# 2026-07-10 10:54:21 by RouterOS 7.21.4 # software id = 5HTF-YFWV # # model = CCR1009-7G-1C-1S+ # serial number = 6F5006EA1923 /interface bridge add name=bridge_cpe_mgmt port-cost-mode=short add name=newhope port-cost-mode=short /interface ethernet set [ find default-name=combo1 ] l2mtu=9000 rx-flow-control=auto \ tx-flow-control=auto set [ find default-name=ether1 ] l2mtu=9000 rx-flow-control=auto \ tx-flow-control=auto set [ find default-name=ether2 ] l2mtu=9000 name=ether2-380 rx-flow-control=\ auto tx-flow-control=auto set [ find default-name=ether3 ] disabled=yes l2mtu=2024 name=\ ether3-lowrycrossing-old rx-flow-control=auto tx-flow-control=auto set [ find default-name=ether4 ] disabled=yes l2mtu=2024 rx-flow-control=auto \ tx-flow-control=auto set [ find default-name=ether5 ] l2mtu=9000 name=ether5-switch \ rx-flow-control=auto tx-flow-control=auto set [ find default-name=ether6 ] l2mtu=9000 name=ether6-lowrycrossing \ rx-flow-control=auto tx-flow-control=auto set [ find default-name=ether7 ] l2mtu=9000 name=ether7-tower \ rx-flow-control=auto tx-flow-control=auto set [ find default-name=sfp-sfpplus1 ] l2mtu=9000 loop-protect=off name=\ sfp-sfpplus1-edgepoint rx-flow-control=auto tx-flow-control=auto /interface vlan add interface=ether5-switch name=mgmt_ether5 vlan-id=10 add interface=sfp-sfpplus1-edgepoint name=mgmt_sfp+ vlan-id=10 /interface lte apn set [ find default=yes ] ip-type=ipv4 use-network-apn=no /interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik /ip hotspot profile add dns-name=newhope.vntx.net hotspot-address=100.64.19.254 login-by=\ mac,http-chap mac-auth-mode=mac-as-username-and-password name=hsprof1 /ip hotspot add addresses-per-mac=unlimited idle-timeout=none interface=\ sfp-sfpplus1-edgepoint name=hotspot1 profile=hsprof1 /ip hotspot user profile set [ find default=yes ] add-mac-cookie=no on-logout="/ip hotspot host remove \ [find where address=\94\$address\94 and !authorized and !bypassed]" \ session-timeout=1h shared-users=2 /ip ipsec proposal set [ find default=yes ] auth-algorithms=sha256 enc-algorithms=\ aes-256-cbc,aes-128-cbc pfs-group=modp2048 /ip pool add name=dhcp_pool1 ranges=10.100.128.1-10.100.142.254 add name=dhcp_pool2 ranges=172.16.128.1-172.16.143.253 add name=dhcp_pool3 ranges=10.10.128.1-10.10.142.253 add name=cgnat ranges=100.64.19.1-100.64.19.249 add name=public-temp ranges=204.110.189.1-204.110.189.125 add name=cgnat-full ranges=100.64.16.1-100.64.19.249 add name=dhcp_pool6 ranges=10.0.108.1-10.0.108.249 /ip dhcp-server add address-pool=dhcp_pool3 interface=bridge_cpe_mgmt lease-script="{\ \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\ uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/cd\ c24944-c947-4e01-9c54-07a1653d2e3e\"\ \n:local url2 \"https://iptrack.vntx.net/api/dhcp\"\ \n:local max 1\ \n\ \n:local attempts 0\ \n:local success1 0\ \n:local success2 0\ \n:do {\ \n :set attempts (\$attempts+1);\ \n :if (\$leaseBound = 0) do {\ \n # Try url2 (iptrack.vntx.net) - deassignment\ \n :do {\ \n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\ t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\ und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\ \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\"}\"\ \n :set success1 1;\ \n :log info \"DHCP deassignment successfully sent to iptrack.vntx.ne\ t for \$leaseActMAC / \$leaseActIP\";\ \n } on-error={\ \n :log error \"DHCP FAILED to send deassignment to iptrack.vntx.net \ on attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\ \n }\ \n\ \n # Try url (gaiia) - deassignment\ \n :do {\ \n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\ \_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\ und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\ \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\ \\\":\\\"\\\"}\"\ \n :set success2 1;\ \n :log info \"DHCP deassignment successfully sent to gaiia AWS API f\ or \$leaseActMAC / \$leaseActIP\";\ \n } on-error={\ \n :log error \"DHCP FAILED to send deassignment to gaiia AWS API on \ attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\ \n }\ \n\ \n :if (\$success1 != 1 || \$success2 != 1) do={\ \n :delay 3s;\ \n }\ \n } else {\ \n :delay 1s;\ \n :local remoteID [/ip dhcp-server lease get [find where address=\$lea\ seActIP] agent-remote-id];\ \n\ \n # Try url2 (iptrack.vntx.net) - assignment\ \n :do {\ \n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\ t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\ und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\ \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\ \\\":\\\"\$remoteID\\\"}\"\ \n :set success1 1;\ \n :log info \"DHCP assignment successfully sent to iptrack.vntx.net \ for \$leaseActMAC / \$leaseActIP / \$remoteID\";\ \n } on-error={\ \n :log error \"DHCP FAILED to send assignment to iptrack.vntx.net on\ \_attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\"\ ;\ \n }\ \n\ \n # Try url (gaiia) - assignment\ \n :do {\ \n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\ \_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\ und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\ \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\ \\\":\\\"\$remoteID\\\"}\"\ \n :set success2 1;\ \n :log info \"DHCP assignment successfully sent to gaiia AWS API for\ \_\$leaseActMAC / \$leaseActIP / \$remoteID\";\ \n } on-error={\ \n :log error \"DHCP FAILED to send assignment to gaiia AWS API on at\ tempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\";\ \n }\ \n\ \n :if (\$success1 != 1 || \$success2 != 1) do={\ \n :delay 30s;\ \n }\ \n }\ \n :if (\$success1 = 1 && \$success2 = 1) do {\ \n :set attempts \$max;\ \n }\ \n} while ( \$attempts < \$max )\ \n}\ \n" lease-time=1h name=management add address-pool=dhcp_pool6 interface=ether7-tower lease-time=1h name=\ newhope-tower /ip smb users set [ find default=yes ] disabled=yes /ipv6 dhcp-server option add code=23 name=v6-dns /ipv6 pool add name=newhope-cust-pd-1 prefix=2606:1c80:1801::/48 prefix-length=56 /ppp profile set *0 dns-server=204.110.191.240,204.110.191.250 remote-address=dhcp_pool3 add change-tcp-mss=yes dhcpv6-pd-pool=newhope-cust-pd-1 dns-server=\ 204.110.191.240,204.110.191.250 idle-timeout=1h local-address=\ 100.64.19.253 name=newhope on-down="{\ \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\ uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\ 7f4443-fc8a-4fe0-807c-f535d2aa1865\"\ \n:local url2 \"https://iptrack.vntx.net/api/pppoe\"\ \n:local max 1\ \n\ \n:local localAddr \$\"local-address\"\ \n:local remoteAddr \$\"remote-address\"\ \n:local callerId \$\"caller-id\"\ \n:local calledId \$\"called-id\"\ \n:local interfaceName [/interface get \$interface name]\ \n\ \n:local attempts 0\ \n:local success1 0\ \n:local success2 0\ \n:do {\ \n :set attempts (\$attempts+1);\ \n\ \n # Try url2 (iptrack.vntx.net)\ \n :do {\ \n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=post \ http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"boun\ d\\\":\\\"0\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\ \\\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\ \n :set success1 1;\ \n :log info \"PPPoE deassignment successfully sent to iptrack.vntx.net\ \_for \$user / \$remoteAddr\";\ \n } on-error={\ \n :log error \"PPPoE FAILED to send deassignment to iptrack.vntx.net o\ n attempt \$attempts out of \$max for \$user / \$remoteAddr\";\ \n }\ \n\ \n # Try url (AWS API)\ \n :do {\ \n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post h\ ttp-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bound\ \\\":\\\"0\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\\\ \"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\ \n :set success2 1;\ \n :log info \"PPPoE deassignment successfully sent to gaiia AWS API fo\ r \$user / \$remoteAddr\";\ \n } on-error={\ \n :log error \"PPPoPoE FAILED to send deassignment to gaiia AWS API on\ \_attempt \$attempts out of \$max for \$user / \$remoteAddr\";\ \n }\ \n\ \n :if (\$success1 = 1 && \$success2 = 1) do {\ \n :set attempts \$max;\ \n } else {\ \n :delay 3s;\ \n }\ \n} while ( \$attempts < \$max )\ \n}\ \n" on-up="{\ \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\ uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\ 7f4443-fc8a-4fe0-807c-f535d2aa1865\"\ \n:local url2 \"https://iptrack.vntx.net/api/pppoe\"\ \n:local max 5\ \n\ \n:local localAddr \$\"local-address\"\ \n:local remoteAddr \$\"remote-address\"\ \n:local callerId \$\"caller-id\"\ \n:local calledId \$\"called-id\"\ \n:local interfaceName [/interface get \$interface name]\ \n\ \n:local attempts 0\ \n:local success1 0\ \n:local success2 0\ \n:do {\ \n :set attempts (\$attempts+1);\ \n\ \n # Try url2 (iptrack.vntx.net)\ \n :do {\ \n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=post \ http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"boun\ d\\\":\\\"1\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\ \\\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\ \n :set success1 1;\ \n :log info \"PPPoE assignment successfully sent to iptrack.vntx.net f\ or \$user / \$remoteAddr\";\ \n } on-error={\ \n :log error \"PPPoE FAILED to send assignment to iptrack.vntx.net on \ attempt \$attempts out of \$max for \$user / \$remoteAddr\";\ \n }\ \n\ \n # Try url (gaiia)\ \n :do {\ \n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post h\ ttp-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bound\ \\\":\\\"1\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\\\ \"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\ \n :set success2 1;\ \n :log info \"PPPoE assignment successfully sent to gaiia AWS API for \ \$user / \$remoteAddr\";\ \n } on-error={\ \n :log error \"PPPoE FAILED to send assignment to gaiia AWS API on att\ empt \$attempts out of \$max for \$user / \$remoteAddr\";\ \n }\ \n\ \n :if (\$success1 = 1 && \$success2 = 1) do {\ \n :set attempts \$max;\ \n } else {\ \n :delay 3s;\ \n }\ \n} while ( \$attempts < \$max )\ \n}\ \n" only-one=yes remote-address=cgnat remote-ipv6-prefix-pool=\ newhope-cust-pd-1 use-upnp=no set *FFFFFFFE dns-server=204.110.191.240,204.110.191.250 /queue type add kind=pcq name=delinquent_download pcq-classifier=dst-address \ pcq-dst-address6-mask=64 pcq-rate=64k pcq-src-address6-mask=64 \ pcq-total-limit=250000KiB add kind=pcq name=delinquent_upload pcq-classifier=src-address \ pcq-dst-address6-mask=64 pcq-rate=64k pcq-src-address6-mask=64 \ pcq-total-limit=250000KiB add kind=fq-codel name=fq-codel /queue interface set combo1 queue=fq-codel set ether1 queue=fq-codel set ether2-380 queue=fq-codel set ether3-lowrycrossing-old queue=fq-codel set ether4 queue=fq-codel set ether5-switch queue=fq-codel set ether6-lowrycrossing queue=fq-codel set ether7-tower queue=fq-codel set sfp-sfpplus1-edgepoint queue=fq-codel /routing bgp instance add as=393837 name=bgp-instance-1 router-id=10.254.254.108 /routing bgp template set default as=393837 disabled=no output.network=bgp-networks .redistribute=\ connected /routing id add disabled=no id=10.254.254.108 name=id-1 select-dynamic-id="" /routing ospf instance add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\ ospf-out redistribute=connected router-id=id-1 /routing ospf area add disabled=no instance=default-v2 name=backbone-v2 /routing rip instance add name=rip-instance-1 /snmp community set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\ kdyyJrT0Mm /system logging action set 3 remote=10.240.1.250 src-address=10.254.254.108 add name=logs remote=204.110.191.229 src-address=10.254.254.108 target=remote /interface bridge port add bridge=bridge_cpe_mgmt ingress-filtering=no interface=mgmt_ether5 \ internal-path-cost=10 path-cost=10 add bridge=bridge_cpe_mgmt ingress-filtering=no interface=mgmt_sfp+ \ internal-path-cost=10 path-cost=10 add bridge=newhope ingress-filtering=no interface=combo1 internal-path-cost=\ 10 path-cost=10 add bridge=newhope interface=ether5-switch add bridge=newhope interface=sfp-sfpplus1-edgepoint /ip firewall connection tracking set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \ tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \ tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \ tcp-time-wait-timeout=2m udp-stream-timeout=2m /ip settings set tcp-syncookies=yes /ipv6 settings set accept-router-advertisements=no /interface pppoe-server server add authentication=mschap2 default-profile=newhope disabled=no interface=\ newhope max-mru=1492 max-mtu=1492 one-session-per-host=yes service-name=\ newhope /interface sstp-server server set certificate=vntx.net.pem_0 /ip address add address=10.254.254.108 interface=lo network=10.254.254.108 add address=10.250.1.110/29 interface=ether6-lowrycrossing network=\ 10.250.1.104 add address=10.10.143.254/20 interface=bridge_cpe_mgmt network=10.10.128.0 add address=100.64.19.254/22 interface=sfp-sfpplus1-edgepoint network=\ 100.64.16.0 add address=204.110.188.190/27 interface=sfp-sfpplus1-edgepoint network=\ 204.110.188.160 add address=10.250.1.57/29 interface=ether2-380 network=10.250.1.56 add address=10.0.108.254/24 interface=ether7-tower network=10.0.108.0 /ip dhcp-client add add-default-route=no disabled=yes interface=ether1 /ip dhcp-relay add dhcp-server=38.86.38.250 interface=*A local-address=10.254.254.108 name=\ relay1 /ip dhcp-server add address-pool=cgnat dhcp-option-set=vntx interface=newhope lease-script="{\ \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\ uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/cd\ c24944-c947-4e01-9c54-07a1653d2e3e\"\ \n:local url2 \"https://iptrack.vntx.net/api/dhcp\"\ \n:local max 1\ \n\ \n:local attempts 0\ \n:local success1 0\ \n:local success2 0\ \n:do {\ \n :set attempts (\$attempts+1);\ \n :if (\$leaseBound = 0) do {\ \n # Try url2 (iptrack.vntx.net) - deassignment\ \n :do {\ \n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\ t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\ und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\ \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\"}\"\ \n :set success1 1;\ \n :log info \"DHCP deassignment successfully sent to iptrack.vntx.ne\ t for \$leaseActMAC / \$leaseActIP\";\ \n } on-error={\ \n :log error \"DHCP FAILED to send deassignment to iptrack.vntx.net \ on attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\ \n }\ \n\ \n # Try url (gaiia) - deassignment\ \n :do {\ \n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\ \_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\ und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\ \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\ \\\":\\\"\\\"}\"\ \n :set success2 1;\ \n :log info \"DHCP deassignment successfully sent to gaiia AWS API f\ or \$leaseActMAC / \$leaseActIP\";\ \n } on-error={\ \n :log error \"DHCP FAILED to send deassignment to gaiia AWS API on \ attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\ \n }\ \n\ \n :if (\$success1 != 1 || \$success2 != 1) do={\ \n :delay 3s;\ \n }\ \n } else {\ \n :delay 1s;\ \n :local remoteID [/ip dhcp-server lease get [find where address=\$lea\ seActIP] agent-remote-id];\ \n\ \n # Try url2 (iptrack.vntx.net) - assignment\ \n :do {\ \n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\ t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\ und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\ \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\ \\\":\\\"\$remoteID\\\"}\"\ \n :set success1 1;\ \n :log info \"DHCP assignment successfully sent to iptrack.vntx.net \ for \$leaseActMAC / \$leaseActIP / \$remoteID\";\ \n } on-error={\ \n :log error \"DHCP FAILED to send assignment to iptrack.vntx.net on\ \_attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\"\ ;\ \n }\ \n\ \n # Try url (gaiia) - assignment\ \n :do {\ \n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\ \_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\ und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\ \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\ \\\":\\\"\$remoteID\\\"}\"\ \n :set success2 1;\ \n :log info \"DHCP assignment successfully sent to gaiia AWS API for\ \_\$leaseActMAC / \$leaseActIP / \$remoteID\";\ \n } on-error={\ \n :log error \"DHCP FAILED to send assignment to gaiia AWS API on at\ tempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\";\ \n }\ \n\ \n :if (\$success1 != 1 || \$success2 != 1) do={\ \n :delay 30s;\ \n }\ \n }\ \n :if (\$success1 = 1 && \$success2 = 1) do {\ \n :set attempts \$max;\ \n }\ \n} while ( \$attempts < \$max )\ \n}\ \n" lease-time=1h name=newhope /ip dhcp-server alert add disabled=no interface=newhope on-alert=rogue-dhcp valid-server=\ 6C:3B:6B:E1:5D:46 /ip dhcp-server lease add address=100.64.19.250 mac-address=0C:73:EB:B0:BB:5B server=newhope add address=100.64.19.252 client-id=1:dc:2c:6e:b4:77:0 mac-address=\ DC:2C:6E:B4:77:00 server=newhope add address=100.64.19.251 mac-address=74:AC:B9:A3:E0:5C /ip dhcp-server network add address=10.0.108.0/24 dns-server=204.110.191.240,204.110.191.250 gateway=\ 10.0.108.254 ntp-server=23.150.40.242,108.61.215.221,162.254.225.152 add address=10.10.128.0/20 dns-server=204.110.191.240,204.110.191.250 domain=\ vntx.net gateway=10.10.143.254 ntp-server=\ 23.150.40.242,108.61.215.221,162.254.225.152 add address=100.64.16.0/22 dns-server=204.110.191.240,204.110.191.250 domain=\ vntx.net gateway=100.64.19.254 ntp-server=\ 23.150.40.242,108.61.215.221,162.254.225.152 add address=204.110.188.160/27 dns-server=204.110.191.240,204.110.191.250 \ domain=vntx.net gateway=204.110.188.190 ntp-server=\ 23.150.40.242,108.61.215.221,162.254.225.152 /ip dhcp-server option sets add name=vntx options=*1 /ip dns set servers=204.110.191.240,204.110.191.250 /ip firewall address-list add address=204.110.188.0/22 comment="VNTX public IPs" list=trusted add address=100.64.0.0/10 comment="CGNAT pools" list=trusted add address=10.0.0.0/8 comment="RFC 1918 private" list=trusted add address=192.168.0.0/16 comment="RFC 1918 private" list=trusted /ip firewall filter add action=accept chain=input comment="allow trusted to management services" \ dst-port=8728-8729,8291,22 protocol=tcp src-address-list=trusted add action=drop chain=input comment="drop untrusted to management services" \ dst-port=8728-8729,8291,22 protocol=tcp add action=accept chain=forward comment=\ "bypass fasttrack for MPLS spine (out)" out-interface=\ ether6-lowrycrossing add action=accept chain=forward comment=\ "bypass fasttrack for MPLS spine (in)" in-interface=ether6-lowrycrossing add action=accept chain=forward comment=\ "bypass fasttrack for MPLS spine (out)" out-interface=ether2-380 add action=accept chain=forward comment=\ "bypass fasttrack for MPLS spine (in)" in-interface=ether2-380 add action=fasttrack-connection chain=forward comment=\ "fasttrack established/related" connection-state=established,related add action=accept chain=forward comment="accept established/related" \ connection-state=established,related /ip firewall nat add action=masquerade chain=srcnat src-address=10.0.108.0/24 /ip hotspot ip-binding add address=100.64.19.251 type=bypassed add address=100.64.19.250 type=bypassed add address=204.110.188.0/24 add address=100.64.19.253 type=bypassed add address=100.64.19.254 type=bypassed add address=100.64.0.0/10 add address=10.100.128.1-10.100.142.254 add address=10.100.143.0/24 type=bypassed add address=0.0.0.0/0 type=blocked /ip hotspot user add name=admin password=h8xd9tkryg /ip hotspot walled-garden add comment="place hotspot rules here" disabled=yes add comment="place hotspot rules here" disabled=yes /ip hotspot walled-garden ip add action=accept disabled=no dst-address=204.110.191.195 !dst-address-list \ !dst-port !protocol !src-address !src-address-list add action=accept disabled=no dst-address=204.110.191.207 !dst-address-list \ !dst-port !protocol !src-address !src-address-list add action=accept disabled=no !dst-address !dst-address-list dst-host=\ provision.vntx.net !dst-port !protocol !src-address !src-address-list /ip ipsec policy set 0 dst-address=0.0.0.0/0 src-address=0.0.0.0/0 /ip ipsec profile set [ find default=yes ] dh-group=modp2048 dpd-interval=2m \ dpd-maximum-failures=5 enc-algorithm=aes-256,aes-128 hash-algorithm=\ sha256 /ip proxy set cache-path=web-proxy1 port=33443 /ip route add disabled=no dst-address=0.0.0.0/0 gateway=10.250.1.62 add disabled=yes dst-address=0.0.0.0/0 gateway=10.250.1.105 add disabled=no dst-address=10.254.254.109/32 gateway=10.250.1.105 \ routing-table=main add disabled=no dst-address=204.110.188.192/27 gateway=10.250.1.105 \ routing-table=main add disabled=no dst-address=100.64.20.0/22 gateway=10.250.1.105 \ routing-table=main add disabled=no dst-address=10.10.144.0/20 gateway=10.250.1.105 \ routing-table=main /ipv6 route add comment="default via core" distance=1 dst-address=::/0 gateway=\ 2606:1c80:0:13::1 add comment="core loopback (iBGP bootstrap)" distance=1 dst-address=\ 2606:1c80:0:10::253/128 gateway=2606:1c80:0:13::1 add comment="edge loopback via core" distance=1 dst-address=\ 2606:1c80:0:10::254/128 gateway=2606:1c80:0:13::1 add blackhole comment="newhope /44 aggregate (iBGP origin)" distance=200 \ dst-address=2606:1c80:1800::/44 add comment="lowry loopback via P2P" distance=1 dst-address=\ 2606:1c80:0:10::109/128 gateway=2606:1c80:0:18::2 /ip service set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes set www address=204.110.188.0/22,10.0.0.0/8 disabled=yes port=81 set www-ssl address=204.110.188.0/22,10.0.0.0/8 certificate=vntx.net.pem_0 set ssh address=204.110.188.0/22,10.0.0.0/8 port=1022 set winbox address=204.110.188.0/22,10.0.0.0/8 set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10 set api-ssl certificate=vntx.net.pem_0 /ip ssh set host-key-type=ed25519 password-authentication=yes strong-crypto=yes /ip traffic-flow set cache-entries=256k enabled=yes /ipv6 address add address=2606:1c80:0:10::108/128 advertise=no comment=loopback interface=\ lo add address=2606:1c80:0:13::2 advertise=no comment="P2P newhope<->core" \ interface=ether2-380 add address=2606:1c80:0:18::1 advertise=no comment="P2P newhope<->lowry" \ interface=ether6-lowrycrossing add address=2606:1c80:1800::1 comment="newhope mgmt LAN" interface=\ bridge_cpe_mgmt /ipv6 dhcp-server add dhcp-option=v6-dns interface=bridge_cpe_mgmt name=newhope-mgmt-stateless /ipv6 firewall filter add action=accept chain=input comment=established connection-state=\ established,related add action=drop chain=input comment=invalid connection-state=invalid add action=accept chain=input comment=icmpv6 protocol=icmpv6 add action=accept chain=input comment=link-local src-address=fe80::/10 add action=accept chain=input comment=internal src-address=2606:1c80::/32 add action=drop chain=input comment="default deny" add action=accept chain=forward comment=established connection-state=\ established,related add action=drop chain=forward comment=invalid connection-state=invalid add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\ icmpv6 add action=accept chain=forward comment=icmpv6 protocol=icmpv6 add action=accept chain=forward comment="v6 outbound (all vntx sources)" \ src-address=2606:1c80::/32 add action=drop chain=forward comment="default deny" /ipv6 nd add advertise-dns=yes interface=bridge_cpe_mgmt other-configuration=yes /mpls interface add interface=ether2-380 mpls-mtu=1508 add interface=ether6-lowrycrossing mpls-mtu=1508 /mpls ldp add disabled=no lsr-id=10.254.254.108 transport-addresses=10.254.254.108 vrf=\ main /mpls ldp interface add interface=ether2-380 add interface=ether6-lowrycrossing /mpls settings set propagate-ttl=no /ppp aaa set interim-update=15m use-radius=yes /radius add address=204.110.191.248 secret=ivcgfagb6f0t64ws service=ppp,hotspot,dhcp \ src-address=204.110.188.190 timeout=3s add address=204.110.191.2 secret=ivcgfagb6f0t64ws service=ppp,hotspot,dhcp \ src-address=204.110.188.190 timeout=3s add accounting-backup=yes address=45.76.56.5 secret=ivcgfagb6f0t64ws service=\ ppp,hotspot,dhcp src-address=204.110.188.190 timeout=3s /radius incoming set accept=yes /routing bfd configuration add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5 /routing bgp connection add afi=ip,ipv6 comment="iBGP to core (v6 RR), v6 transport" instance=\ bgp-instance-1 local.address=2606:1c80:0:10::108 .role=ibgp multihop=yes \ name=ibgp-rr-core nexthop-choice=force-self output.filter-chain=\ v6-ibgp-out .redistribute=connected,static remote.address=\ 2606:1c80:0:10::253 .as=393837 templates=default /routing filter rule add chain=ospf-in disabled=no rule="accept;" add chain=ospf-out disabled=no rule="accept;" add chain=bgp-in disabled=no rule="accept;" add chain=bgp-out disabled=no rule="accept;" add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1800::/44 || dst==2\ 606:1c80:0:10::108/128 || (dst-len==64 && (dst==2606:1c80:0:13::/64 || dst\ ==2606:1c80:0:18::/64))) { accept; } else { reject; }" /routing ospf interface-template add area=backbone-v2 auth=sha512 auth-id=1 auth-key=\ 5YHHWmoooAyVaFDX48ffjGjc36XMO5Irb7zS44Tsvet cost=10 disabled=no \ interfaces=ether4 priority=1 type=ptp use-bfd=no add area=backbone-v2 auth=sha512 auth-id=1 auth-key=\ 5YHHWmoooAyVaFDX48ffjGjc36XMO5Irb7zS44Tsvet cost=10 disabled=no \ interfaces=ether6-lowrycrossing priority=1 type=ptp use-bfd=no add area=backbone-v2 auth=sha512 auth-id=1 auth-key=\ 5YHHWmoooAyVaFDX48ffjGjc36XMO5Irb7zS44Tsvet cost=10 disabled=no \ interfaces=ether2-380 priority=1 type=ptp use-bfd=no add area=backbone-v2 disabled=no passive /routing rip interface-template add instance=rip-instance-1 /routing rip static-neighbor add address="" disabled=no instance=rip-instance-1 /snmp set contact=graham@vntx.net enabled=yes location="33.207391, -96.537840" /system clock set time-zone-name=America/Chicago /system identity set name=NewHope /system logging add action=logs topics=info add disabled=yes topics=!debug,!dns,!snmp,!hotspot /system note set note="__ __\ \n\\ \\ / /__ _ __ ___ _ __ __ _\ \n \\ \\ / / _ \\ '__/ _ \\| '_ \\ / _` |\ \n \\ V / __/ | | (_) | | | | (_| |\ \n \\_/ \\___|_| \\___/|_| |_|\\__,_|\ \n _ _ _ _\ \n| \\ | | ___| |___ _____ _ __| | _____\ \n| \\| |/ _ \\ __\\ \\ /\\ / / _ \\| '__| |/ / __|\ \n| |\\ | __/ |_ \\ V V / (_) | | | <\\__ \\\ \n|_| \\_|\\___|\\__| \\_/\\_/ \\___/|_| |_|\\_\\___/\ \n\ \n###############################################################\ \n# Welcome to Verona Networks #\ \n# All connections are monitored and recorded #\ \n# Disconnect IMMEDIATELY if you are not an authorized user! #\ \n###############################################################\ \n\ \n" show-at-login=no /system ntp client set enabled=yes /system ntp client servers add address=ntp.vntx.net add address=0.us.pool.ntp.org /system package update set channel=long-term /system routerboard settings set auto-upgrade=yes /system scheduler add interval=5m name=remove_hotspot on-event=\ "/ip hotspot host remove [/ip hotspot host find where !authorized]" \ policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive \ start-time=startup add name=reboot on-event="/system reboot" policy=\ ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=\ 2025-01-21 start-time=03:25:00 add interval=1d name="disable proxy" on-event="/ip proxy set enabled=no\r\ \n" policy=\ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \ start-date=2020-04-11 start-time=04:00:00 /system script add dont-require-permissions=no name=backup owner=admin policy=\ ftp,reboot,read,write,policy,test,password,sniff,sensitive source="/export\ \_file=backup.rsc\ \n\ \n;\r\ \n/tool e-mail send to=\"graham@vntx.net\" subject=(\"mtik backup \" . [/s\ ystem identity get name]) file=backup.rsc;\r\ \n\ \n:log info \"Backup email sent.\";\ \n" add dont-require-permissions=no name=rogue-dhcp owner=admin policy=\ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=\ ":log warning message=\"Rogue DHCP server detected!\"" /system watchdog set auto-send-supout=yes ping-start-after-boot=1h send-email-from=\ support@vntx.net send-email-to=graham@vntx.net send-smtp-server=\ 204.110.191.236 watchdog-timer=no /tool e-mail set certificate-verification=no from=NewHope@vntx.net password=\ F9K2B2yhvE6YUnv server=smtp.sendgrid.net tls=starttls user=veronanetworks /tool graphing interface add /tool graphing queue add /tool graphing resource add /tool romon set secrets=vntx1830