`, customer pool 2606:1c80:1101::/48 → /56 -# -# BFD on wireless OSPFv2 templates was already turned off on this router -# earlier today (2026-05-09) — verified via the freshly-pulled climax.rsc. -# No BFD changes here. -# ============================================================================= - -# ----------------------------------------------------------------------------- -# WIPE — drop OSPFv3 + stale internal v6 -# ----------------------------------------------------------------------------- -/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool="" -/ipv6 dhcp-server remove [find] -/ipv6 dhcp-server option remove [find] -/ipv6 dhcp-client remove [find] -/ipv6 nd prefix remove [find] -/ipv6 nd remove [find default=no] -/ipv6 pool remove [find] -/ipv6 route remove [find dynamic=no] -/ipv6 firewall filter remove [find] -/ipv6 firewall mangle remove [find] -/ipv6 firewall raw remove [find] -/ipv6 address remove [find dynamic=no] - -# OSPFv3 — instance, area, and the orphan culleoka-11ghz template entry -# (currently lives under area=backbone-v3) all get removed. -/routing ospf interface-template remove [find area=backbone-v3] -/routing ospf area remove [find name=backbone-v3] -/routing ospf instance remove [find name=default-v3] - -# Drop any stale internal v6 iBGP peers (none present, but defensive). -/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")] - -# ----------------------------------------------------------------------------- -# APPLY — BGP instance (climax has none today) -# ----------------------------------------------------------------------------- -/routing bgp instance -add name=bgp-instance-1 as=393837 router-id=10.254.254.102 - -# ----------------------------------------------------------------------------- -# APPLY — addresses -# ----------------------------------------------------------------------------- -/ipv6 settings set forward=yes accept-router-advertisements=no - -/ipv6 address -add address=2606:1c80:0:10::102/128 interface=lo advertise=no comment="loopback" -add address=2606:1c80:0:12::2/64 interface=ether4-380-airfiber24 advertise=no comment="P2P climax<->core" -add address=2606:1c80:0:20::2/64 interface=ether6-verona-11ghz advertise=no comment="P2P climax<->verona" -add address=2606:1c80:0:21::1/64 interface=ether3-culleoka-11ghz advertise=no comment="P2P climax<->culleoka" -add address=2606:1c80:0:17::1/64 interface=ether5-494 advertise=no comment="P2P climax<->494" -add address=2606:1c80:1100::1/64 interface=mgmt advertise=yes comment="climax mgmt LAN" - -# ----------------------------------------------------------------------------- -# APPLY — static routes (replace what an IGP would have learned) -# ----------------------------------------------------------------------------- -/ipv6 route -# Default upstream toward core (only one path from climax — core forwards -# upward via preseem/direct). -add dst-address=::/0 gateway=2606:1c80:0:12::1 distance=1 comment="default via core" - -# Edge loopback explicit (recursively resolved through default; explicit -# entry helps iBGP control plane converge quickly on first bring-up). -add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:12::1 distance=1 comment="edge loopback via core" - -# 494 sits one hop further out via the climax<->494 P2P; climax is the -# only neighbour that can deliver to its loopback. Without this, return -# traffic for 494's /128 from core/edge loops at climax. -add dst-address=2606:1c80:0:10::111/128 gateway=2606:1c80:0:17::2 distance=1 comment="494 loopback via P2P" - -# verona's loopback is reachable through verona's own P2P side. Adding -# this static beats the BGP-learned next-hop during convergence and -# avoids the stale-next-hop loop we hit on 2026-05-09. -add dst-address=2606:1c80:0:10::101/128 gateway=2606:1c80:0:20::1 distance=1 comment="verona loopback via P2P" - -# Blackhole climax's /44 aggregate so iBGP has the prefix to advertise. -add dst-address=2606:1c80:1100::/44 blackhole distance=200 comment="climax /44 aggregate (iBGP origin)" - -# ----------------------------------------------------------------------------- -# APPLY — neighbour discovery on the mgmt LAN (SLAAC + RDNSS) -# ----------------------------------------------------------------------------- -/ipv6 nd -add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes - -/ipv6 nd prefix -add interface=mgmt prefix=2606:1c80:1100::/64 autonomous=yes on-link=yes - -/ipv6 dhcp-server -add interface=mgmt name=climax-mgmt-stateless address-pool=static-only - -/ipv6 dhcp-server option -add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" - -# ----------------------------------------------------------------------------- -# APPLY — customer PD pool + bind to the climax PPPoE profile -# ----------------------------------------------------------------------------- -/ipv6 pool -add name=climax-cust-pd-1 prefix=2606:1c80:1101::/48 prefix-length=56 - -/ppp profile -set [find name=pppoe] remote-ipv6-prefix-pool=climax-cust-pd-1 dhcpv6-pd-pool=climax-cust-pd-1 - -# ----------------------------------------------------------------------------- -# APPLY — firewall (mirrors v4 hygiene; deny by default) -# ----------------------------------------------------------------------------- -/ipv6 firewall filter -add chain=input action=accept connection-state=established,related comment="established" -add chain=input action=drop connection-state=invalid comment="invalid" -add chain=input action=accept protocol=icmpv6 comment="icmpv6" -add chain=input action=accept src-address=fe80::/10 comment="link-local" -add chain=input action=accept src-address=2606:1c80::/32 comment="internal" -add chain=input action=drop comment="default deny" - -add chain=forward action=accept connection-state=established,related comment="established" -add chain=forward action=drop connection-state=invalid comment="invalid" -add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD" -add chain=forward action=accept protocol=icmpv6 comment="icmpv6" -add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal" -add chain=forward action=accept in-interface-list=customer comment="v6 outbound from customers" -add chain=forward action=drop comment="default deny" - -# ----------------------------------------------------------------------------- -# APPLY — iBGP to edge (v4 transport / v6 NLRI) -# ----------------------------------------------------------------------------- -# Output filter: advertise climax's own routes — /44 customer aggregate, -# loopback /128, and connected /64 P2Ps toward verona, core, culleoka, 494. -# Core (v6 RR) reflects these to every other client. -/routing filter rule -add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1100::/44 || dst==2606:1c80:0:10::102/128 || (dst-len==64 && (dst==2606:1c80:0:12::/64 || dst==2606:1c80:0:17::/64 || dst==2606:1c80:0:20::/64 || dst==2606:1c80:0:21::/64))) { accept; } else { reject; }" - -# Single iBGP session to CORE (which is the v6 route reflector for the fleet). -# v6 transport (loopback-to-loopback). output.redistribute=connected,static -# picks up the loopback /128 (connected) and the /44 blackhole aggregate -# (static); the filter chain narrows the set. -/routing bgp connection -add name=ibgp-rr-core instance=bgp-instance-1 templates=default \ - afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::102 \ - remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \ - nexthop-choice=force-self output.filter-chain=v6-ibgp-out \ - output.redistribute=connected,static \ - comment="iBGP to core (v6 RR), v6 transport" - -# ----------------------------------------------------------------------------- -# VERIFY (paste after apply) -# ----------------------------------------------------------------------------- -# /ipv6 address print -# /ipv6 route print where active -# /routing ospf neighbor print ;; only OSPFv2 should remain -# /routing bgp instance print -# /routing bgp connection print -# /routing bgp session print -# -# After core + edge have applied: -# /ping 2606:1c80:0:12::1 count=3 ;; core P2P side -# /ping 2606:1c80:0:10::253 count=3 ;; core loopback -# /ping 2606:1c80:0:10::254 count=3 ;; edge loopback -# /ping 2606:4700:4700::1111 count=3 ;; cloudflare end-to-end -# /routing bgp session print ;; ibgp-edge-v6 should be Established diff --git a/mikrotik-tool/climax.rsc b/mikrotik-tool/climax.rsc index 6350329..5dfba56 100644 --- a/mikrotik-tool/climax.rsc +++ b/mikrotik-tool/climax.rsc @@ -1,4 +1,4 @@ -# 2026-05-11 16:45:07 by RouterOS 7.21.4 +# 2026-05-11 16:47:21 by RouterOS 7.21.4 # software id = UETF-WF31 # # model = CCR2004-16G-2S+ diff --git a/mikrotik-tool/core-v6-apply.rsc b/mikrotik-tool/core-v6-apply.rsc deleted file mode 100644 index c5709ce..0000000 --- a/mikrotik-tool/core-v6-apply.rsc +++ /dev/null @@ -1,224 +0,0 @@ -# ============================================================================= -# core (380) — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3) -# ============================================================================= -# -# Core sits between edge and the towers. Two paths to edge mirror v4: -# 1. PRIMARY: sfp-sfpplus1-edge-preseem, /127 :1002::2 — edge cost 10 -# 2. BACKUP: ether3-edge-direct, /127 :11::2 — OSPFv2 cost 100 on both -# ends; v6 mirrors via static distance. -# -# Tower-facing P2Ps (per ipv6.md): -# ether5-climax :12::/64 (core .1, climax .2) -# ether4-newhope :13::/64 (core .1, newhope .2) -# ether1-982-60ghz :14::/64 (core .1, 982 .2) -# ether6-culleoka-11ghz :15::/64 (core .1, culleoka .2) -# -# Mgmt LAN: vlan10_combo1 (vlan 10 on combo1-380), v6 = 2606:1c80:1400::1/64 -# PPPoE customers: profile name `380`, customer pool 2606:1c80:1401::/48 → /56 -# -# Two pre-apply fixes required on core: -# (a) /routing/bgp/instance bgp-instance-1 currently has as=65530 — must -# be 393837 to peer iBGP with edge. We update it in place. -# (b) BFD is currently on for ether5-climax (AF24), ether4-newhope, and -# ether6-culleoka-11ghz (AF11). Per fleet policy (no BFD on -# wireless), we set use-bfd=no on those three OSPFv2 templates. -# Wired backbone (sfp-sfpplus1-edge-preseem, ether3-edge-direct) -# keeps BFD as-is. -# ============================================================================= - -# ----------------------------------------------------------------------------- -# WIPE — drop OSPFv3 + stale internal v6 -# ----------------------------------------------------------------------------- -/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool="" -/ipv6 dhcp-server remove [find] -/ipv6 dhcp-server option remove [find] -/ipv6 dhcp-client remove [find] -/ipv6 nd prefix remove [find] -/ipv6 nd remove [find default=no] -/ipv6 pool remove [find] -/ipv6 route remove [find dynamic=no] -/ipv6 firewall filter remove [find] -/ipv6 firewall mangle remove [find] -/ipv6 firewall raw remove [find] -/ipv6 address remove [find dynamic=no] - -/routing ospf interface-template remove [find area=backbone-v3] -/routing ospf area remove [find name=backbone-v3] -/routing ospf instance remove [find name=default-v3] - -/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"] -# also remove the disabled placeholder climax connection (will be replaced -# by the future climax tower's own iBGP-to-edge session). -/routing bgp connection remove [find name=climax and disabled=yes] - -# ----------------------------------------------------------------------------- -# APPLY — fix BGP instance AS (65530 → 393837 to match the fleet) -# ----------------------------------------------------------------------------- -/routing bgp instance set [find name=bgp-instance-1] as=393837 - -# ----------------------------------------------------------------------------- -# APPLY — turn off BFD on wireless backbone OSPFv2 templates -# ----------------------------------------------------------------------------- -/routing ospf interface-template set [find interfaces=ether5-climax] use-bfd=no -/routing ospf interface-template set [find interfaces=ether4-newhope] use-bfd=no -/routing ospf interface-template set [find interfaces=ether6-culleoka-11ghz] use-bfd=no - -# ----------------------------------------------------------------------------- -# APPLY — addresses -# ----------------------------------------------------------------------------- -/ipv6 settings set forward=yes accept-router-advertisements=no - -/ipv6 address -add address=2606:1c80:0:10::253/128 interface=lo advertise=no comment="loopback" -add address=2606:1c80:0:11::2/64 interface=ether3-edge-direct advertise=no comment="P2P core<->edge direct (backup)" -add address=2606:1c80:0:1002::2/64 interface=sfp-sfpplus1-edge-preseem advertise=no comment="P2P core<->edge via preseem (primary)" -add address=2606:1c80:0:12::1/64 interface=ether5-climax advertise=no comment="P2P core<->climax" -add address=2606:1c80:0:13::1/64 interface=ether4-newhope advertise=no comment="P2P core<->newhope" -add address=2606:1c80:0:14::1/64 interface=ether1-982-60ghz advertise=no comment="P2P core<->982 60GHz" -add address=2606:1c80:0:15::1/64 interface=ether6-culleoka-11ghz advertise=no comment="P2P core<->culleoka" -add address=2606:1c80:1400::1/64 interface=vlan10_combo1 advertise=yes comment="380 mgmt LAN" - -# ----------------------------------------------------------------------------- -# APPLY — static routes (replace what an IGP would have learned) -# ----------------------------------------------------------------------------- -/ipv6 route -# v6 default toward edge — preseem primary, direct backup (mirrors v4 cost relationship). -add dst-address=::/0 gateway=2606:1c80:0:1002::1 distance=1 comment="default via preseem (primary)" -add dst-address=::/0 gateway=2606:1c80:0:11::1 distance=2 comment="default via direct (backup)" - -# Edge loopback static fallback (so iBGP TCP control plane can reach edge -# even before BGP populates anything beyond defaults). -add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:1002::1 distance=1 comment="edge loopback via preseem" -add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:11::1 distance=2 comment="edge loopback via direct" - -# Per-tower /128 bootstrap statics. Every iBGP RR client needs core to be -# able to reach its loopback BEFORE the iBGP session is up — chicken/egg -# otherwise. distance=1 wins until BGP comes up; once it does, the session -# itself reflects the same /128 with the same forwarding outcome, so these -# statics stay harmlessly more-specific. Towers reached *through* climax -# (494) or *through* newhope (lowry) take the long way; directly-attached -# towers (982, culleoka, newhope) use the matching P2P. -add dst-address=2606:1c80:0:10::101/128 gateway=2606:1c80:0:12::2 distance=1 comment="verona loopback (via climax)" -add dst-address=2606:1c80:0:10::102/128 gateway=2606:1c80:0:12::2 distance=1 comment="climax loopback" -add dst-address=2606:1c80:0:10::104/128 gateway=2606:1c80:0:15::2 distance=1 comment="culleoka loopback" -add dst-address=2606:1c80:0:10::108/128 gateway=2606:1c80:0:13::2 distance=1 comment="newhope loopback" -add dst-address=2606:1c80:0:10::109/128 gateway=2606:1c80:0:13::2 distance=1 comment="lowry loopback (via newhope)" -add dst-address=2606:1c80:0:10::110/128 gateway=2606:1c80:0:14::2 distance=1 comment="982 loopback" -add dst-address=2606:1c80:0:10::111/128 gateway=2606:1c80:0:12::2 distance=1 comment="494 loopback (via climax)" - -# Blackhole core's /44 aggregate so iBGP has the prefix to advertise upward. -add dst-address=2606:1c80:1400::/44 blackhole distance=200 comment="core /44 aggregate (iBGP origin)" - -# ----------------------------------------------------------------------------- -# APPLY — neighbour discovery on the 380 mgmt LAN (SLAAC + RDNSS) -# ----------------------------------------------------------------------------- -/ipv6 nd -add interface=vlan10_combo1 ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes - -/ipv6 nd prefix -add interface=vlan10_combo1 prefix=2606:1c80:1400::/64 autonomous=yes on-link=yes - -/ipv6 dhcp-server -add interface=vlan10_combo1 name=core-mgmt-stateless address-pool=static-only - -/ipv6 dhcp-server option -add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" - -# ----------------------------------------------------------------------------- -# APPLY — customer PD pool + bind to the 380 PPPoE profile -# ----------------------------------------------------------------------------- -/ipv6 pool -add name=core-cust-pd-1 prefix=2606:1c80:1401::/48 prefix-length=56 - -/ppp profile -set [find name=380] remote-ipv6-prefix-pool=core-cust-pd-1 dhcpv6-pd-pool=core-cust-pd-1 - -# ----------------------------------------------------------------------------- -# APPLY — firewall (mirrors v4 hygiene; deny by default) -# ----------------------------------------------------------------------------- -/ipv6 firewall filter -add chain=input action=accept connection-state=established,related comment="established" -add chain=input action=drop connection-state=invalid comment="invalid" -add chain=input action=accept protocol=icmpv6 comment="icmpv6" -add chain=input action=accept src-address=fe80::/10 comment="link-local" -add chain=input action=accept src-address=2606:1c80::/32 comment="internal" -add chain=input action=drop comment="default deny" - -add chain=forward action=accept connection-state=established,related comment="established" -add chain=forward action=drop connection-state=invalid comment="invalid" -add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD" -add chain=forward action=accept protocol=icmpv6 comment="icmpv6" -add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal" -add chain=forward action=accept in-interface-list=customer comment="v6 outbound from customers" -add chain=forward action=drop comment="default deny" - -# ----------------------------------------------------------------------------- -# APPLY — iBGP route reflector (core is RR; edge + every tower are RR clients) -# ----------------------------------------------------------------------------- -# Why core (not edge) is the RR: ROS 6.49 on edge does not properly reflect v6 -# NLRI even with all RR settings (cluster-id, route-reflect, multihop, correct -# in/out filters). ROS7 on core does. So core takes the RR role and edge is -# just another iBGP client — it learns tower /44s + /128 loopbacks reflected -# from core, and supplies the v6 default that core reflects back to towers. -# -# cluster-id on the bgp-instance turns this router into a route reflector. -# It must be set BEFORE adding the client connections. -/routing bgp instance set [find name=bgp-instance-1] cluster-id=10.254.254.253 - -# Filter for RR-reflected traffic (in & out): allow ::/0, any /44 (customer -# aggregates), any /64 (P2P backbone links + per-tower customer LANs), any -# /128 (router loopbacks). Reject everything else (defense in depth — keeps -# random connected /80 etc. from leaking). -# NOTE on syntax: ROS 7.21 routing-filter language doesn't accept range -# matchers like `dst-in ` or `dst > ` — only `dst==` -# and length comparisons. So we match by length-class, not by sub-range. -# The /48 covering customer-vs-infra distinction is enforced by the -# ORIGINATING router's own narrower filter (v6-ibgp-out below). -/routing filter rule -add chain=v6-rr-out disabled=no rule="if (dst==::/0 || dst-len==44 || dst-len==64 || dst-len==128) { accept; } else { reject; }" -add chain=v6-rr-in disabled=no rule="if (dst==::/0 || dst-len==44 || dst-len==64 || dst-len==128) { accept; } else { reject; }" - -# Filter for advertising CORE'S OWN connected/static routes outbound (this -# filter runs on each connection's output.filter-chain — what core ORIGINATES -# rather than what it REFLECTS). Narrow by exact prefix so only core's /44 -# customer aggregate, /128 loopback, and /64 P2P links toward each neighbour -# escape into iBGP. -add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1400::/44 || dst==2606:1c80:0:10::253/128 || (dst-len==64 && (dst==2606:1c80:0:11::/64 || dst==2606:1c80:0:12::/64 || dst==2606:1c80:0:13::/64 || dst==2606:1c80:0:14::/64 || dst==2606:1c80:0:15::/64 || dst==2606:1c80:0:1002::/64))) { accept; } else { reject; }" - -# All client connections share these settings: -# templates=default inherits keepalive/holdtime/timers -# afi=ip,ipv6 carry both v4 and v6 NLRI (v4 unused on these but harmless) -# local.role=ibgp same-AS = iBGP -# multihop=yes loopback-to-loopback (more than one hop) -# nexthop-choice=force-self pin next-hop to core's v6 loopback -# cluster=yes marks the peer as an RR client -# input.filter=v6-rr-in limit what we accept -# output.filter-chain=v6-rr-out limit what we send (covers reflected + originated) -# output.redistribute=connected,static pick up our own /44 + /128 -/routing bgp connection -add name=ibgp-rr-edge instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::254 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: edge" -add name=ibgp-rr-verona instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::101 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: verona" -add name=ibgp-rr-climax instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::102 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: climax" -add name=ibgp-rr-culleoka instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::104 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: culleoka" -add name=ibgp-rr-newhope instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::108 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: newhope" -add name=ibgp-rr-lowry instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::109 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: lowry" -add name=ibgp-rr-982 instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::110 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: 982" -add name=ibgp-rr-494 instance=bgp-instance-1 templates=default afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::253 remote.address=2606:1c80:0:10::111 remote.as=393837 multihop=yes nexthop-choice=force-self cluster=yes input.filter=v6-rr-in output.filter-chain=v6-rr-out output.redistribute=connected,static comment="RR client: 494" - -# ----------------------------------------------------------------------------- -# VERIFY (paste after apply) -# ----------------------------------------------------------------------------- -# /ipv6 address print -# /ipv6 route print where active -# /routing ospf neighbor print -# /routing ospf interface-template print where use-bfd=yes ;; should be wired-only -# /routing bgp instance print -# /routing bgp connection print -# /routing bgp session print -# -# After edge has applied: -# /ping 2606:1c80:0:1002::1 count=3 ;; edge preseem-side -# /ping 2606:1c80:0:11::1 count=3 ;; edge direct-side -# /ping 2606:1c80:0:10::254 count=3 ;; edge loopback -# /ping 2606:4700:4700::1111 count=3 ;; cloudflare end-to-end -# /routing bgp session print ;; ibgp-edge-v6 should be Established diff --git a/mikrotik-tool/core.rsc b/mikrotik-tool/core.rsc index 4a76d96..066d624 100644 --- a/mikrotik-tool/core.rsc +++ b/mikrotik-tool/core.rsc @@ -1,4 +1,4 @@ -# 2026-05-11 16:45:08 by RouterOS 7.21.4 +# 2026-05-11 16:47:21 by RouterOS 7.21.4 # software id = XS5B-41QR # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/culleoka-v6-apply.rsc b/mikrotik-tool/culleoka-v6-apply.rsc deleted file mode 100644 index 387efb3..0000000 --- a/mikrotik-tool/culleoka-v6-apply.rsc +++ /dev/null @@ -1,149 +0,0 @@ -# ============================================================================= -# culleoka — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3) -# ============================================================================= -# -# Culleoka has two upstream paths: -# * core (primary) — ether6-380-11ghz, v6 P2P 2606:1c80:0:15::/64 -# * climax (backup) — ether1-climax-11ghz, v6 P2P 2606:1c80:0:21::/64 -# The climax-↔-culleoka 11 GHz radio link is currently DOWN at the radio -# (power injector unplugged); the v6 P2P is configured but inactive until -# the radio comes back up. v4 transit currently goes via core. -# -# Loopback: 2606:1c80:0:10::104/128 -# /44 customer aggregate: 2606:1c80:1600::/44 -# Mgmt LAN: 2606:1c80:1600::1/64 — assumes a `mgmt` bridge similar to -# climax. If culleoka uses a different name (e.g. `bridge1`, `lan`), -# substitute on apply. PPPoE profile assumed `pppoe` — verify with -# /ppp profile print before applying. -# -# Customer interface-list assumed `customer` (same as climax). -# ============================================================================= - -# ----------------------------------------------------------------------------- -# WIPE — drop OSPFv3 + stale internal v6 -# ----------------------------------------------------------------------------- -/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool="" -/ipv6 dhcp-server remove [find] -/ipv6 dhcp-server option remove [find] -/ipv6 dhcp-client remove [find] -/ipv6 nd prefix remove [find] -/ipv6 nd remove [find default=no] -/ipv6 pool remove [find] -/ipv6 route remove [find dynamic=no] -/ipv6 firewall filter remove [find] -/ipv6 firewall mangle remove [find] -/ipv6 firewall raw remove [find] -/ipv6 address remove [find dynamic=no] - -/routing ospf interface-template remove [find area=backbone-v3] -/routing ospf area remove [find name=backbone-v3] -/routing ospf instance remove [find name=default-v3] - -/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")] - -# ----------------------------------------------------------------------------- -# APPLY — BGP instance -# ----------------------------------------------------------------------------- -/routing bgp template set [find name=default] disabled=no - -/routing bgp instance -add name=bgp-instance-1 as=393837 router-id=10.254.254.104 - -# ----------------------------------------------------------------------------- -# APPLY — addresses -# ----------------------------------------------------------------------------- -/ipv6 settings set forward=yes accept-router-advertisements=no - -/ipv6 address -add address=2606:1c80:0:10::104/128 interface=lo advertise=no comment="loopback" -add address=2606:1c80:0:15::2/64 interface=ether6-380-11ghz advertise=no comment="P2P culleoka<->core" -add address=2606:1c80:0:21::2/64 interface=ether1-climax-11ghz advertise=no comment="P2P culleoka<->climax (radio DOWN)" -add address=2606:1c80:1600::1/64 interface=mgmt advertise=yes comment="culleoka mgmt LAN" - -# ----------------------------------------------------------------------------- -# APPLY — static routes -# ----------------------------------------------------------------------------- -/ipv6 route -# Default upstream toward core (climax path stays as a higher-distance backup -# that becomes active automatically when the climax 11 GHz radio is brought -# back up — same shape as v4 OSPF cost relationship in CLAUDE.md). -add dst-address=::/0 gateway=2606:1c80:0:15::1 distance=1 comment="default via core (primary)" -add dst-address=::/0 gateway=2606:1c80:0:21::1 distance=100 comment="default via climax (backup, radio down)" - -# Bootstrap: reach core's v6 loopback before iBGP comes up. Distance=1 wins -# over the BGP-learned /128 (distance=200) once the session is up; both -# routes have the same forwarding outcome. -add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:15::1 distance=1 comment="core loopback (iBGP bootstrap)" -add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:15::1 distance=1 comment="edge loopback via core" - -# Blackhole the /44 so output.redistribute=static picks it up for iBGP. -add dst-address=2606:1c80:1600::/44 blackhole distance=200 comment="culleoka /44 aggregate (iBGP origin)" - -# ----------------------------------------------------------------------------- -# APPLY — neighbour discovery on the mgmt LAN (SLAAC + RDNSS) -# ----------------------------------------------------------------------------- -/ipv6 nd -add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes - -/ipv6 nd prefix -add interface=mgmt prefix=2606:1c80:1600::/64 autonomous=yes on-link=yes - -/ipv6 dhcp-server -add interface=mgmt name=culleoka-mgmt-stateless address-pool=static-only - -/ipv6 dhcp-server option -add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" - -# ----------------------------------------------------------------------------- -# APPLY — customer PD pool + bind to PPPoE profile -# ----------------------------------------------------------------------------- -/ipv6 pool -add name=culleoka-cust-pd-1 prefix=2606:1c80:1601::/48 prefix-length=56 - -/ppp profile -set [find name=pppoe] remote-ipv6-prefix-pool=culleoka-cust-pd-1 dhcpv6-pd-pool=culleoka-cust-pd-1 - -# ----------------------------------------------------------------------------- -# APPLY — firewall -# ----------------------------------------------------------------------------- -/ipv6 firewall filter -add chain=input action=accept connection-state=established,related comment="established" -add chain=input action=drop connection-state=invalid comment="invalid" -add chain=input action=accept protocol=icmpv6 comment="icmpv6" -add chain=input action=accept src-address=fe80::/10 comment="link-local" -add chain=input action=accept src-address=2606:1c80::/32 comment="internal" -add chain=input action=drop comment="default deny" - -add chain=forward action=accept connection-state=established,related comment="established" -add chain=forward action=drop connection-state=invalid comment="invalid" -add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD" -add chain=forward action=accept protocol=icmpv6 comment="icmpv6" -add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal" -add chain=forward action=accept src-address=2606:1c80:1600::/44 comment="v6 outbound from culleoka customers" -add chain=forward action=drop comment="default deny" - -# ----------------------------------------------------------------------------- -# APPLY — iBGP to core (v6 RR) -# ----------------------------------------------------------------------------- -/routing filter rule -add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1600::/44 || dst==2606:1c80:0:10::104/128 || (dst-len==64 && (dst==2606:1c80:0:15::/64 || dst==2606:1c80:0:21::/64))) { accept; } else { reject; }" - -/routing bgp connection -add name=ibgp-rr-core instance=bgp-instance-1 templates=default \ - afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::104 \ - remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \ - nexthop-choice=force-self output.filter-chain=v6-ibgp-out \ - output.redistribute=connected,static \ - comment="iBGP to core (v6 RR), v6 transport" - -# ----------------------------------------------------------------------------- -# VERIFY (paste after apply) -# ----------------------------------------------------------------------------- -# /ipv6 address print -# /ipv6 route print where active -# /routing bgp session print ;; ibgp-rr-core should be Established -# -# After session is up: -# /ping 2606:1c80:0:10::253 count=3 ;; core loopback -# /ping 2606:1c80:0:10::254 count=3 ;; edge loopback (via core) -# /ping 2606:4700:4700::1111 count=3 ;; cloudflare (needs working TWC v6) diff --git a/mikrotik-tool/culleoka.rsc b/mikrotik-tool/culleoka.rsc index fb6e617..14960c1 100644 --- a/mikrotik-tool/culleoka.rsc +++ b/mikrotik-tool/culleoka.rsc @@ -1,4 +1,4 @@ -# 2026-05-11 16:45:08 by RouterOS 7.21.4 +# 2026-05-11 16:47:21 by RouterOS 7.21.4 # software id = HVP9-3G0K # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/edge-v6-apply.rsc b/mikrotik-tool/edge-v6-apply.rsc deleted file mode 100644 index cec0cd3..0000000 --- a/mikrotik-tool/edge-v6-apply.rsc +++ /dev/null @@ -1,173 +0,0 @@ -# ============================================================================= -# edge — IPv6 apply script (ROS 6.49.18, BGP-only / no OSPFv3) -# ============================================================================= -# -# Edge is the iBGP hub: it terminates the TWC v6 eBGP peering and the v4 -# transport iBGP sessions to every tower. v6 NLRI rides v4 transport (so the -# existing v4 OSPF reachability between loopbacks is reused; no v6 IGP is -# needed). This matches the verona-v6-apply.rsc design choice. -# -# Two paths edge<->core: -# 1. PRIMARY: sfp-sfpplus11-preseem via the Preseem shaper (transparent -# L2). OSPFv2 cost on edge is the default 10. v6 P2P: -# 2606:1c80:0:1002::/64 (edge .1, core .2) -# 2. BACKUP: sfp-sfpplus7-core-direct direct fiber. OSPFv2 cost on edge -# is 100 (same on core's side). v6 P2P: -# 2606:1c80:0:11::/64 (edge .1, core .2) -# NOTE: P2P prefix is /64 not /127 — picking ::1/127 + ::2/127 puts the -# two ends in *different* /127 networks (verified live 2026-05-09). /64 -# matches the per-link allocation in ipv6.md. -# Static v6 routes for the infra /48 mirror that cost relationship by -# distance (lower = preferred): preseem at distance=1, direct at -# distance=2. -# -# What this script DOES NOT touch (USER CONSTRAINT 2026-05-09): -# * TWC v6 eBGP peer `twc-v6` (remote 2605:6000:0:8::f:372, AS11427) — -# name doesn't match the ^ibgp- wipe pattern, so it survives. -# * The 2606:1c80::/32 BGP network announcement upstream. -# * The TWC P2P address 2605:6000:0:8::f:373/127 on sfp-sfpplus12-spectrum -# — enabled, so it survives the [find disabled=yes] wipe. -# * The existing server LAN address 2606:1c80::1 on vlan9_sfpplus8 — -# enabled, so it survives. We only ADD a per-interface ND override -# to suppress RA there; the IP and prefix are unmodified. -# * v4 OSPFv2 / RIP / firewall rules — v4 control plane is unchanged. -# -# Apply order: review -> paste in winbox/SSH on edge -> verify with checks -# at the bottom -> only then run the matching `core-v6-apply.rsc` so the -# preseem and direct /127 endpoints come up symmetrically. -# ============================================================================= - -# ----------------------------------------------------------------------------- -# WIPE — only the stale internal-only v6 state on edge. Leaves TWC peering, -# the upstream /32 announcement, the server LAN address, and v4 alone. -# ----------------------------------------------------------------------------- -# Drop any disabled placeholder v6 internal addresses (none on edge today, -# but harmless if present). -/ipv6 address remove [find disabled=yes] - -# Drop any leftover OSPFv3 interface entries (we are committing to BGP-only -# for v6; any v3 instances on edge have been minimal/stub). -/routing ospf-v3 interface remove [find] - -# Drop only internal iBGP v6 peers if any exist; never touch twc-v6. -/routing bgp peer remove [find name~"^ibgp-" and address-families~"ipv6"] - -# ----------------------------------------------------------------------------- -# APPLY — addresses -# ----------------------------------------------------------------------------- -/ipv6 settings set forward=yes accept-router-advertisements=no - -/ipv6 address -add address=2606:1c80:0:10::254/128 interface=loopback advertise=no comment="edge loopback" -add address=2606:1c80:0:11::1/64 interface=sfp-sfpplus7-core-direct advertise=no comment="P2P edge<->core direct (backup)" -add address=2606:1c80:0:1002::1/64 interface=sfp-sfpplus11-preseem advertise=no comment="P2P edge<->core via preseem (primary)" - -# NOTE: the server LAN address 2606:1c80::1 on vlan9_sfpplus8 is left -# untouched per user constraint. The ND override below makes it RA-free -# without modifying the address itself. - -# ----------------------------------------------------------------------------- -# APPLY — neighbour discovery: SUPPRESS RA on the server LAN -# ----------------------------------------------------------------------------- -# Server LAN is static-only per the IPv6 plan — disable RA + DHCPv6 hints. -# A per-interface entry overrides the global default. -/ipv6 nd -add interface=vlan9_sfpplus8 disabled=no advertise=no managed-address-configuration=no other-configuration=no comment="server LAN: static only, no SLAAC" - -# ----------------------------------------------------------------------------- -# APPLY — static routes (replace what an IGP would have learned) -# ----------------------------------------------------------------------------- -# Infra /48 covers all router loopbacks (2606:1c80:0:10::/64), all P2P -# /64s, and any future infra slots. Two entries with different distances -# pin preseem as primary and direct as backup. The connected /64 server -# LAN at 2606:1c80::/64 wins by longest-prefix-match, so this /48 doesn't -# steal local server traffic. -/ipv6 route -add dst-address=2606:1c80::/48 gateway=2606:1c80:0:1002::2 distance=1 comment="infra: via preseem (primary)" -add dst-address=2606:1c80::/48 gateway=2606:1c80:0:11::2 distance=2 comment="infra: via direct (backup)" - -# Tower /44s are learned via iBGP from each tower (next-hop = tower's v6 -# loopback inside :10::/64, recursively resolved through the /48 above). -# No static needed for them. - -# ----------------------------------------------------------------------------- -# APPLY — firewall (extend the existing minimal v6 ruleset) -# ----------------------------------------------------------------------------- -# The existing v6 firewall already accepts BGP (179) and established. Add -# the rules required for internal-network forwarding + ICMPv6 / link-local. -/ipv6 firewall filter -add chain=input action=accept protocol=icmpv6 comment="icmpv6 input" -add chain=input action=accept src-address=fe80::/10 comment="link-local input" -add chain=input action=accept src-address=2606:1c80::/32 comment="internal input" - -add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD forward" -add chain=forward action=accept protocol=icmpv6 comment="icmpv6 forward" -add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal<->internal" - -# (we do not add a default-deny; edge has long-running customer transit -# paths and a sudden v6 default-deny would break them. existing rules at -# the bottom of /ipv6 firewall filter remain authoritative.) - -# ----------------------------------------------------------------------------- -# APPLY — iBGP route filters (v6) -# ----------------------------------------------------------------------------- -# Edge has ONE iBGP v6 peer: core, which is the v6 RR for the fleet. Edge is -# an RR client of core (no `route-reflect=yes` — that flag would mark the -# OTHER side as a client, but edge has no clients). Edge sends ::/0 to core -# (which reflects it to towers) and learns tower /44s + /128 loopbacks from -# core (reflected from each tower). -# -# in-filter: accept any infra/customer prefix that core (v6 RR) reflects to -# us. Length 44 = customer aggregates, 64 = backbone P2Ps + per-tower LAN /64s, -# 128 = router loopbacks. Anything else within 2606:1c80::/32 is rejected -# (defense in depth — keeps random connected /80 etc. from leaking). -/routing filter -add chain=ibgp-rr-in prefix=2606:1c80::/32 prefix-length=44-128 action=accept comment="any reflected infra/customer prefix" -add chain=ibgp-rr-in action=discard comment="default deny" - -# out-filter: edge sends only the v6 default to core (which the RR fans -# out to every tower). Anything else stays inside edge. -add chain=ibgp-rr-out prefix=::/0 prefix-length=0 action=accept comment="default route" -add chain=ibgp-rr-out action=discard comment="default deny" - -# ----------------------------------------------------------------------------- -# APPLY — iBGP peer to core (v6 transport, carrying v6 NLRI) -# ----------------------------------------------------------------------------- -# v6 transport (loopback-to-loopback over 2606:1c80:0:10::254 ↔ ::253) avoids -# the v4-mapped-next-hop bug we hit with v4 transport carrying v6 NLRI. Core -# (ROS7) is the route reflector — edge is an RR client and, importantly, NOT -# a reflector itself (ROS 6.49 does not properly reflect v6 NLRI even with -# all RR settings; that's the entire reason core has the role). -# update-source=loopback sources the TCP session from edge's loopback iface -# (which holds both 10.254.254.254 and 2606:1c80:0:10::254). -# nexthop-choice=force-self pins the next-hop edge advertises (::/0) to -# edge's own v6 loopback so towers can resolve it via the RR-reflected -# /128 path. -/routing bgp peer -add name=ibgp-rr-core remote-address=2606:1c80:0:10::253 remote-as=393837 update-source=loopback address-families=ipv6 nexthop-choice=force-self ttl=255 in-filter=ibgp-rr-in out-filter=ibgp-rr-out default-originate=always comment="iBGP to core (v6 RR), v6 transport" - -# ----------------------------------------------------------------------------- -# VERIFY (paste after apply) -# ----------------------------------------------------------------------------- -# /ipv6 address print -# /ipv6 route print where active -# /ipv6 nd print -# /routing bgp peer print where name~"v6" -# /routing bgp advertisements print peer=ibgp-verona-v6 -# -# Expected immediately: -# * /ipv6 address print shows 2606:1c80:0:10::254/128 (loopback), -# :11::1/127 (direct), :1002::1/127 (preseem), :1::/64 server LAN -# * /ipv6 nd print shows the vlan9_sfpplus8 entry with advertise=no -# * the new /48 routes show as inactive (gateway unreachable until core -# applies), which is fine -# * ibgp-verona-v6 is in `connecting` state until verona reaches edge's -# v6 loopback (which needs core configured) — for the bare TCP -# session, v4 loopback reachability is enough so the session SHOULD -# come up immediately. confirm with /routing bgp peer print. -# -# Once core has its matching v6 apply: -# /ping 2606:1c80:0:1002::2 count=3 ;; core preseem-side -# /ping 2606:1c80:0:11::2 count=3 ;; core direct-side -# /ping 2606:1c80:0:10::253 count=3 ;; core loopback (via preseem) -# /ip route check dst=2606:1c80:0:10::101 ;; verona loopback path diff --git a/mikrotik-tool/edge-working.rsc b/mikrotik-tool/edge-working.rsc deleted file mode 100644 index 75f503b..0000000 --- a/mikrotik-tool/edge-working.rsc +++ /dev/null @@ -1,720 +0,0 @@ -# may/09/2026 09:37:53 by RouterOS 6.49.18 -# software id = 8XZE-R7EJ -# -# model = CCR2004-1G-12S+2XS -# serial number = C8A70C55A930 -/interface bridge -add name=cgnat -add fast-forward=no name=loopback -/interface ethernet -set [ find default-name=ether1 ] rx-flow-control=auto tx-flow-control=auto -set [ find default-name=sfp-sfpplus7 ] auto-negotiation=no name=\ - sfp-sfpplus7-core-direct -set [ find default-name=sfp-sfpplus8 ] name=sfp-sfpplus8-server-switch \ - rx-flow-control=auto tx-flow-control=auto -set [ find default-name=sfp-sfpplus10 ] rx-flow-control=auto tx-flow-control=\ - auto -set [ find default-name=sfp-sfpplus11 ] name=sfp-sfpplus11-preseem \ - rx-flow-control=auto tx-flow-control=auto -set [ find default-name=sfp-sfpplus12 ] l2mtu=1500 name=\ - sfp-sfpplus12-spectrum rx-flow-control=auto tx-flow-control=auto -/interface vlan -add interface=sfp-sfpplus8-server-switch name=vlan9_sfpplus8 vlan-id=9 -/interface wireless security-profiles -set [ find default=yes ] supplicant-identity=MikroTik -/ip dhcp-server -add disabled=no interface=vlan9_sfpplus8 name=servers-public -/ip pool -add name=380building ranges=10.0.0.150-10.0.0.239 -add name=servers-public ranges=204.110.191.193-204.110.191.217 -/ip dhcp-server -add address-pool=380building disabled=no interface=sfp-sfpplus8-server-switch \ - name=380-building -/ppp profile -add name=RWB_sstp_profile -/queue simple -add burst-limit=1M/1M burst-threshold=1M/1M burst-time=1s/1s disabled=yes \ - limit-at=1M/1M max-limit=1M/1M name=Delinquent packet-marks=Delenquent \ - priority=2/2 target="" -add burst-limit=1/1 burst-threshold=1/1 burst-time=1s/1s disabled=yes \ - limit-at=1/1 max-limit=1/1 name=Inactive packet-marks=Inactive priority=\ - 2/2 target="" -/routing bgp instance -set default as=393837 out-filter=twc-out router-id=204.110.191.190 -/routing ospf instance -set [ find default=yes ] distribute-default=always-as-type-1 router-id=\ - 10.254.254.254 -/routing ospf-v3 instance -set [ find default=yes ] distribute-default=always-as-type-1 \ - redistribute-connected=as-type-1 router-id=10.254.254.254 -/snmp community -set [ find default=yes ] name=onehuargd4a8974y79a497yi -add addresses=204.110.188.0/22,10.0.0.0/8 name=kdyyJrT0Mm -/system logging action -add name=logs remote=204.110.191.229 remote-port=1514 src-address=\ - 10.254.254.254 target=remote -/user group -set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\ - sword,web,sniff,sensitive,api,romon,dude,tikapp" -/ip firewall connection tracking -set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \ - tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \ - tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \ - tcp-time-wait-timeout=2m udp-stream-timeout=2m udp-timeout=30s -/ip neighbor discovery-settings -set discover-interface-list=!dynamic -/ip settings -set rp-filter=strict tcp-syncookies=yes -/ipv6 settings -set accept-router-advertisements=no -/ip address -add address=71.41.226.118/30 interface=sfp-sfpplus12-spectrum network=\ - 71.41.226.116 -add address=204.110.191.186/30 interface=sfp-sfpplus11-preseem network=\ - 204.110.191.184 -add address=204.110.191.254/26 interface=vlan9_sfpplus8 network=\ - 204.110.191.192 -add address=10.254.254.254 interface=loopback network=10.254.254.254 -add address=204.110.191.182/30 interface=sfp-sfpplus7-core-direct network=\ - 204.110.191.180 -add address=10.0.0.254/24 interface=sfp-sfpplus8-server-switch network=\ - 10.0.0.0 -add address=204.110.190.129/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.130/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.131/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.132/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.133/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.134/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.135/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.136/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.137/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.138/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.139/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.140/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.141/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.142/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.143/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.144/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.145/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.146/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.147/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.148/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.149/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.150/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.151/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.152/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.153/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.154/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.155/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.156/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.157/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.158/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.159/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.160/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.161/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.162/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.163/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.164/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.165/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.166/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.167/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.168/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.169/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.170/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.171/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.172/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.173/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.174/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.175/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.176/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.177/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.178/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.179/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.180/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.181/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.182/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.183/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.184/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.185/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.186/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.187/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.188/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.189/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.190/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.191/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.192/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.193/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.194/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.195/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.196/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.197/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.198/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.199/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.200/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.201/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.202/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.203/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.204/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.205/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.206/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.207/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.208/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.209/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.210/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.211/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.212/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.213/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.214/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.215/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.216/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.217/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.218/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.219/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.220/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.221/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.222/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.223/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.224/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.225/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.226/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.227/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.228/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.229/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.230/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.231/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.232/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.233/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.234/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.235/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.236/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.237/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.238/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.239/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.240/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.241/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.242/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.243/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.244/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.245/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.246/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.247/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.248/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.249/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.250/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.251/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.252/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.253/25 interface=cgnat network=204.110.190.128 -add address=204.110.190.254/25 interface=cgnat network=204.110.190.128 -/ip dhcp-server lease -add address=10.0.0.249 client-id=1:0:21:9b:91:5c:b6 mac-address=\ - 00:21:9B:91:5C:B6 server=380-building -add address=204.110.191.205 mac-address=BC:24:11:8B:C0:9C -add address=10.0.0.250 client-id=1:48:a9:8a:38:3b:2d mac-address=\ - 48:A9:8A:38:3B:2D server=380-building -add address=10.0.0.253 client-id=\ - ff:ca:53:9:5a:0:2:0:0:ab:11:2c:53:dd:b2:c1:50:9a:35 comment=truenas \ - mac-address=BC:24:11:29:2B:5A server=380-building -add address=10.0.0.252 client-id=1:bc:24:11:f5:81:d6 mac-address=\ - BC:24:11:F5:81:D6 server=380-building -add address=10.0.0.251 client-id=1:bc:24:11:6b:73:53 mac-address=\ - BC:24:11:6B:73:53 server=380-building -/ip dhcp-server network -add address=10.0.0.0/24 dns-server=9.9.9.9,1.1.1.1 domain=vntx.net gateway=\ - 10.0.0.254 ntp-server=23.150.41.122 -add address=204.110.191.192/26 dns-server=\ - 204.110.191.240,204.110.191.250,1.1.1.1 gateway=204.110.191.254 -/ip dns -set servers=204.110.191.240,204.110.191.250 -/ip firewall address-list -add address=204.110.188.0/22 list=trusted -add address=100.64.0.0/10 list=trusted -add address=10.0.0.0/8 list=trusted -add address=35.197.73.77 list=preseem -add address=35.199.29.237 list=preseem -add address=98.97.82.0/24 comment=starlink list=trusted -add address=129.222.72.0/24 comment=starlink list=trusted -add address=129.222.73.0/24 comment=starlink list=trusted -add address=129.222.74.0/24 comment=starlink list=trusted -add address=129.222.75.0/24 comment=starlink list=trusted -add address=129.222.76.0/24 comment=starlink list=trusted -add address=129.222.77.0/24 comment=starlink list=trusted -add address=129.222.78.0/24 comment=starlink list=trusted -add address=129.222.79.0/24 comment=starlink list=trusted -add address=98.97.80.0/24 comment=starlink list=trusted -add address=98.97.81.0/24 comment=starlink list=trusted -add address=98.97.83.0/24 comment=starlink list=trusted -add address=98.97.84.0/24 comment=starlink list=trusted -add address=98.97.85.0/24 comment=starlink list=trusted -add address=98.97.86.0/24 comment=starlink list=trusted -add address=98.97.87.0/24 comment=starlink list=trusted -add address=98.97.88.0/24 comment=starlink list=trusted -add address=98.97.89.0/24 comment=starlink list=trusted -add address=98.97.90.0/24 comment=starlink list=trusted -add address=98.97.91.0/24 comment=starlink list=trusted -add address=98.97.92.0/24 comment=starlink list=trusted -add address=98.97.93.0/24 comment=starlink list=trusted -add address=98.97.94.0/24 comment=starlink list=trusted -add address=98.97.95.0/24 comment=starlink list=trusted -add address=52.158.209.86 list=trusted -add address=3.210.85.72 list=gaiia -add address=3.81.237.51 list=gaiia -add address=3.215.70.188 list=gaiia -add address=3.228.90.246 list=gaiia -add address=47.147.43.145 list=trusted -add address=71.41.226.117 comment=TWC list=BGP-NEIGHBORS -add address=204.110.191.185 comment=Preseem list=BGP-NEIGHBORS -add address=204.110.191.252 comment="Virtual RouterOS" list=BGP-NEIGHBORS -add address=204.110.188.0/22 list=bgp-networks -add address=151.243.11.0/24 list=abusive -add address=172.245.56.83 list=trusted -/ip firewall filter -add action=accept chain=input comment="BGP Input" dst-port=179 protocol=tcp -add action=accept chain=output comment="BGP Output" protocol=tcp src-port=179 -add action=accept chain=forward comment="BGP Forward" dst-port=179 protocol=\ - tcp -add action=accept chain=forward comment="BGP Forward Reply" protocol=tcp \ - src-port=179 -add action=accept chain=input comment="OSPF Input" protocol=ospf -add action=accept chain=output comment="OSPF Output" protocol=ospf -add action=accept chain=forward comment="OSPF Forward" protocol=ospf -add action=accept chain=input comment="Established Input" connection-state=\ - established,related -add action=accept chain=forward comment="Established Forward" \ - connection-state=established,related -add action=accept chain=input comment="Allow Remote Winbox" disabled=yes \ - in-interface=*18 -add action=fasttrack-connection chain=forward comment=\ - "fasttrack established/related" connection-state=established,related -add action=accept chain=forward comment="accept established/related" \ - connection-state=established,related -add action=drop chain=forward dst-address=91.190.98.0/24 log=yes -add action=accept chain=forward dst-port=23 protocol=tcp src-address=\ - 204.110.190.208 -add action=accept chain=forward dst-address=204.110.191.219 -add action=accept chain=forward dst-address=204.110.191.222 -add action=accept chain=forward dst-address=204.110.191.252 -add action=accept chain=forward dst-address=204.110.191.8 -add action=accept chain=forward dst-address=204.110.191.192/26 src-address=\ - 52.158.209.86 -add action=accept chain=forward dst-address=204.110.191.210 -add action=accept chain=forward disabled=yes dst-address=204.110.191.248 \ - dst-port=3306 log=yes protocol=tcp -add action=accept chain=forward dst-address=204.110.191.248 dst-port=3306 \ - protocol=tcp src-address-list=gaiia -add action=accept chain=forward disabled=yes dst-address=204.110.191.248 -add action=accept chain=forward dst-address=204.110.191.231 -add action=accept chain=forward dst-address=204.110.191.232 in-interface=\ - sfp-sfpplus12-spectrum -add action=tarpit chain=input protocol=tcp src-address-list=abusive -add action=drop chain=forward src-address-list=abusive -add action=accept chain=forward connection-state=established,related \ - disabled=yes -add action=accept chain=input connection-state=established,related,untracked \ - disabled=yes -add action=drop chain=forward disabled=yes dst-port=3389 in-interface=\ - sfp-sfpplus12-spectrum protocol=tcp -add action=drop chain=forward disabled=yes dst-port=3389 in-interface=\ - sfp-sfpplus12-spectrum protocol=udp -add action=drop chain=forward comment="Drop anyone in Black List (SSH)." \ - in-interface=sfp-sfpplus12-spectrum log-prefix="BL_Black List (SSH)" \ - src-address-list="Black List (SSH)" -add action=drop chain=forward comment="block incoming ftp" disabled=yes \ - dst-port=21 in-interface=sfp-sfpplus12-spectrum protocol=tcp -add action=drop chain=forward comment="block incoming telnet" dst-port=23 \ - in-interface=sfp-sfpplus12-spectrum protocol=tcp -add action=drop chain=input comment="Drop all packets from public internet whi\ - ch should not exist in public network" in-interface=\ - sfp-sfpplus12-spectrum src-address-list=NotPublic -add action=drop chain=input disabled=yes dst-port=3784 in-interface=\ - sfp-sfpplus12-spectrum log=yes protocol=udp -add action=drop chain=forward comment=bfd dst-port=3784 in-interface=\ - sfp-sfpplus12-spectrum protocol=udp -add action=drop chain=input comment=bfd dst-port=3784 in-interface=\ - sfp-sfpplus12-spectrum protocol=udp -add action=drop chain=input comment="Drop Invalid connections" \ - connection-state=invalid -add action=add-src-to-address-list address-list=winbox_blacklist \ - address-list-timeout=4w3d chain=input connection-state=new disabled=yes \ - dst-port=8291 log=yes protocol=tcp src-address-list=winbox_stage3 -add action=add-src-to-address-list address-list=winbox_stage3 \ - address-list-timeout=1m chain=input connection-state=new disabled=yes \ - dst-port=8291 protocol=tcp src-address-list=winbox_stage2 -add action=add-src-to-address-list address-list=winbox_stage2 \ - address-list-timeout=1m chain=input connection-state=new disabled=yes \ - dst-port=8291 protocol=tcp src-address-list=winbox_stage1 -add action=add-src-to-address-list address-list=winbox_stage1 \ - address-list-timeout=1m chain=input connection-state=new disabled=yes \ - dst-port=8291 protocol=tcp src-address-list=!vntx -add action=drop chain=forward comment="drop winbox brute downstream" \ - disabled=yes dst-port=8291 protocol=tcp src-address-list=winbox_blacklist -add action=accept chain=input comment="BGP Neighbors" dst-port=179 protocol=\ - tcp src-address-list=BGP-NEIGHBORS -add action=drop chain=input comment="Drop anyone in Black List (SSH)." \ - disabled=yes in-interface=sfp-sfpplus12-spectrum log-prefix=\ - "BL_Black List (SSH)" src-address-list="Black List (SSH)" -add action=jump chain=input comment="Jump to Black List (SSH) chain." \ - dst-port=22 in-interface=sfp-sfpplus12-spectrum jump-target=\ - "Black List (SSH) Chain" protocol=tcp -add action=drop chain=input comment=. dst-port=23 in-interface=\ - sfp-sfpplus12-spectrum protocol=tcp -add action=drop chain=forward comment=. dst-port=23 in-interface=\ - sfp-sfpplus12-spectrum protocol=tcp -add action=jump chain=forward comment="Jump to Black List (SSH) chain." \ - dst-port=22 in-interface=sfp-sfpplus12-spectrum jump-target=\ - "Black List (SSH) Chain" protocol=tcp -add action=add-src-to-address-list address-list="Black List (SSH)" \ - address-list-timeout=4w2d chain="Black List (SSH) Chain" comment="Transfer\ - \_repeated attempts from Black List (SSH) Stage 3 to Black List (SSH)." \ - connection-state=new in-interface=sfp-sfpplus12-spectrum log-prefix=\ - "Add_Black List (SSH)" src-address-list="Black List (SSH) Stage 3" -add action=add-src-to-address-list address-list="Black List (SSH) Stage 3" \ - address-list-timeout=1m chain="Black List (SSH) Chain" comment=\ - "Add successive attempts to Black List (SSH) Stage 3." connection-state=\ - new in-interface=sfp-sfpplus12-spectrum log-prefix=\ - "Add_Black List (SSH) S3" src-address-list="Black List (SSH) Stage 2" -add action=add-src-to-address-list address-list="Black List (SSH) Stage 2" \ - address-list-timeout=1m chain="Black List (SSH) Chain" comment=\ - "Add successive attempts to Black List (SSH) Stage 2." connection-state=\ - new in-interface=sfp-sfpplus12-spectrum log-prefix=\ - "Add_Black List (SSH) S2" src-address-list="Black List (SSH) Stage 1" -add action=add-src-to-address-list address-list="Black List (SSH) Stage 1" \ - address-list-timeout=1m chain="Black List (SSH) Chain" comment=\ - "Add initial attempt to Black List (SSH) Stage 1." connection-state=new \ - in-interface=sfp-sfpplus12-spectrum log-prefix="Add_Black List (SSH) S1" \ - src-address-list=!trusted -add action=return chain="Black List (SSH) Chain" comment=\ - "Return From Black List (SSH) chain." -add action=accept chain=forward disabled=yes dst-address=204.110.191.192/26 \ - dst-port=3306 log=yes protocol=tcp src-address=162.243.131.32 -add action=accept chain=forward dst-address=204.110.191.197 -add action=accept chain=forward comment=micromirror dst-address=\ - 204.110.191.235 -add action=accept chain=forward dst-address=204.110.191.219 -add action=accept chain=forward dst-address=204.110.191.8 -add action=accept chain=forward dst-address=204.110.191.192/26 protocol=icmp -add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=80 \ - protocol=tcp -add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=443 \ - protocol=tcp -add action=accept chain=forward dst-address=204.110.191.232 dst-port=14580 \ - protocol=tcp -add action=accept chain=forward dst-address=204.110.191.232 dst-port=14501 \ - protocol=tcp -add action=accept chain=forward comment=wireguard dst-address=204.110.191.247 \ - dst-port=51820 protocol=udp -add action=accept chain=forward dst-address=204.110.191.247 dst-port=22 \ - protocol=tcp -add action=drop chain=forward disabled=yes dst-address=204.110.191.192/26 \ - dst-port=3306 log=yes protocol=tcp -add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=53 \ - protocol=udp src-address-list=trusted -add action=accept chain=forward comment=ns2 dst-address=204.110.191.239 \ - dst-port=53 protocol=udp -add action=accept chain=forward comment=ns1 dst-address=204.110.191.249 \ - dst-port=53 protocol=udp -add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=22 \ - protocol=tcp src-address-list=trusted -add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=22 \ - protocol=tcp src-address-list=preseem -add action=accept chain=forward dst-address=204.110.191.192/26 \ - src-address-list=trusted -add action=drop chain=forward dst-address=204.110.191.192/26 \ - src-address-list=!trusted -add action=drop chain=input dst-port=8921 protocol=tcp src-address-list=\ - !trusted -add action=drop chain=forward dst-port=8921 protocol=tcp src-address-list=\ - !trusted -add action=drop chain=input disabled=yes in-interface=sfp-sfpplus12-spectrum \ - src-address=100.64.0.0/10 -add action=drop chain=output disabled=yes dst-address=100.64.0.0/10 \ - out-interface=sfp-sfpplus12-spectrum -add action=drop chain=forward disabled=yes in-interface=\ - sfp-sfpplus12-spectrum src-address=100.64.0.0/10 -add action=drop chain=forward disabled=yes out-interface=\ - sfp-sfpplus12-spectrum src-address=100.64.0.0/10 -add action=drop chain=forward disabled=yes dst-address=100.64.0.0/10 \ - out-interface=sfp-sfpplus12-spectrum -add action=accept chain=input comment="Established Input" connection-state=\ - established,related -add action=accept chain=forward comment="Established Forward" \ - connection-state=established,related -add action=accept chain=input comment=BGP dst-port=179 protocol=tcp -add action=accept chain=output comment=BGP protocol=tcp src-port=179 -add action=accept chain=forward comment=BGP dst-port=179 protocol=tcp -add action=accept chain=forward comment=BGP protocol=tcp src-port=179 -add action=accept chain=input comment=OSPF protocol=ospf -add action=accept chain=output comment=OSPF protocol=ospf -add action=accept chain=forward comment=OSPF protocol=ospf -add action=drop chain=forward dst-port=23 log-prefix=TELNET protocol=tcp -/ip firewall mangle -add action=mark-packet chain=prerouting disabled=yes new-packet-mark=Inactive \ - passthrough=no src-address-list=Inactive -add action=mark-packet chain=prerouting disabled=yes dst-address-list=\ - Inactive new-packet-mark=Inactive passthrough=no -add action=accept chain=postrouting disabled=yes protocol=tcp tcp-flags=ack -/ip firewall nat -add action=src-nat chain=srcnat comment="Internal NAT catch-all" \ - out-interface=sfp-sfpplus12-spectrum src-address=10.0.0.0/8 to-addresses=\ - 204.110.191.190 -add action=src-nat chain=srcnat out-interface=sfp-sfpplus12-spectrum \ - src-address=10.0.0.0/24 to-addresses=204.110.190.254 -add action=src-nat chain=srcnat comment="Loopback NAT" out-interface=\ - sfp-sfpplus12-spectrum src-address=10.254.254.0/24 to-addresses=\ - 204.110.191.190 -add action=src-nat chain=srcnat comment="Loopback NAT" out-interface=\ - sfp-sfpplus12-spectrum src-address=10.254.254.0/24 to-addresses=\ - 204.110.191.190 -add action=src-nat chain=srcnat out-interface=sfp-sfpplus12-spectrum \ - src-address=10.0.0.0/8 to-addresses=204.110.191.190 -add action=src-nat chain=srcnat comment="Internal Network NAT" out-interface=\ - sfp-sfpplus12-spectrum src-address=10.250.1.0/24 to-addresses=\ - 204.110.191.190 -add action=src-nat chain=srcnat comment="Internal Network NAT" out-interface=\ - sfp-sfpplus12-spectrum src-address=10.250.1.0/24 to-addresses=\ - 204.110.191.190 -add action=src-nat chain=srcnat comment="fallthrough CGNAT" disabled=yes \ - out-interface=sfp-sfpplus12-spectrum src-address=100.64.0.0/10 \ - to-addresses=204.110.190.254 -add action=netmap chain=srcnat ipsec-policy=out,none out-interface=\ - sfp-sfpplus12-spectrum src-address=100.64.0.0/10 to-addresses=\ - 204.110.190.128/25 -add action=netmap chain=dstmap comment=\ - "Port Forwarding Solution for CGNAT (TCP)" dst-address=204.110.190.128/25 \ - dst-port=1024-65535 protocol=tcp to-addresses=100.64.0.0/10 -add action=netmap chain=dstmap comment=\ - "Port Forwarding Solution for CGNAT (UDP)" dst-address=204.110.190.128/25 \ - dst-port=1024-65535 protocol=udp to-addresses=100.64.0.0/10 -/ip firewall raw -add action=drop chain=prerouting src-address-list="Black List (SSH)" -add action=drop chain=prerouting disabled=yes src-address-list=abusive -add action=drop chain=prerouting disabled=yes src-address-list=\ - winbox_blacklist -/ip proxy -set port=23435 -/ip proxy access -add src-address=204.110.188.0/22 -/ip route -add distance=1 gateway=71.41.226.117 -add distance=1 dst-address=10.10.0.0/20 gateway=204.110.191.185 -add distance=1 dst-address=10.10.16.0/20 gateway=204.110.191.185 -add distance=1 dst-address=10.250.1.8/29 gateway=204.110.191.185 -add distance=1 dst-address=10.250.1.8/29 gateway=204.110.191.185 -add distance=1 dst-address=10.250.1.24/29 gateway=204.110.191.185 -add distance=1 dst-address=10.250.1.64/29 gateway=204.110.191.185 -add distance=1 dst-address=10.250.1.64/29 gateway=204.110.191.185 -add distance=1 dst-address=10.250.1.88/29 gateway=204.110.191.185 -add distance=1 dst-address=10.250.1.88/29 gateway=204.110.191.185 -add distance=1 dst-address=10.254.254.101/32 gateway=204.110.191.185 -add distance=1 dst-address=10.254.254.102/32 gateway=204.110.191.185 -add distance=1 dst-address=100.64.0.0/10 gateway=204.110.191.185 -add distance=1 dst-address=100.64.0.0/22 gateway=204.110.191.185 -add distance=1 dst-address=100.64.4.0/22 gateway=204.110.191.185 -add distance=1 dst-address=100.64.4.0/22 gateway=204.110.191.185 -add distance=1 dst-address=100.64.12.0/22 gateway=204.110.191.185 -add distance=1 dst-address=172.63.0.0/20 gateway=204.110.191.253 -add distance=1 dst-address=204.110.188.0/22 gateway=204.110.191.181 -add distance=1 dst-address=204.110.188.0/27 gateway=204.110.191.253 -add distance=1 dst-address=204.110.188.32/27 gateway=204.110.191.185 -add distance=1 dst-address=204.110.188.32/27 gateway=204.110.191.185 -add distance=1 dst-address=204.110.188.224/27 gateway=204.110.191.185 -add distance=1 dst-address=204.110.191.0/27 gateway=204.110.191.185 -/ip service -set telnet disabled=yes -set ftp disabled=yes -set www address=204.110.188.0/22 port=2080 -set ssh address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10 port=1022 -set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10 -set api-ssl address=0.0.0.0/0 certificate=server -/ip ssh -set always-allow-password-login=yes forwarding-enabled=remote strong-crypto=\ - yes -/ipv6 address -add address=2605:6000:0:8::f:373/127 advertise=no interface=\ - sfp-sfpplus12-spectrum -add address=2606:1c80::1 interface=vlan9_sfpplus8 -add address=2606:1c80:0:10::254/128 advertise=no comment="edge loopback" \ - interface=loopback -add address=2606:1c80:0:11::1/127 advertise=no comment=\ - "P2P edge<->core direct (backup)" interface=sfp-sfpplus7-core-direct -add address=2606:1c80:0:1002::1/127 advertise=no comment=\ - "P2P edge<->core via preseem (primary)" interface=sfp-sfpplus11-preseem -/ipv6 firewall address-list -add address=2606:1c80::/32 list=bgp-networks -/ipv6 firewall filter -add action=accept chain=input comment="IPv6 BGP Input" dst-port=179 protocol=\ - tcp -add action=accept chain=output comment="IPv6 BGP Output" protocol=tcp \ - src-port=179 -add action=accept chain=forward comment="IPv6 BGP Forward" dst-port=179 \ - protocol=tcp -add action=accept chain=forward comment="IPv6 BGP Forward Reply" protocol=tcp \ - src-port=179 -add action=accept chain=input comment="IPv6 Established Input" \ - connection-state=established,related -add action=accept chain=forward comment="IPv6 Established Forward" \ - connection-state=established,related -add action=accept chain=input comment="icmpv6 input" protocol=icmpv6 -add action=accept chain=input comment="link-local input" src-address=\ - fe80::/10 -add action=accept chain=input comment="internal input" src-address=\ - 2606:1c80::/32 -add action=accept chain=forward comment="PMTUD forward" hop-limit=equal:1 \ - protocol=icmpv6 -add action=accept chain=forward comment="icmpv6 forward" protocol=icmpv6 -add action=accept chain=forward comment=internal<->internal dst-address=\ - 2606:1c80::/32 src-address=2606:1c80::/32 -/ipv6 route -add comment="infra: via preseem (primary)" distance=1 dst-address=\ - 2606:1c80::/48 gateway=2606:1c80:0:1002::2 -add comment="infra: via direct (backup)" distance=2 dst-address=\ - 2606:1c80::/48 gateway=2606:1c80:0:11::2 -/mpls interface -set [ find default=yes ] mpls-mtu=1530 -add interface=sfp-sfpplus8-server-switch mpls-mtu=1530 -/mpls ldp -set distribute-for-default-route=yes enabled=yes loop-detect=yes lsr-id=\ - 10.254.254.254 transport-address=10.254.254.254 -/mpls ldp accept-filter -add -/mpls ldp advertise-filter -add -/mpls ldp interface -add disabled=yes interface=ether1 -add disabled=yes interface=sfp-sfpplus11-preseem transport-address=\ - 10.254.254.254 -add disabled=yes interface=vlan9_sfpplus8 transport-address=10.254.254.254 -add interface=sfp-sfpplus8-server-switch -/routing bfd interface -set [ find default=yes ] disabled=yes -add interface=sfp-sfpplus7-core-direct -add interface=sfp-sfpplus11-preseem -/routing bgp network -add network=204.110.188.0/22 synchronize=no -add network=2606:1c80::/32 synchronize=no -/routing bgp peer -add in-filter=twc-in name=twc out-filter=twc-out remote-address=71.41.226.117 \ - remote-as=11427 ttl=default -add address-families=ipv6 in-filter=twc-in name=twc-v6 out-filter=twc-out \ - remote-address=2605:6000:0:8::f:372 remote-as=11427 ttl=default -add comment="TEAM-CYMRU BOGON Server #1" disabled=yes in-filter=\ - BOGON-SERVER-IN max-prefix-limit=50 multihop=yes name=CYMRU-1 out-filter=\ - BGP-DROP remote-address=38.229.6.20 remote-as=65332 tcp-md5-key=\ - mC9LaaOi0P -add comment="TEAM-CYMRU BOGON Server #2" disabled=yes in-filter=\ - BOGON-SERVER-IN max-prefix-limit=50 multihop=yes name=CYMRU-1 out-filter=\ - BGP-DROP remote-address=38.229.46.20 remote-as=65332 tcp-md5-key=\ - mC9LaaOi0P -add address-families=ip,ipv6 default-originate=always disabled=yes name=\ - edge_core_preseem nexthop-choice=propagate out-filter=bgp-default-only \ - remote-address=204.110.191.185 remote-as=393837 -add address-families=ipv6 comment="iBGP to verona, v4 transport / v6 NLRI" \ - default-originate=always in-filter=ibgp-tower-in-v6 name=ibgp-verona-v6 \ - nexthop-choice=force-self out-filter=ibgp-tower-out-v6 remote-address=\ - 10.254.254.101 remote-as=393837 update-source=loopback -/routing filter -add action=accept chain=twc-out comment=blackhole disabled=yes prefix=\ - 204.110.188.197 prefix-length=32 set-bgp-communities=7486:666 -add action=accept chain=twc-in prefix=0.0.0.0/0 -add action=accept chain=twc-in prefix=0.0.0.0/0 prefix-length=0 -add action=discard chain=twc-in disabled=yes prefix=0.0.0.0 prefix-length=\ - 0-32 protocol="" -add action=accept chain=twc-out prefix=204.110.188.0/22 -add action=accept chain=twc-out prefix=2606:1c80::/32 -add action=discard chain=twc-out -add action=discard chain=BGP-DROP -add action=accept bgp-communities=65333:888 chain=BOGON-SERVER-IN disabled=\ - yes set-type=blackhole -add action=discard chain=BOGON-SERVER-IN disabled=yes -add action=discard chain=BGP-DROP -add action=accept chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \ - prefix-length=0 -add action=discard chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \ - prefix-length=0-32 -add action=accept chain=ibgp-tower-in-v6 comment=\ - "tower /44 customer aggregate" prefix=2606:1c80:1000::/36 prefix-length=\ - 44 -add action=accept chain=ibgp-tower-in-v6 comment="tower v6 loopback" prefix=\ - 2606:1c80:0:10::/64 prefix-length=128 -add action=discard chain=ibgp-tower-in-v6 comment="default deny" -add action=accept chain=ibgp-tower-out-v6 comment="default route to tower" \ - prefix=::/0 prefix-length=0 -add action=discard chain=ibgp-tower-out-v6 comment="default deny" -/routing ospf interface -add interface=sfp-sfpplus12-spectrum network-type=broadcast passive=yes -add interface=sfp-sfpplus11-preseem network-type=point-to-point use-bfd=yes -add cost=20 interface=sfp-sfpplus9 network-type=nbma use-bfd=yes -add interface=sfp-sfpplus10 network-type=nbma passive=yes -add cost=20 interface=ether1 network-type=broadcast -add interface=sfp-sfpplus8-server-switch network-type=broadcast -add cost=100 interface=sfp-sfpplus7-core-direct network-type=point-to-point \ - use-bfd=yes -add interface=vlan9_sfpplus8 network-type=nbma -/routing ospf nbma-neighbor -add address=204.110.191.189 poll-interval=10s -add address=10.250.1.94 -add address=10.250.1.57 -add address=10.250.1.201 -add address=10.250.2.1 -add address=204.110.191.185 poll-interval=10s -add address=204.110.191.252 poll-interval=10s -/routing ospf network -add area=backbone -/routing rip -set distribute-default=always redistribute-connected=yes redistribute-ospf=\ - yes -/routing rip interface -add interface=sfp-sfpplus11-preseem -add interface=sfp-sfpplus7-core-direct -add interface=sfp-sfpplus8-server-switch -/routing rip network -add -/snmp -set contact="Verona Networks" enabled=yes location="Verona Networks" -/system clock -set time-zone-name=America/Chicago -/system identity -set name=edge -/system logging -add action=logs topics=info -/system note -set note="__ __\ - \n\\ \\ / /__ _ __ ___ _ __ __ _\ - \n \\ \\ / / _ \\ '__/ _ \\| '_ \\ / _` |\ - \n \\ V / __/ | | (_) | | | | (_| |\ - \n \\_/ \\___|_| \\___/|_| |_|\\__,_|\ - \n _ _ _ _\ - \n| \\ | | ___| |___ _____ _ __| | _____\ - \n| \\| |/ _ \\ __\\ \\ /\\ / / _ \\| '__| |/ / __|\ - \n| |\\ | __/ |_ \\ V V / (_) | | | <\\__ \\\ - \n|_| \\_|\\___|\\__| \\_/\\_/ \\___/|_| |_|\\_\\___/\ - \n\ - \n###############################################################\ - \n# Welcome to Verona Networks #\ - \n# All connections are monitored and recorded #\ - \n# Disconnect IMMEDIATELY if you are not an authorized user! #\ - \n###############################################################\ - \n\ - \n" show-at-login=no -/system ntp client -set enabled=yes primary-ntp=162.159.200.1 secondary-ntp=45.79.1.70 -/system routerboard settings -set auto-upgrade=yes -/system scheduler -add name=reboot on-event="/system reboot\r\ - \n" policy=\ - ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \ - start-date=jun/14/2023 start-time=03:00:00 -add comment=RWB_IP_RESOLVER interval=5m name=RWB_IP_RESOLVER on-event=\ - RWB_IP_RESOLVER policy=\ - ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \ - start-date=oct/13/2022 start-time=22:59:02 -/tool graphing interface -add allow-address=204.110.188.0/22 -/tool graphing queue -add allow-address=204.110.188.0/22 -/tool graphing resource -add allow-address=204.110.188.0/22 -/tool romon -set enabled=yes -/user aaa -set default-group=full diff --git a/mikrotik-tool/edge.rsc b/mikrotik-tool/edge.rsc index 3ff055b..0fc1193 100644 --- a/mikrotik-tool/edge.rsc +++ b/mikrotik-tool/edge.rsc @@ -1,4 +1,4 @@ -# may/11/2026 16:45:07 by RouterOS 6.49.18 +# may/11/2026 16:47:21 by RouterOS 6.49.18 # software id = 8XZE-R7EJ # # model = CCR2004-1G-12S+2XS diff --git a/mikrotik-tool/home-v6-apply.rsc b/mikrotik-tool/home-v6-apply.rsc deleted file mode 100644 index 5745c4a..0000000 --- a/mikrotik-tool/home-v6-apply.rsc +++ /dev/null @@ -1,129 +0,0 @@ -# ============================================================================= -# graham's home router — IPv6 apply (RB5009UG+S+, ROS 7.22.3) -# ============================================================================= -# -# This is graham's home — multi-WAN: TMHI primary, VNTX secondary, Starlink -# last-resort. v6 source is T-Mobile Home Internet's gateway via DHCPv6-PD -# on ether6-tmobile. Switched off the verona-PD path on 2026-05-09 because -# TWC isn't accepting our 2606:1c80::/32 yet (separate ticket); TMHI gives -# us a globally-reachable v6 prefix today, even if it rotates. -# -# Whatever TMHI delegates (typically /64 on residential, sometimes /60 on -# the newer gateways) populates the local `home-pd` pool. Internal LANs -# pull /64s from it: -# * bridge — main home LAN (10.0.16/24, 10.0.19/22) -# * ether3-servers — servers LAN (10.0.15.254/21) -# If TMHI only delegates a single /64, only `bridge` gets v6; the second -# `from-pool=` add will error harmlessly. If they hand out a /60 or /56, -# both LANs come up. -# ============================================================================= - -# ----------------------------------------------------------------------------- -# WIPE — clean prior v6 config (preserve auto-link-local + Starlink ULA) -# ----------------------------------------------------------------------------- -/ipv6 firewall filter remove [find] -/ipv6 nd remove [find default=no] -/ipv6 nd prefix remove [find] -/ipv6 dhcp-server remove [find] -/ipv6 dhcp-server option remove [find] -/ipv6 dhcp-client remove [find] -/ipv6 pool remove [find name=home-pd] -/ipv6 route remove [find static=yes] -/ipv6 address remove [find dynamic=no and disabled=no] - -# ----------------------------------------------------------------------------- -# APPLY — settings -# ----------------------------------------------------------------------------- -# Forward stays on (we're a router). accept-router-advertisements=yes is -# REQUIRED on this router because TMHI only provides v6 via SLAAC — no -# DHCPv6 server, no PD downstream. Without this we wouldn't even get a -# global v6 address on ether6-tmobile. RAs we send on bridge/ether3-servers -# are not received by ourselves so this is safe to leave global. -/ipv6 settings set forward=yes accept-router-advertisements=yes - -# ----------------------------------------------------------------------------- -# APPLY — DHCPv6 client (request prefix delegation from TMHI gateway) -# ----------------------------------------------------------------------------- -# request=address,prefix asks for both an IA_NA address on the WAN and a -# delegated prefix (IA_PD) for downstream LANs. pool-name stores the PD in -# a local pool we then carve /64s out of. add-default-route=yes installs -# ::/0 via TMHI's gateway link-local on receipt. Distance 1 matches the v4 -# default priority for TMHI. -# Disabled — TMHI Sagemcom 5688W gateway runs no DHCPv6 server, only -# SLAAC. Verified 2026-05-09: client stays in status=searching... forever -# even with prefix-hint=::/56. The ROUTER itself gets v6 from RAs (above). -# Internal LANs can't get native PD from TMHI. To get v6 on internal LANs -# while routing via TMHI: add NAT66 with a ULA prefix (see notes in -# CLAUDE.md / memory). Kept here disabled so we remember the attempt. -/ipv6 dhcp-client -add interface=ether6-tmobile request=address,prefix pool-name=home-pd pool-prefix-length=64 \ - add-default-route=yes default-route-distance=1 \ - use-peer-dns=yes disabled=yes \ - comment="DHCPv6-PD from TMHI (disabled - TMHI runs SLAAC only, no PD server)" - -# Disabled fallback — re-enable manually if TMHI v6 dies and verona is up -# AND TWC has accepted our 2606:1c80::/32 (separate ticket). -add interface=ether5-vntx-static request=prefix pool-name=home-pd-vntx pool-prefix-length=64 \ - add-default-route=yes default-route-distance=2 \ - use-peer-dns=yes disabled=yes \ - comment="DHCPv6-PD from verona (disabled, fallback)" - -# ----------------------------------------------------------------------------- -# APPLY — internal LAN addresses -# ----------------------------------------------------------------------------- -# Currently no internal v6 — TMHI doesn't delegate a prefix and the verona -# path is held until TWC accepts our /32. When PD is restored, re-enable -# whichever dhcp-client is appropriate above and uncomment these: -# -# /ipv6 address -# add address=::1 from-pool=home-pd interface=bridge advertise=yes comment="home main LAN" -# add address=::1 from-pool=home-pd interface=ether3-servers advertise=yes comment="home servers LAN" - -# ----------------------------------------------------------------------------- -# APPLY — neighbour discovery on internal LANs (SLAAC + RDNSS for clients) -# ----------------------------------------------------------------------------- -# Skipped while no internal v6 prefix exists — RAs without a global prefix -# would just announce the router as a default gateway with no on-link -# prefix, which doesn't help clients. Re-enable along with the address -# block above when PD is back. -# -# /ipv6 nd -# add interface=bridge ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes -# add interface=ether3-servers ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes -# -# /ipv6 dhcp-server -# add interface=bridge name=home-bridge-stateless address-pool=static-only -# add interface=ether3-servers name=home-servers-stateless address-pool=static-only -# -# /ipv6 dhcp-server option -# add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" - -# ----------------------------------------------------------------------------- -# APPLY — firewall (mirror v4 hygiene; deny by default on input) -# ----------------------------------------------------------------------------- -/ipv6 firewall filter -add chain=input action=accept connection-state=established,related comment="established" -add chain=input action=drop connection-state=invalid comment="invalid" -add chain=input action=accept protocol=icmpv6 comment="icmpv6" -add chain=input action=accept src-address=fe80::/10 comment="link-local" -add chain=input action=accept src-address=2606:1c80::/32 comment="vntx internal" -add chain=input action=drop comment="default deny input" - -# Forward — let internal LANs reach the world; allow inbound established -# but don't accept arbitrary inbound to home hosts. -add chain=forward action=accept connection-state=established,related comment="established" -add chain=forward action=drop connection-state=invalid comment="invalid" -add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD" -add chain=forward action=accept protocol=icmpv6 comment="icmpv6" -add chain=forward action=accept in-interface=bridge comment="home outbound (bridge)" -add chain=forward action=accept in-interface=ether3-servers comment="home outbound (servers)" -add chain=forward action=drop comment="default deny forward" - -# ----------------------------------------------------------------------------- -# VERIFY (after apply) -# ----------------------------------------------------------------------------- -# /ipv6 dhcp-client print ;; should show status=bound on ether6-tmobile -# /ipv6 pool print ;; should show home-pd populated (whatever TMHI delegated) -# /ipv6 address print ;; bridge gets ::1/64; servers gets one too if TMHI gave /60+ -# /ipv6 route print where active ;; ::/0 via fe80::xxxx of TMHI gateway -# /ping 2606:4700:4700::1111 count=3 ;; cloudflare — should work once dhcp-client is bound diff --git a/mikrotik-tool/home.rsc b/mikrotik-tool/home.rsc index 322214f..400db16 100644 --- a/mikrotik-tool/home.rsc +++ b/mikrotik-tool/home.rsc @@ -1,4 +1,4 @@ -# 2026-05-11 16:45:08 by RouterOS 7.22.3 +# 2026-05-11 16:47:21 by RouterOS 7.22.3 # software id = ZGNY-ZJW7 # # model = RB5009UG+S+ diff --git a/mikrotik-tool/lowry-v6-apply.rsc b/mikrotik-tool/lowry-v6-apply.rsc deleted file mode 100644 index b79a132..0000000 --- a/mikrotik-tool/lowry-v6-apply.rsc +++ /dev/null @@ -1,119 +0,0 @@ -# ============================================================================= -# lowry — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3) -# ============================================================================= -# -# Lowry is a leaf tower. Single backbone P2P: -# * newhope (north) — ether1-newhope, v6 P2P 2606:1c80:0:18::/64 (lowry .2) -# Default upstream toward newhope :18::1, which forwards to core. -# -# Loopback: 2606:1c80:0:10::109/128 -# /44 customer aggregate: 2606:1c80:1900::/44 -# Mgmt LAN: 2606:1c80:1900::1/64 (assumes `mgmt` bridge — verify name first). -# PPPoE profile assumed `pppoe`. Customer interface-list assumed `customer`. -# ============================================================================= - -# ----------------------------------------------------------------------------- -# WIPE -# ----------------------------------------------------------------------------- -/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool="" -/ipv6 dhcp-server remove [find] -/ipv6 dhcp-server option remove [find] -/ipv6 dhcp-client remove [find] -/ipv6 nd prefix remove [find] -/ipv6 nd remove [find default=no] -/ipv6 pool remove [find] -/ipv6 route remove [find dynamic=no] -/ipv6 firewall filter remove [find] -/ipv6 firewall mangle remove [find] -/ipv6 firewall raw remove [find] -/ipv6 address remove [find dynamic=no] - -/routing ospf interface-template remove [find area=backbone-v3] -/routing ospf area remove [find name=backbone-v3] -/routing ospf instance remove [find name=default-v3] - -/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")] - -# ----------------------------------------------------------------------------- -# APPLY — BGP instance -# ----------------------------------------------------------------------------- -/routing bgp template set [find name=default] disabled=no - -/routing bgp instance -add name=bgp-instance-1 as=393837 router-id=10.254.254.109 - -# ----------------------------------------------------------------------------- -# APPLY — addresses -# ----------------------------------------------------------------------------- -/ipv6 settings set forward=yes accept-router-advertisements=no - -/ipv6 address -add address=2606:1c80:0:10::109/128 interface=lo advertise=no comment="loopback" -add address=2606:1c80:0:18::2/64 interface=ether1-newhope advertise=no comment="P2P lowry<->newhope" -add address=2606:1c80:1900::1/64 interface=management advertise=yes comment="lowry mgmt LAN" - -# ----------------------------------------------------------------------------- -# APPLY — static routes -# ----------------------------------------------------------------------------- -/ipv6 route -add dst-address=::/0 gateway=2606:1c80:0:18::1 distance=1 comment="default via newhope" -add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:18::1 distance=1 comment="core loopback (iBGP bootstrap, via newhope)" -add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:18::1 distance=1 comment="edge loopback (via newhope)" -add dst-address=2606:1c80:1900::/44 blackhole distance=200 comment="lowry /44 aggregate (iBGP origin)" - -# ----------------------------------------------------------------------------- -# APPLY — neighbour discovery on the mgmt LAN -# ----------------------------------------------------------------------------- -/ipv6 nd -add interface=management ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes - -/ipv6 nd prefix -add interface=management prefix=2606:1c80:1900::/64 autonomous=yes on-link=yes - -/ipv6 dhcp-server -add interface=management name=lowry-mgmt-stateless address-pool=static-only - -/ipv6 dhcp-server option -add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" - -# ----------------------------------------------------------------------------- -# APPLY — customer PD pool + bind to PPPoE profile -# ----------------------------------------------------------------------------- -/ipv6 pool -add name=lowry-cust-pd-1 prefix=2606:1c80:1901::/48 prefix-length=56 - -/ppp profile -set [find name=pppoe] remote-ipv6-prefix-pool=lowry-cust-pd-1 dhcpv6-pd-pool=lowry-cust-pd-1 - -# ----------------------------------------------------------------------------- -# APPLY — firewall -# ----------------------------------------------------------------------------- -/ipv6 firewall filter -add chain=input action=accept connection-state=established,related comment="established" -add chain=input action=drop connection-state=invalid comment="invalid" -add chain=input action=accept protocol=icmpv6 comment="icmpv6" -add chain=input action=accept src-address=fe80::/10 comment="link-local" -add chain=input action=accept src-address=2606:1c80::/32 comment="internal" -add chain=input action=drop comment="default deny" - -add chain=forward action=accept connection-state=established,related comment="established" -add chain=forward action=drop connection-state=invalid comment="invalid" -add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD" -add chain=forward action=accept protocol=icmpv6 comment="icmpv6" -add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal" -add chain=forward action=accept src-address=2606:1c80:1900::/44 comment="v6 outbound from lowry customers" -add chain=forward action=drop comment="default deny" - -# ----------------------------------------------------------------------------- -# APPLY — iBGP to core (v6 RR) -# ----------------------------------------------------------------------------- -/routing filter rule -add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1900::/44 || dst==2606:1c80:0:10::109/128 || (dst-len==64 && dst==2606:1c80:0:18::/64)) { accept; } else { reject; }" - -/routing bgp connection -add name=ibgp-rr-core instance=bgp-instance-1 templates=default \ - afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::109 \ - remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \ - nexthop-choice=force-self output.filter-chain=v6-ibgp-out \ - output.redistribute=connected,static \ - comment="iBGP to core (v6 RR), v6 transport" diff --git a/mikrotik-tool/lowry.rsc b/mikrotik-tool/lowry.rsc index 512c4e2..7c67a7a 100644 --- a/mikrotik-tool/lowry.rsc +++ b/mikrotik-tool/lowry.rsc @@ -1,4 +1,4 @@ -# 2026-05-11 16:45:08 by RouterOS 7.21.4 +# 2026-05-11 16:47:21 by RouterOS 7.21.4 # software id = 2I9X-PQZP # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/newhope-v6-apply.rsc b/mikrotik-tool/newhope-v6-apply.rsc deleted file mode 100644 index 55e5a2e..0000000 --- a/mikrotik-tool/newhope-v6-apply.rsc +++ /dev/null @@ -1,141 +0,0 @@ -# ============================================================================= -# newhope — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3) -# ============================================================================= -# -# Newhope is a relay tower. P2Ps: -# * core (north) — ether2-380, v6 P2P 2606:1c80:0:13::/64 (newhope .2) -# * lowry (south) — ether6-lowrycrossing, v6 P2P 2606:1c80:0:18::/64 (newhope .1) -# Default upstream toward core via :13::1. -# Lowry's loopback :10::109 is reachable through the :18::/64 link (lowry -# is dual-homed only via newhope today). -# -# Loopback: 2606:1c80:0:10::108/128 -# /44 customer aggregate: 2606:1c80:1800::/44 -# Mgmt LAN: 2606:1c80:1800::1/64 — assumes a `mgmt` bridge (verify with -# /interface/print before applying). -# PPPoE profile assumed `pppoe`. Customer interface-list assumed `customer`. -# ============================================================================= - -# ----------------------------------------------------------------------------- -# WIPE — drop OSPFv3 + stale internal v6 -# ----------------------------------------------------------------------------- -/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool="" -/ipv6 dhcp-server remove [find] -/ipv6 dhcp-server option remove [find] -/ipv6 dhcp-client remove [find] -/ipv6 nd prefix remove [find] -/ipv6 nd remove [find default=no] -/ipv6 pool remove [find] -/ipv6 route remove [find dynamic=no] -/ipv6 firewall filter remove [find] -/ipv6 firewall mangle remove [find] -/ipv6 firewall raw remove [find] -/ipv6 address remove [find dynamic=no] - -/routing ospf interface-template remove [find area=backbone-v3] -/routing ospf area remove [find name=backbone-v3] -/routing ospf instance remove [find name=default-v3] - -/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")] - -# ----------------------------------------------------------------------------- -# APPLY — BGP instance -# ----------------------------------------------------------------------------- -/routing bgp template set [find name=default] disabled=no - -/routing bgp instance -add name=bgp-instance-1 as=393837 router-id=10.254.254.108 - -# ----------------------------------------------------------------------------- -# APPLY — addresses -# ----------------------------------------------------------------------------- -/ipv6 settings set forward=yes accept-router-advertisements=no - -/ipv6 address -add address=2606:1c80:0:10::108/128 interface=lo advertise=no comment="loopback" -add address=2606:1c80:0:13::2/64 interface=ether2-380 advertise=no comment="P2P newhope<->core" -add address=2606:1c80:0:18::1/64 interface=ether6-lowrycrossing advertise=no comment="P2P newhope<->lowry" -add address=2606:1c80:1800::1/64 interface=bridge_cpe_mgmt advertise=yes comment="newhope mgmt LAN" - -# ----------------------------------------------------------------------------- -# APPLY — static routes -# ----------------------------------------------------------------------------- -/ipv6 route -add dst-address=::/0 gateway=2606:1c80:0:13::1 distance=1 comment="default via core" -add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:13::1 distance=1 comment="core loopback (iBGP bootstrap)" -add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:13::1 distance=1 comment="edge loopback via core" - -# Lowry sits one hop further out via the newhope<->lowry P2P. newhope is -# the only neighbour that can deliver to lowry's loopback, so we hold a -# static for it; without this, traffic for :10::109 from core/edge loops -# at newhope until iBGP fully converges. -add dst-address=2606:1c80:0:10::109/128 gateway=2606:1c80:0:18::2 distance=1 comment="lowry loopback via P2P" - -add dst-address=2606:1c80:1800::/44 blackhole distance=200 comment="newhope /44 aggregate (iBGP origin)" - -# ----------------------------------------------------------------------------- -# APPLY — neighbour discovery on the mgmt LAN -# ----------------------------------------------------------------------------- -/ipv6 nd -add interface=bridge_cpe_mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes - -/ipv6 nd prefix -add interface=bridge_cpe_mgmt prefix=2606:1c80:1800::/64 autonomous=yes on-link=yes - -/ipv6 dhcp-server -add interface=bridge_cpe_mgmt name=newhope-mgmt-stateless address-pool=static-only - -/ipv6 dhcp-server option -add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" - -# ----------------------------------------------------------------------------- -# APPLY — customer PD pool + bind to PPPoE profile -# ----------------------------------------------------------------------------- -/ipv6 pool -add name=newhope-cust-pd-1 prefix=2606:1c80:1801::/48 prefix-length=56 - -/ppp profile -set [find name=newhope] remote-ipv6-prefix-pool=newhope-cust-pd-1 dhcpv6-pd-pool=newhope-cust-pd-1 - -# ----------------------------------------------------------------------------- -# APPLY — firewall -# ----------------------------------------------------------------------------- -/ipv6 firewall filter -add chain=input action=accept connection-state=established,related comment="established" -add chain=input action=drop connection-state=invalid comment="invalid" -add chain=input action=accept protocol=icmpv6 comment="icmpv6" -add chain=input action=accept src-address=fe80::/10 comment="link-local" -add chain=input action=accept src-address=2606:1c80::/32 comment="internal" -add chain=input action=drop comment="default deny" - -add chain=forward action=accept connection-state=established,related comment="established" -add chain=forward action=drop connection-state=invalid comment="invalid" -add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD" -add chain=forward action=accept protocol=icmpv6 comment="icmpv6" -add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal" -add chain=forward action=accept src-address=2606:1c80:1800::/44 comment="v6 outbound from newhope customers" -add chain=forward action=accept src-address=2606:1c80:1900::/44 comment="v6 outbound from lowry customers (transit)" -add chain=forward action=drop comment="default deny" - -# ----------------------------------------------------------------------------- -# APPLY — iBGP to core (v6 RR) -# ----------------------------------------------------------------------------- -/routing filter rule -add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1800::/44 || dst==2606:1c80:0:10::108/128 || (dst-len==64 && (dst==2606:1c80:0:13::/64 || dst==2606:1c80:0:18::/64))) { accept; } else { reject; }" - -/routing bgp connection -add name=ibgp-rr-core instance=bgp-instance-1 templates=default \ - afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::108 \ - remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \ - nexthop-choice=force-self output.filter-chain=v6-ibgp-out \ - output.redistribute=connected,static \ - comment="iBGP to core (v6 RR), v6 transport" - -# ----------------------------------------------------------------------------- -# VERIFY -# ----------------------------------------------------------------------------- -# /ipv6 address print -# /ipv6 route print where active -# /routing bgp session print -# /ping 2606:1c80:0:10::253 count=3 ;; core -# /ping 2606:1c80:0:10::109 count=3 ;; lowry (after lowry applies) diff --git a/mikrotik-tool/newhope.rsc b/mikrotik-tool/newhope.rsc index 83b725f..37481e1 100644 --- a/mikrotik-tool/newhope.rsc +++ b/mikrotik-tool/newhope.rsc @@ -1,4 +1,4 @@ -# 2026-05-11 16:45:08 by RouterOS 7.21.4 +# 2026-05-11 16:47:21 by RouterOS 7.21.4 # software id = 5HTF-YFWV # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/verona-v6-apply.rsc b/mikrotik-tool/verona-v6-apply.rsc deleted file mode 100644 index 75ac1f7..0000000 --- a/mikrotik-tool/verona-v6-apply.rsc +++ /dev/null @@ -1,181 +0,0 @@ -# ============================================================================= -# verona — IPv6 apply script (v4-transport iBGP, no OSPFv3) -# ============================================================================= -# -# Design choices vs ipv6.md plan: -# * Drops OSPFv3 entirely. iBGP TCP session runs over the existing v4 -# loopback (10.254.254.101 ↔ 10.254.254.254) — v4 OSPF already provides -# reachability between v4 loopbacks, so no v6 IGP is needed for the -# session itself. The session carries IPv6 NLRI (MP-BGP, RFC 4760). -# * v6 forwarding uses a static default route via climax's v6 P2P side -# (2606:1c80:0:20::2). That gateway becomes reachable when climax's -# v6 apply runs; until then v6 customer traffic will fail past verona -# — known and accepted while the rollout proceeds tower-by-tower. -# * iBGP next-hop is forced to self (verona's v6 loopback). Edge will -# need a route to 2606:1c80:0:10::101/128 once edge is configured; -# handled in the edge apply step. -# -# Apply order: review → paste into a winbox/SSH session on verona → -# verify with the checks at the bottom. -# ============================================================================= - -# ----------------------------------------------------------------------------- -# WIPE — remove all existing internal v6 + OSPFv3 state. Leaves v4 alone. -# ----------------------------------------------------------------------------- -/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool="" -/ipv6 dhcp-server remove [find] -/ipv6 dhcp-server option remove [find] -/ipv6 dhcp-client remove [find] -/ipv6 nd prefix remove [find] -/ipv6 nd remove [find default=no] -/ipv6 pool remove [find] -/ipv6 route remove [find dynamic=no] -/ipv6 firewall filter remove [find] -/ipv6 firewall mangle remove [find] -/ipv6 firewall raw remove [find] -/ipv6 address remove [find dynamic=no] - -# OSPFv3 — remove the v3 instance, area, interface-template entry, leave v2 alone. -/routing ospf interface-template remove [find area=backbone-v3] -/routing ospf area remove [find name=backbone-v3] -/routing ospf instance remove [find name=default-v3] - -# Any leftover v6 BGP — wipe internal-only, never touch upstream peers. -/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")] - -# ----------------------------------------------------------------------------- -# APPLY — addresses -# ----------------------------------------------------------------------------- -/ipv6 settings set forward=yes accept-router-advertisements=no - -/ipv6 address -add address=2606:1c80:0:10::101/128 interface=lo advertise=no comment="loopback" -add address=2606:1c80:0:20::1/64 interface=ether3-climax-11ghz advertise=no comment="P2P verona<->climax" -add address=2606:1c80:0:30::1/64 interface=vlan9_sfpplus1 advertise=no comment="P2P verona<->graham home" -add address=2606:1c80:1000::1/64 interface=verona advertise=yes comment="verona mgmt LAN" -add address=2606:1c80:1500::1/64 interface=ether6-switch advertise=yes comment="altoga mgmt LAN" - -# ----------------------------------------------------------------------------- -# APPLY — static routes (replaces what OSPFv3 would have done) -# ----------------------------------------------------------------------------- -/ipv6 route -add dst-address=::/0 gateway=2606:1c80:0:20::2 distance=1 comment="default via climax P2P" -add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:20::2 distance=1 comment="edge loopback (iBGP target reachability fallback)" - -# Blackhole the /44 aggregates so iBGP has something to advertise. -# (ROS7 syntax: `blackhole` is a flag, not a `type=` value.) -add dst-address=2606:1c80:1000::/44 blackhole distance=200 comment="verona /44 aggregate (iBGP origin)" -add dst-address=2606:1c80:1500::/44 blackhole distance=200 comment="altoga /44 aggregate (iBGP origin)" - -# ----------------------------------------------------------------------------- -# APPLY — neighbour discovery / RA on mgmt LANs (SLAAC + RDNSS) -# ----------------------------------------------------------------------------- -/ipv6 nd -add interface=verona ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes -add interface=ether6-switch ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes - -/ipv6 nd prefix -add interface=verona prefix=2606:1c80:1000::/64 autonomous=yes on-link=yes -add interface=ether6-switch prefix=2606:1c80:1500::/64 autonomous=yes on-link=yes - -# Stateless DHCPv6 on each mgmt LAN — only carries DNS + search-domain options. -/ipv6 dhcp-server -add interface=verona name=verona-mgmt-stateless address-pool=static-only -add interface=ether6-switch name=altoga-mgmt-stateless address-pool=static-only - -# DHCPv6 PD server on vlan9_sfpplus1 — graham's home router connects there -# and is treated like a regular customer: it requests prefix delegation, -# receives a /56 from verona-cust-pd-1, and the dynamic route to that /56 -# is created automatically with gateway=client-link-local. -add interface=vlan9_sfpplus1 name=verona-wired-pd address-pool=static-only prefix-pool=verona-cust-pd-1 - -# RA on vlan9_sfpplus1 advertises the link /64 + DNS option so the home -# router learns the default route via verona's link-local automatically. -/ipv6 nd -add interface=vlan9_sfpplus1 ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes - -/ipv6 nd prefix -add interface=vlan9_sfpplus1 prefix=2606:1c80:0:30::/64 autonomous=no on-link=yes - -/ipv6 dhcp-server option -add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" - -# ----------------------------------------------------------------------------- -# APPLY — customer PD pools and PPP profile bindings -# ----------------------------------------------------------------------------- -/ipv6 pool -add name=verona-cust-pd-1 prefix=2606:1c80:1001::/48 prefix-length=56 -add name=altoga-cust-pd-1 prefix=2606:1c80:1501::/48 prefix-length=56 - -/ppp profile -set [find name=pppoe-verona] remote-ipv6-prefix-pool=verona-cust-pd-1 dhcpv6-pd-pool=verona-cust-pd-1 -set [find name=pppoe-altoga] remote-ipv6-prefix-pool=altoga-cust-pd-1 dhcpv6-pd-pool=altoga-cust-pd-1 - -# ----------------------------------------------------------------------------- -# APPLY — firewall (mirror v4 hygiene; deny by default) -# ----------------------------------------------------------------------------- -/ipv6 firewall filter -add chain=input action=accept connection-state=established,related comment="established" -add chain=input action=drop connection-state=invalid comment="invalid" -add chain=input action=accept protocol=icmpv6 comment="icmpv6" -add chain=input action=accept src-address=fe80::/10 comment="link-local" -add chain=input action=accept src-address=2606:1c80::/32 comment="internal" -add chain=input action=drop comment="default deny" - -add chain=forward action=accept connection-state=established,related comment="established" -add chain=forward action=drop connection-state=invalid comment="invalid" -add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD" -add chain=forward action=accept protocol=icmpv6 comment="icmpv6" -add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal" -add chain=forward action=accept in-interface-list=customer comment="v6 outbound from customers" -add chain=forward action=drop comment="default deny" - -# ----------------------------------------------------------------------------- -# APPLY — iBGP to edge over v4 transport, carrying v6 NLRI -# ----------------------------------------------------------------------------- -# ROS 7.21.4 syntax notes (verified live on verona 2026-05-09): -# - parameter is `afi=ip,ipv6` NOT `address-families=...` -# - need a `/routing bgp instance` to reference (carries the local AS) -# - `templates=default` ties it to the existing /routing/bgp/template -# Output filter: advertise verona's own routes — verona+altoga /44 customer -# aggregates, verona loopback /128, and connected /64 P2Ps to climax (:20) -# and graham's home (:30). Core (the v6 RR) reflects these to every other -# client. Anything else is rejected so we don't leak customer LANs etc. -/routing filter rule -add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1000::/44 || dst==2606:1c80:1500::/44 || dst==2606:1c80:0:10::101/128 || (dst-len==64 && (dst==2606:1c80:0:20::/64 || dst==2606:1c80:0:30::/64))) { accept; } else { reject; }" - -/routing bgp instance -add name=bgp-instance-1 as=393837 router-id=10.254.254.101 - -# Single iBGP session to CORE (which is the v6 route reflector for the fleet). -# v6 transport (loopback-to-loopback) — sidesteps the v4-mapped-next-hop bug -# we saw with v4 transport carrying v6 NLRI. -# output.redistribute=connected,static picks up the loopback /128 (connected) -# and the customer /44 blackhole aggregates (static); the filter chain narrows -# to just those three prefixes. -/routing bgp connection -add name=ibgp-rr-core instance=bgp-instance-1 templates=default \ - afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::101 \ - remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \ - nexthop-choice=force-self output.filter-chain=v6-ibgp-out \ - output.redistribute=connected,static \ - comment="iBGP to core (v6 RR), v6 transport" - -# ----------------------------------------------------------------------------- -# VERIFY — paste these after the apply -# ----------------------------------------------------------------------------- -# /ipv6 address print -# /ipv6 route print where active -# /ipv6 nd print -# /ipv6 pool print -# /ppp profile print where name~"pppoe-" -# /routing bgp connection print -# /routing bgp session print -# -# Once climax has its v6 apply done: -# /ping 2606:1c80:0:20::2 count=3 ;; climax P2P side -# /ping 2606:1c80:0:10::102 count=3 ;; climax loopback -# Once edge is done end-to-end: -# /ping 2606:1c80:0:10::254 count=3 ;; edge loopback -# /ping 2606:4700:4700::1111 count=3 ;; cloudflare end-to-end -# /routing bgp session print ;; ibgp-edge-v6 should be Established diff --git a/mikrotik-tool/verona.rsc b/mikrotik-tool/verona.rsc index a714817..4ae1330 100644 --- a/mikrotik-tool/verona.rsc +++ b/mikrotik-tool/verona.rsc @@ -1,4 +1,4 @@ -# 2026-05-11 16:45:08 by RouterOS 7.21.4 +# 2026-05-11 16:47:21 by RouterOS 7.21.4 # software id = Y1CT-1WB1 # # model = CCR2004-16G-2S+