# may/08/2026 17:46:02 by RouterOS 6.49.18 # software id = 8XZE-R7EJ # # model = CCR2004-1G-12S+2XS # serial number = C8A70C55A930 /interface bridge add name=cgnat add fast-forward=no name=loopback /interface ethernet set [ find default-name=ether1 ] rx-flow-control=auto tx-flow-control=auto set [ find default-name=sfp-sfpplus7 ] auto-negotiation=no name=\ sfp-sfpplus7-core-direct set [ find default-name=sfp-sfpplus8 ] name=sfp-sfpplus8-server-switch \ rx-flow-control=auto tx-flow-control=auto set [ find default-name=sfp-sfpplus10 ] rx-flow-control=auto tx-flow-control=\ auto set [ find default-name=sfp-sfpplus11 ] name=sfp-sfpplus11-preseem \ rx-flow-control=auto tx-flow-control=auto set [ find default-name=sfp-sfpplus12 ] l2mtu=1500 name=\ sfp-sfpplus12-spectrum rx-flow-control=auto tx-flow-control=auto /interface vlan add interface=sfp-sfpplus8-server-switch name=vlan9_sfpplus8 vlan-id=9 /interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik /ip dhcp-server add disabled=no interface=vlan9_sfpplus8 name=servers-public /ip pool add name=380building ranges=10.0.0.150-10.0.0.239 add name=servers-public ranges=204.110.191.193-204.110.191.217 /ip dhcp-server add address-pool=380building disabled=no interface=sfp-sfpplus8-server-switch \ name=380-building /ppp profile add name=RWB_sstp_profile /queue simple add burst-limit=1M/1M burst-threshold=1M/1M burst-time=1s/1s disabled=yes \ limit-at=1M/1M max-limit=1M/1M name=Delinquent packet-marks=Delenquent \ priority=2/2 target="" add burst-limit=1/1 burst-threshold=1/1 burst-time=1s/1s disabled=yes \ limit-at=1/1 max-limit=1/1 name=Inactive packet-marks=Inactive priority=\ 2/2 target="" /routing bgp instance set default as=393837 out-filter=twc-out router-id=204.110.191.190 /routing ospf instance set [ find default=yes ] distribute-default=always-as-type-1 router-id=\ 10.254.254.254 /routing ospf-v3 instance set [ find default=yes ] distribute-default=always-as-type-1 \ redistribute-connected=as-type-1 router-id=10.254.254.254 /snmp community set [ find default=yes ] name=onehuargd4a8974y79a497yi add addresses=204.110.188.0/22,10.0.0.0/8 name=kdyyJrT0Mm /system logging action add name=logs remote=204.110.191.229 remote-port=1514 src-address=\ 10.254.254.254 target=remote /user group set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\ sword,web,sniff,sensitive,api,romon,dude,tikapp" /ip firewall connection tracking set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \ tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \ tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \ tcp-time-wait-timeout=2m udp-stream-timeout=2m udp-timeout=30s /ip neighbor discovery-settings set discover-interface-list=!dynamic /ip settings set rp-filter=strict tcp-syncookies=yes /ip address add address=71.41.226.118/30 interface=sfp-sfpplus12-spectrum network=\ 71.41.226.116 add address=204.110.191.186/30 interface=sfp-sfpplus11-preseem network=\ 204.110.191.184 add address=204.110.191.254/26 interface=vlan9_sfpplus8 network=\ 204.110.191.192 add address=10.254.254.254 interface=loopback network=10.254.254.254 add address=204.110.191.182/30 interface=sfp-sfpplus7-core-direct network=\ 204.110.191.180 add address=10.0.0.254/24 interface=sfp-sfpplus8-server-switch network=\ 10.0.0.0 add address=204.110.190.129/25 interface=cgnat network=204.110.190.128 add address=204.110.190.130/25 interface=cgnat network=204.110.190.128 add address=204.110.190.131/25 interface=cgnat network=204.110.190.128 add address=204.110.190.132/25 interface=cgnat network=204.110.190.128 add address=204.110.190.133/25 interface=cgnat network=204.110.190.128 add address=204.110.190.134/25 interface=cgnat network=204.110.190.128 add address=204.110.190.135/25 interface=cgnat network=204.110.190.128 add address=204.110.190.136/25 interface=cgnat network=204.110.190.128 add address=204.110.190.137/25 interface=cgnat network=204.110.190.128 add address=204.110.190.138/25 interface=cgnat network=204.110.190.128 add address=204.110.190.139/25 interface=cgnat network=204.110.190.128 add address=204.110.190.140/25 interface=cgnat network=204.110.190.128 add address=204.110.190.141/25 interface=cgnat network=204.110.190.128 add address=204.110.190.142/25 interface=cgnat network=204.110.190.128 add address=204.110.190.143/25 interface=cgnat network=204.110.190.128 add address=204.110.190.144/25 interface=cgnat network=204.110.190.128 add address=204.110.190.145/25 interface=cgnat network=204.110.190.128 add address=204.110.190.146/25 interface=cgnat network=204.110.190.128 add address=204.110.190.147/25 interface=cgnat network=204.110.190.128 add address=204.110.190.148/25 interface=cgnat network=204.110.190.128 add address=204.110.190.149/25 interface=cgnat network=204.110.190.128 add address=204.110.190.150/25 interface=cgnat network=204.110.190.128 add address=204.110.190.151/25 interface=cgnat network=204.110.190.128 add address=204.110.190.152/25 interface=cgnat network=204.110.190.128 add address=204.110.190.153/25 interface=cgnat network=204.110.190.128 add address=204.110.190.154/25 interface=cgnat network=204.110.190.128 add address=204.110.190.155/25 interface=cgnat network=204.110.190.128 add address=204.110.190.156/25 interface=cgnat network=204.110.190.128 add address=204.110.190.157/25 interface=cgnat network=204.110.190.128 add address=204.110.190.158/25 interface=cgnat network=204.110.190.128 add address=204.110.190.159/25 interface=cgnat network=204.110.190.128 add address=204.110.190.160/25 interface=cgnat network=204.110.190.128 add address=204.110.190.161/25 interface=cgnat network=204.110.190.128 add address=204.110.190.162/25 interface=cgnat network=204.110.190.128 add address=204.110.190.163/25 interface=cgnat network=204.110.190.128 add address=204.110.190.164/25 interface=cgnat network=204.110.190.128 add address=204.110.190.165/25 interface=cgnat network=204.110.190.128 add address=204.110.190.166/25 interface=cgnat network=204.110.190.128 add address=204.110.190.167/25 interface=cgnat network=204.110.190.128 add address=204.110.190.168/25 interface=cgnat network=204.110.190.128 add address=204.110.190.169/25 interface=cgnat network=204.110.190.128 add address=204.110.190.170/25 interface=cgnat network=204.110.190.128 add address=204.110.190.171/25 interface=cgnat network=204.110.190.128 add address=204.110.190.172/25 interface=cgnat network=204.110.190.128 add address=204.110.190.173/25 interface=cgnat network=204.110.190.128 add address=204.110.190.174/25 interface=cgnat network=204.110.190.128 add address=204.110.190.175/25 interface=cgnat network=204.110.190.128 add address=204.110.190.176/25 interface=cgnat network=204.110.190.128 add address=204.110.190.177/25 interface=cgnat network=204.110.190.128 add address=204.110.190.178/25 interface=cgnat network=204.110.190.128 add address=204.110.190.179/25 interface=cgnat network=204.110.190.128 add address=204.110.190.180/25 interface=cgnat network=204.110.190.128 add address=204.110.190.181/25 interface=cgnat network=204.110.190.128 add address=204.110.190.182/25 interface=cgnat network=204.110.190.128 add address=204.110.190.183/25 interface=cgnat network=204.110.190.128 add address=204.110.190.184/25 interface=cgnat network=204.110.190.128 add address=204.110.190.185/25 interface=cgnat network=204.110.190.128 add address=204.110.190.186/25 interface=cgnat network=204.110.190.128 add address=204.110.190.187/25 interface=cgnat network=204.110.190.128 add address=204.110.190.188/25 interface=cgnat network=204.110.190.128 add address=204.110.190.189/25 interface=cgnat network=204.110.190.128 add address=204.110.190.190/25 interface=cgnat network=204.110.190.128 add address=204.110.190.191/25 interface=cgnat network=204.110.190.128 add address=204.110.190.192/25 interface=cgnat network=204.110.190.128 add address=204.110.190.193/25 interface=cgnat network=204.110.190.128 add address=204.110.190.194/25 interface=cgnat network=204.110.190.128 add address=204.110.190.195/25 interface=cgnat network=204.110.190.128 add address=204.110.190.196/25 interface=cgnat network=204.110.190.128 add address=204.110.190.197/25 interface=cgnat network=204.110.190.128 add address=204.110.190.198/25 interface=cgnat network=204.110.190.128 add address=204.110.190.199/25 interface=cgnat network=204.110.190.128 add address=204.110.190.200/25 interface=cgnat network=204.110.190.128 add address=204.110.190.201/25 interface=cgnat network=204.110.190.128 add address=204.110.190.202/25 interface=cgnat network=204.110.190.128 add address=204.110.190.203/25 interface=cgnat network=204.110.190.128 add address=204.110.190.204/25 interface=cgnat network=204.110.190.128 add address=204.110.190.205/25 interface=cgnat network=204.110.190.128 add address=204.110.190.206/25 interface=cgnat network=204.110.190.128 add address=204.110.190.207/25 interface=cgnat network=204.110.190.128 add address=204.110.190.208/25 interface=cgnat network=204.110.190.128 add address=204.110.190.209/25 interface=cgnat network=204.110.190.128 add address=204.110.190.210/25 interface=cgnat network=204.110.190.128 add address=204.110.190.211/25 interface=cgnat network=204.110.190.128 add address=204.110.190.212/25 interface=cgnat network=204.110.190.128 add address=204.110.190.213/25 interface=cgnat network=204.110.190.128 add address=204.110.190.214/25 interface=cgnat network=204.110.190.128 add address=204.110.190.215/25 interface=cgnat network=204.110.190.128 add address=204.110.190.216/25 interface=cgnat network=204.110.190.128 add address=204.110.190.217/25 interface=cgnat network=204.110.190.128 add address=204.110.190.218/25 interface=cgnat network=204.110.190.128 add address=204.110.190.219/25 interface=cgnat network=204.110.190.128 add address=204.110.190.220/25 interface=cgnat network=204.110.190.128 add address=204.110.190.221/25 interface=cgnat network=204.110.190.128 add address=204.110.190.222/25 interface=cgnat network=204.110.190.128 add address=204.110.190.223/25 interface=cgnat network=204.110.190.128 add address=204.110.190.224/25 interface=cgnat network=204.110.190.128 add address=204.110.190.225/25 interface=cgnat network=204.110.190.128 add address=204.110.190.226/25 interface=cgnat network=204.110.190.128 add address=204.110.190.227/25 interface=cgnat network=204.110.190.128 add address=204.110.190.228/25 interface=cgnat network=204.110.190.128 add address=204.110.190.229/25 interface=cgnat network=204.110.190.128 add address=204.110.190.230/25 interface=cgnat network=204.110.190.128 add address=204.110.190.231/25 interface=cgnat network=204.110.190.128 add address=204.110.190.232/25 interface=cgnat network=204.110.190.128 add address=204.110.190.233/25 interface=cgnat network=204.110.190.128 add address=204.110.190.234/25 interface=cgnat network=204.110.190.128 add address=204.110.190.235/25 interface=cgnat network=204.110.190.128 add address=204.110.190.236/25 interface=cgnat network=204.110.190.128 add address=204.110.190.237/25 interface=cgnat network=204.110.190.128 add address=204.110.190.238/25 interface=cgnat network=204.110.190.128 add address=204.110.190.239/25 interface=cgnat network=204.110.190.128 add address=204.110.190.240/25 interface=cgnat network=204.110.190.128 add address=204.110.190.241/25 interface=cgnat network=204.110.190.128 add address=204.110.190.242/25 interface=cgnat network=204.110.190.128 add address=204.110.190.243/25 interface=cgnat network=204.110.190.128 add address=204.110.190.244/25 interface=cgnat network=204.110.190.128 add address=204.110.190.245/25 interface=cgnat network=204.110.190.128 add address=204.110.190.246/25 interface=cgnat network=204.110.190.128 add address=204.110.190.247/25 interface=cgnat network=204.110.190.128 add address=204.110.190.248/25 interface=cgnat network=204.110.190.128 add address=204.110.190.249/25 interface=cgnat network=204.110.190.128 add address=204.110.190.250/25 interface=cgnat network=204.110.190.128 add address=204.110.190.251/25 interface=cgnat network=204.110.190.128 add address=204.110.190.252/25 interface=cgnat network=204.110.190.128 add address=204.110.190.253/25 interface=cgnat network=204.110.190.128 add address=204.110.190.254/25 interface=cgnat network=204.110.190.128 /ip dhcp-server lease add address=10.0.0.249 client-id=1:0:21:9b:91:5c:b6 mac-address=\ 00:21:9B:91:5C:B6 server=380-building add address=204.110.191.205 mac-address=BC:24:11:8B:C0:9C add address=10.0.0.250 client-id=1:48:a9:8a:38:3b:2d mac-address=\ 48:A9:8A:38:3B:2D server=380-building add address=10.0.0.253 client-id=\ ff:ca:53:9:5a:0:2:0:0:ab:11:2c:53:dd:b2:c1:50:9a:35 comment=truenas \ mac-address=BC:24:11:29:2B:5A server=380-building add address=10.0.0.252 client-id=1:bc:24:11:f5:81:d6 mac-address=\ BC:24:11:F5:81:D6 server=380-building add address=10.0.0.251 client-id=1:bc:24:11:6b:73:53 mac-address=\ BC:24:11:6B:73:53 server=380-building /ip dhcp-server network add address=10.0.0.0/24 dns-server=9.9.9.9,1.1.1.1 domain=vntx.net gateway=\ 10.0.0.254 ntp-server=23.150.41.122 add address=204.110.191.192/26 dns-server=\ 204.110.191.240,204.110.191.250,1.1.1.1 gateway=204.110.191.254 /ip dns set servers=204.110.191.240,204.110.191.250 /ip firewall address-list add address=204.110.188.0/22 list=trusted add address=100.64.0.0/10 list=trusted add address=10.0.0.0/8 list=trusted add address=35.197.73.77 list=preseem add address=35.199.29.237 list=preseem add address=98.97.82.0/24 comment=starlink list=trusted add address=129.222.72.0/24 comment=starlink list=trusted add address=129.222.73.0/24 comment=starlink list=trusted add address=129.222.74.0/24 comment=starlink list=trusted add address=129.222.75.0/24 comment=starlink list=trusted add address=129.222.76.0/24 comment=starlink list=trusted add address=129.222.77.0/24 comment=starlink list=trusted add address=129.222.78.0/24 comment=starlink list=trusted add address=129.222.79.0/24 comment=starlink list=trusted add address=98.97.80.0/24 comment=starlink list=trusted add address=98.97.81.0/24 comment=starlink list=trusted add address=98.97.83.0/24 comment=starlink list=trusted add address=98.97.84.0/24 comment=starlink list=trusted add address=98.97.85.0/24 comment=starlink list=trusted add address=98.97.86.0/24 comment=starlink list=trusted add address=98.97.87.0/24 comment=starlink list=trusted add address=98.97.88.0/24 comment=starlink list=trusted add address=98.97.89.0/24 comment=starlink list=trusted add address=98.97.90.0/24 comment=starlink list=trusted add address=98.97.91.0/24 comment=starlink list=trusted add address=98.97.92.0/24 comment=starlink list=trusted add address=98.97.93.0/24 comment=starlink list=trusted add address=98.97.94.0/24 comment=starlink list=trusted add address=98.97.95.0/24 comment=starlink list=trusted add address=52.158.209.86 list=trusted add address=3.210.85.72 list=gaiia add address=3.81.237.51 list=gaiia add address=3.215.70.188 list=gaiia add address=3.228.90.246 list=gaiia add address=47.147.43.145 list=trusted add address=71.41.226.117 comment=TWC list=BGP-NEIGHBORS add address=204.110.191.185 comment=Preseem list=BGP-NEIGHBORS add address=204.110.191.252 comment="Virtual RouterOS" list=BGP-NEIGHBORS add address=204.110.188.0/22 list=bgp-networks add address=151.243.11.0/24 list=abusive add address=172.245.56.83 list=trusted /ip firewall filter add action=accept chain=input comment="BGP Input" dst-port=179 protocol=tcp add action=accept chain=output comment="BGP Output" protocol=tcp src-port=179 add action=accept chain=forward comment="BGP Forward" dst-port=179 protocol=\ tcp add action=accept chain=forward comment="BGP Forward Reply" protocol=tcp \ src-port=179 add action=accept chain=input comment="OSPF Input" protocol=ospf add action=accept chain=output comment="OSPF Output" protocol=ospf add action=accept chain=forward comment="OSPF Forward" protocol=ospf add action=accept chain=input comment="Established Input" connection-state=\ established,related add action=accept chain=forward comment="Established Forward" \ connection-state=established,related add action=accept chain=input comment="Allow Remote Winbox" disabled=yes \ in-interface=*18 add action=fasttrack-connection chain=forward comment=\ "fasttrack established/related" connection-state=established,related add action=accept chain=forward comment="accept established/related" \ connection-state=established,related add action=drop chain=forward dst-address=91.190.98.0/24 log=yes add action=accept chain=forward dst-port=23 protocol=tcp src-address=\ 204.110.190.208 add action=accept chain=forward dst-address=204.110.191.219 add action=accept chain=forward dst-address=204.110.191.222 add action=accept chain=forward dst-address=204.110.191.252 add action=accept chain=forward dst-address=204.110.191.8 add action=accept chain=forward dst-address=204.110.191.192/26 src-address=\ 52.158.209.86 add action=accept chain=forward dst-address=204.110.191.210 add action=accept chain=forward disabled=yes dst-address=204.110.191.248 \ dst-port=3306 log=yes protocol=tcp add action=accept chain=forward dst-address=204.110.191.248 dst-port=3306 \ protocol=tcp src-address-list=gaiia add action=accept chain=forward disabled=yes dst-address=204.110.191.248 add action=accept chain=forward dst-address=204.110.191.231 add action=accept chain=forward dst-address=204.110.191.232 in-interface=\ sfp-sfpplus12-spectrum add action=tarpit chain=input protocol=tcp src-address-list=abusive add action=drop chain=forward src-address-list=abusive add action=accept chain=forward connection-state=established,related \ disabled=yes add action=accept chain=input connection-state=established,related,untracked \ disabled=yes add action=drop chain=forward disabled=yes dst-port=3389 in-interface=\ sfp-sfpplus12-spectrum protocol=tcp add action=drop chain=forward disabled=yes dst-port=3389 in-interface=\ sfp-sfpplus12-spectrum protocol=udp add action=drop chain=forward comment="Drop anyone in Black List (SSH)." \ in-interface=sfp-sfpplus12-spectrum log-prefix="BL_Black List (SSH)" \ src-address-list="Black List (SSH)" add action=drop chain=forward comment="block incoming ftp" disabled=yes \ dst-port=21 in-interface=sfp-sfpplus12-spectrum protocol=tcp add action=drop chain=forward comment="block incoming telnet" dst-port=23 \ in-interface=sfp-sfpplus12-spectrum protocol=tcp add action=drop chain=input comment="Drop all packets from public internet whi\ ch should not exist in public network" in-interface=\ sfp-sfpplus12-spectrum src-address-list=NotPublic add action=drop chain=input disabled=yes dst-port=3784 in-interface=\ sfp-sfpplus12-spectrum log=yes protocol=udp add action=drop chain=forward comment=bfd dst-port=3784 in-interface=\ sfp-sfpplus12-spectrum protocol=udp add action=drop chain=input comment=bfd dst-port=3784 in-interface=\ sfp-sfpplus12-spectrum protocol=udp add action=drop chain=input comment="Drop Invalid connections" \ connection-state=invalid add action=add-src-to-address-list address-list=winbox_blacklist \ address-list-timeout=4w3d chain=input connection-state=new disabled=yes \ dst-port=8291 log=yes protocol=tcp src-address-list=winbox_stage3 add action=add-src-to-address-list address-list=winbox_stage3 \ address-list-timeout=1m chain=input connection-state=new disabled=yes \ dst-port=8291 protocol=tcp src-address-list=winbox_stage2 add action=add-src-to-address-list address-list=winbox_stage2 \ address-list-timeout=1m chain=input connection-state=new disabled=yes \ dst-port=8291 protocol=tcp src-address-list=winbox_stage1 add action=add-src-to-address-list address-list=winbox_stage1 \ address-list-timeout=1m chain=input connection-state=new disabled=yes \ dst-port=8291 protocol=tcp src-address-list=!vntx add action=drop chain=forward comment="drop winbox brute downstream" \ disabled=yes dst-port=8291 protocol=tcp src-address-list=winbox_blacklist add action=accept chain=input comment="BGP Neighbors" dst-port=179 protocol=\ tcp src-address-list=BGP-NEIGHBORS add action=drop chain=input comment="Drop anyone in Black List (SSH)." \ disabled=yes in-interface=sfp-sfpplus12-spectrum log-prefix=\ "BL_Black List (SSH)" src-address-list="Black List (SSH)" add action=jump chain=input comment="Jump to Black List (SSH) chain." \ dst-port=22 in-interface=sfp-sfpplus12-spectrum jump-target=\ "Black List (SSH) Chain" protocol=tcp add action=drop chain=input comment=. dst-port=23 in-interface=\ sfp-sfpplus12-spectrum protocol=tcp add action=drop chain=forward comment=. dst-port=23 in-interface=\ sfp-sfpplus12-spectrum protocol=tcp add action=jump chain=forward comment="Jump to Black List (SSH) chain." \ dst-port=22 in-interface=sfp-sfpplus12-spectrum jump-target=\ "Black List (SSH) Chain" protocol=tcp add action=add-src-to-address-list address-list="Black List (SSH)" \ address-list-timeout=4w2d chain="Black List (SSH) Chain" comment="Transfer\ \_repeated attempts from Black List (SSH) Stage 3 to Black List (SSH)." \ connection-state=new in-interface=sfp-sfpplus12-spectrum log-prefix=\ "Add_Black List (SSH)" src-address-list="Black List (SSH) Stage 3" add action=add-src-to-address-list address-list="Black List (SSH) Stage 3" \ address-list-timeout=1m chain="Black List (SSH) Chain" comment=\ "Add successive attempts to Black List (SSH) Stage 3." connection-state=\ new in-interface=sfp-sfpplus12-spectrum log-prefix=\ "Add_Black List (SSH) S3" src-address-list="Black List (SSH) Stage 2" add action=add-src-to-address-list address-list="Black List (SSH) Stage 2" \ address-list-timeout=1m chain="Black List (SSH) Chain" comment=\ "Add successive attempts to Black List (SSH) Stage 2." connection-state=\ new in-interface=sfp-sfpplus12-spectrum log-prefix=\ "Add_Black List (SSH) S2" src-address-list="Black List (SSH) Stage 1" add action=add-src-to-address-list address-list="Black List (SSH) Stage 1" \ address-list-timeout=1m chain="Black List (SSH) Chain" comment=\ "Add initial attempt to Black List (SSH) Stage 1." connection-state=new \ in-interface=sfp-sfpplus12-spectrum log-prefix="Add_Black List (SSH) S1" \ src-address-list=!trusted add action=return chain="Black List (SSH) Chain" comment=\ "Return From Black List (SSH) chain." add action=accept chain=forward disabled=yes dst-address=204.110.191.192/26 \ dst-port=3306 log=yes protocol=tcp src-address=162.243.131.32 add action=accept chain=forward dst-address=204.110.191.197 add action=accept chain=forward comment=micromirror dst-address=\ 204.110.191.235 add action=accept chain=forward dst-address=204.110.191.219 add action=accept chain=forward dst-address=204.110.191.8 add action=accept chain=forward dst-address=204.110.191.192/26 protocol=icmp add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=80 \ protocol=tcp add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=443 \ protocol=tcp add action=accept chain=forward dst-address=204.110.191.232 dst-port=14580 \ protocol=tcp add action=accept chain=forward dst-address=204.110.191.232 dst-port=14501 \ protocol=tcp add action=accept chain=forward comment=wireguard dst-address=204.110.191.247 \ dst-port=51820 protocol=udp add action=accept chain=forward dst-address=204.110.191.247 dst-port=22 \ protocol=tcp add action=drop chain=forward disabled=yes dst-address=204.110.191.192/26 \ dst-port=3306 log=yes protocol=tcp add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=53 \ protocol=udp src-address-list=trusted add action=accept chain=forward comment=ns2 dst-address=204.110.191.239 \ dst-port=53 protocol=udp add action=accept chain=forward comment=ns1 dst-address=204.110.191.249 \ dst-port=53 protocol=udp add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=22 \ protocol=tcp src-address-list=trusted add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=22 \ protocol=tcp src-address-list=preseem add action=accept chain=forward dst-address=204.110.191.192/26 \ src-address-list=trusted add action=drop chain=forward dst-address=204.110.191.192/26 \ src-address-list=!trusted add action=drop chain=input dst-port=8921 protocol=tcp src-address-list=\ !trusted add action=drop chain=forward dst-port=8921 protocol=tcp src-address-list=\ !trusted add action=drop chain=input disabled=yes in-interface=sfp-sfpplus12-spectrum \ src-address=100.64.0.0/10 add action=drop chain=output disabled=yes dst-address=100.64.0.0/10 \ out-interface=sfp-sfpplus12-spectrum add action=drop chain=forward disabled=yes in-interface=\ sfp-sfpplus12-spectrum src-address=100.64.0.0/10 add action=drop chain=forward disabled=yes out-interface=\ sfp-sfpplus12-spectrum src-address=100.64.0.0/10 add action=drop chain=forward disabled=yes dst-address=100.64.0.0/10 \ out-interface=sfp-sfpplus12-spectrum add action=accept chain=input comment="Established Input" connection-state=\ established,related add action=accept chain=forward comment="Established Forward" \ connection-state=established,related add action=accept chain=input comment=BGP dst-port=179 protocol=tcp add action=accept chain=output comment=BGP protocol=tcp src-port=179 add action=accept chain=forward comment=BGP dst-port=179 protocol=tcp add action=accept chain=forward comment=BGP protocol=tcp src-port=179 add action=accept chain=input comment=OSPF protocol=ospf add action=accept chain=output comment=OSPF protocol=ospf add action=accept chain=forward comment=OSPF protocol=ospf add action=drop chain=forward dst-port=23 log-prefix=TELNET protocol=tcp /ip firewall mangle add action=mark-packet chain=prerouting disabled=yes new-packet-mark=Inactive \ passthrough=no src-address-list=Inactive add action=mark-packet chain=prerouting disabled=yes dst-address-list=\ Inactive new-packet-mark=Inactive passthrough=no add action=accept chain=postrouting disabled=yes protocol=tcp tcp-flags=ack /ip firewall nat add action=src-nat chain=srcnat comment="Internal NAT catch-all" \ out-interface=sfp-sfpplus12-spectrum src-address=10.0.0.0/8 to-addresses=\ 204.110.191.190 add action=src-nat chain=srcnat out-interface=sfp-sfpplus12-spectrum \ src-address=10.0.0.0/24 to-addresses=204.110.190.254 add action=src-nat chain=srcnat comment="Loopback NAT" out-interface=\ sfp-sfpplus12-spectrum src-address=10.254.254.0/24 to-addresses=\ 204.110.191.190 add action=src-nat chain=srcnat comment="Loopback NAT" out-interface=\ sfp-sfpplus12-spectrum src-address=10.254.254.0/24 to-addresses=\ 204.110.191.190 add action=src-nat chain=srcnat out-interface=sfp-sfpplus12-spectrum \ src-address=10.0.0.0/8 to-addresses=204.110.191.190 add action=src-nat chain=srcnat comment="Internal Network NAT" out-interface=\ sfp-sfpplus12-spectrum src-address=10.250.1.0/24 to-addresses=\ 204.110.191.190 add action=src-nat chain=srcnat comment="Internal Network NAT" out-interface=\ sfp-sfpplus12-spectrum src-address=10.250.1.0/24 to-addresses=\ 204.110.191.190 add action=src-nat chain=srcnat comment="fallthrough CGNAT" disabled=yes \ out-interface=sfp-sfpplus12-spectrum src-address=100.64.0.0/10 \ to-addresses=204.110.190.254 add action=netmap chain=srcnat ipsec-policy=out,none out-interface=\ sfp-sfpplus12-spectrum src-address=100.64.0.0/10 to-addresses=\ 204.110.190.128/25 add action=netmap chain=dstmap comment=\ "Port Forwarding Solution for CGNAT (TCP)" dst-address=204.110.190.128/25 \ dst-port=1024-65535 protocol=tcp to-addresses=100.64.0.0/10 add action=netmap chain=dstmap comment=\ "Port Forwarding Solution for CGNAT (UDP)" dst-address=204.110.190.128/25 \ dst-port=1024-65535 protocol=udp to-addresses=100.64.0.0/10 /ip firewall raw add action=drop chain=prerouting src-address-list="Black List (SSH)" add action=drop chain=prerouting disabled=yes src-address-list=abusive add action=drop chain=prerouting disabled=yes src-address-list=\ winbox_blacklist /ip proxy set port=23435 /ip proxy access add src-address=204.110.188.0/22 /ip route add distance=1 gateway=71.41.226.117 add distance=1 dst-address=10.10.0.0/20 gateway=204.110.191.185 add distance=1 dst-address=10.10.16.0/20 gateway=204.110.191.185 add distance=1 dst-address=10.250.1.8/29 gateway=204.110.191.185 add distance=1 dst-address=10.250.1.8/29 gateway=204.110.191.185 add distance=1 dst-address=10.250.1.24/29 gateway=204.110.191.185 add distance=1 dst-address=10.250.1.64/29 gateway=204.110.191.185 add distance=1 dst-address=10.250.1.64/29 gateway=204.110.191.185 add distance=1 dst-address=10.250.1.88/29 gateway=204.110.191.185 add distance=1 dst-address=10.250.1.88/29 gateway=204.110.191.185 add distance=1 dst-address=10.254.254.101/32 gateway=204.110.191.185 add distance=1 dst-address=10.254.254.102/32 gateway=204.110.191.185 add distance=1 dst-address=100.64.0.0/10 gateway=204.110.191.185 add distance=1 dst-address=100.64.0.0/22 gateway=204.110.191.185 add distance=1 dst-address=100.64.4.0/22 gateway=204.110.191.185 add distance=1 dst-address=100.64.4.0/22 gateway=204.110.191.185 add distance=1 dst-address=100.64.12.0/22 gateway=204.110.191.185 add distance=1 dst-address=172.63.0.0/20 gateway=204.110.191.253 add distance=1 dst-address=204.110.188.0/22 gateway=204.110.191.181 add distance=1 dst-address=204.110.188.0/27 gateway=204.110.191.253 add distance=1 dst-address=204.110.188.32/27 gateway=204.110.191.185 add distance=1 dst-address=204.110.188.32/27 gateway=204.110.191.185 add distance=1 dst-address=204.110.188.224/27 gateway=204.110.191.185 add distance=1 dst-address=204.110.191.0/27 gateway=204.110.191.185 /ip service set telnet disabled=yes set ftp disabled=yes set www address=204.110.188.0/22 port=2080 set ssh address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10 port=1022 set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10 set api-ssl address=0.0.0.0/0 certificate=server /ip ssh set always-allow-password-login=yes forwarding-enabled=remote strong-crypto=\ yes /ipv6 address add address=2605:6000:0:8::f:373/127 advertise=no interface=\ sfp-sfpplus12-spectrum add address=2606:1c80::1 interface=vlan9_sfpplus8 add address=2606:1c80:0:1002::1 interface=sfp-sfpplus11-preseem /ipv6 firewall address-list add address=2606:1c80::/32 list=bgp-networks /ipv6 firewall filter add action=accept chain=input comment="IPv6 BGP Input" dst-port=179 protocol=\ tcp add action=accept chain=output comment="IPv6 BGP Output" protocol=tcp \ src-port=179 add action=accept chain=forward comment="IPv6 BGP Forward" dst-port=179 \ protocol=tcp add action=accept chain=forward comment="IPv6 BGP Forward Reply" protocol=tcp \ src-port=179 add action=accept chain=input comment="IPv6 Established Input" \ connection-state=established,related add action=accept chain=forward comment="IPv6 Established Forward" \ connection-state=established,related /mpls interface set [ find default=yes ] mpls-mtu=1530 add interface=sfp-sfpplus8-server-switch mpls-mtu=1530 /mpls ldp set distribute-for-default-route=yes enabled=yes loop-detect=yes lsr-id=\ 10.254.254.254 transport-address=10.254.254.254 /mpls ldp accept-filter add /mpls ldp advertise-filter add /mpls ldp interface add disabled=yes interface=ether1 add disabled=yes interface=sfp-sfpplus11-preseem transport-address=\ 10.254.254.254 add disabled=yes interface=vlan9_sfpplus8 transport-address=10.254.254.254 add interface=sfp-sfpplus8-server-switch /routing bfd interface set [ find default=yes ] disabled=yes add interface=sfp-sfpplus7-core-direct add interface=sfp-sfpplus11-preseem /routing bgp network add network=204.110.188.0/22 synchronize=no add network=2606:1c80::/32 synchronize=no /routing bgp peer add in-filter=twc-in name=twc out-filter=twc-out remote-address=71.41.226.117 \ remote-as=11427 ttl=default add address-families=ipv6 in-filter=twc-in name=twc-v6 out-filter=twc-out \ remote-address=2605:6000:0:8::f:372 remote-as=11427 ttl=default add comment="TEAM-CYMRU BOGON Server #1" disabled=yes in-filter=\ BOGON-SERVER-IN max-prefix-limit=50 multihop=yes name=CYMRU-1 out-filter=\ BGP-DROP remote-address=38.229.6.20 remote-as=65332 tcp-md5-key=\ mC9LaaOi0P add comment="TEAM-CYMRU BOGON Server #2" disabled=yes in-filter=\ BOGON-SERVER-IN max-prefix-limit=50 multihop=yes name=CYMRU-1 out-filter=\ BGP-DROP remote-address=38.229.46.20 remote-as=65332 tcp-md5-key=\ mC9LaaOi0P add address-families=ip,ipv6 default-originate=always disabled=yes name=\ edge_core_preseem nexthop-choice=propagate out-filter=bgp-default-only \ remote-address=204.110.191.185 remote-as=393837 /routing filter add action=accept chain=twc-out comment=blackhole disabled=yes prefix=\ 204.110.188.197 prefix-length=32 set-bgp-communities=7486:666 add action=accept chain=twc-in prefix=0.0.0.0/0 add action=accept chain=twc-in prefix=0.0.0.0/0 prefix-length=0 add action=discard chain=twc-in disabled=yes prefix=0.0.0.0 prefix-length=\ 0-32 protocol="" add action=accept chain=twc-out prefix=204.110.188.0/22 add action=accept chain=twc-out prefix=2606:1c80::/32 add action=discard chain=twc-out add action=discard chain=BGP-DROP add action=accept bgp-communities=65333:888 chain=BOGON-SERVER-IN disabled=\ yes set-type=blackhole add action=discard chain=BOGON-SERVER-IN disabled=yes add action=discard chain=BGP-DROP add action=accept chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \ prefix-length=0 add action=discard chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \ prefix-length=0-32 /routing ospf interface add interface=sfp-sfpplus12-spectrum network-type=broadcast passive=yes add interface=sfp-sfpplus11-preseem network-type=point-to-point use-bfd=yes add cost=20 interface=sfp-sfpplus9 network-type=nbma use-bfd=yes add interface=sfp-sfpplus10 network-type=nbma passive=yes add cost=20 interface=ether1 network-type=broadcast add interface=sfp-sfpplus8-server-switch network-type=broadcast add cost=100 interface=sfp-sfpplus7-core-direct network-type=point-to-point \ use-bfd=yes add interface=vlan9_sfpplus8 network-type=nbma /routing ospf nbma-neighbor add address=204.110.191.189 poll-interval=10s add address=10.250.1.94 add address=10.250.1.57 add address=10.250.1.201 add address=10.250.2.1 add address=204.110.191.185 poll-interval=10s add address=204.110.191.252 poll-interval=10s /routing ospf network add area=backbone /routing ospf-v3 interface add area=backbone add area=backbone interface=sfp-sfpplus12-spectrum network-type=broadcast \ passive=yes /routing rip set distribute-default=always redistribute-connected=yes redistribute-ospf=\ yes /routing rip interface add interface=sfp-sfpplus11-preseem add interface=sfp-sfpplus7-core-direct add interface=sfp-sfpplus8-server-switch /routing rip network add /snmp set contact="Verona Networks" enabled=yes location="Verona Networks" /system clock set time-zone-name=America/Chicago /system identity set name=edge /system logging add action=logs topics=info /system note set note="__ __\ \n\\ \\ / /__ _ __ ___ _ __ __ _\ \n \\ \\ / / _ \\ '__/ _ \\| '_ \\ / _` |\ \n \\ V / __/ | | (_) | | | | (_| |\ \n \\_/ \\___|_| \\___/|_| |_|\\__,_|\ \n _ _ _ _\ \n| \\ | | ___| |___ _____ _ __| | _____\ \n| \\| |/ _ \\ __\\ \\ /\\ / / _ \\| '__| |/ / __|\ \n| |\\ | __/ |_ \\ V V / (_) | | | <\\__ \\\ \n|_| \\_|\\___|\\__| \\_/\\_/ \\___/|_| |_|\\_\\___/\ \n\ \n###############################################################\ \n# Welcome to Verona Networks #\ \n# All connections are monitored and recorded #\ \n# Disconnect IMMEDIATELY if you are not an authorized user! #\ \n###############################################################\ \n\ \n" show-at-login=no /system ntp client set enabled=yes primary-ntp=162.159.200.1 secondary-ntp=45.79.1.70 /system routerboard settings set auto-upgrade=yes /system scheduler add name=reboot on-event="/system reboot\r\ \n" policy=\ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \ start-date=jun/14/2023 start-time=03:00:00 add comment=RWB_IP_RESOLVER interval=5m name=RWB_IP_RESOLVER on-event=\ RWB_IP_RESOLVER policy=\ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \ start-date=oct/13/2022 start-time=22:59:02 /tool graphing interface add allow-address=204.110.188.0/22 /tool graphing queue add allow-address=204.110.188.0/22 /tool graphing resource add allow-address=204.110.188.0/22 /tool romon set enabled=yes /user aaa set default-group=full