500 lines
21 KiB
Text
500 lines
21 KiB
Text
# 2026-05-08 17:46:02 by RouterOS 7.21.4
|
|
# software id = K4QG-8NQV
|
|
#
|
|
# model = RB5009UG+S+
|
|
# serial number = HC907K5P55K
|
|
/interface bridge
|
|
add name=494 port-cost-mode=short
|
|
add name=management port-cost-mode=short
|
|
/interface ethernet
|
|
set [ find default-name=ether1 ] comment=ether1 l2mtu=1580
|
|
set [ find default-name=ether2 ] comment=ether2 l2mtu=1580 name=ether2-climax
|
|
set [ find default-name=ether3 ] comment=ether3 l2mtu=1580
|
|
set [ find default-name=ether4 ] comment=ether4 l2mtu=1580
|
|
set [ find default-name=ether5 ] comment=ether5 l2mtu=1580
|
|
set [ find default-name=ether6 ] comment=ether6 l2mtu=1580
|
|
set [ find default-name=ether7 ] comment=ether7 l2mtu=1580
|
|
set [ find default-name=ether8 ] comment=ether8 l2mtu=1580
|
|
set [ find default-name=sfp-sfpplus1 ] l2mtu=1580
|
|
/interface vlan
|
|
add interface=ether5 name=vlan10_ether5 vlan-id=10
|
|
add interface=ether6 name=vlan10_ether6 vlan-id=10
|
|
add interface=ether7 name=vlan10_ether7 vlan-id=10
|
|
add interface=ether8 name=vlan10_ether8 vlan-id=10
|
|
/interface wireless security-profiles
|
|
set [ find default=yes ] supplicant-identity=MikroTik
|
|
/ip ipsec proposal
|
|
set [ find default=yes ] auth-algorithms=sha256 enc-algorithms=\
|
|
aes-256-cbc,aes-128-cbc pfs-group=modp2048
|
|
/ip pool
|
|
add name=cgnat ranges=100.64.160.1-100.64.174.254
|
|
add name=public ranges=204.110.188.65-204.110.188.93
|
|
/ip dhcp-server
|
|
add add-arp=yes address-pool=cgnat interface=494 lease-script="{\
|
|
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
|
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/cd\
|
|
c24944-c947-4e01-9c54-07a1653d2e3e\"\
|
|
\n:local url2 \"https://iptrack.vntx.net/api/dhcp\"\
|
|
\n:local max 1\
|
|
\n\
|
|
\n:local attempts 0\
|
|
\n:local success1 0\
|
|
\n:local success2 0\
|
|
\n:do {\
|
|
\n :set attempts (\$attempts+1);\
|
|
\n :if (\$leaseBound = 0) do {\
|
|
\n # Try url2 (iptrack.vntx.net) - deassignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
|
|
t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\"}\"\
|
|
\n :set success1 1;\
|
|
\n :log info \"DHCP deassignment successfully sent to iptrack.vntx.ne\
|
|
t for \$leaseActMAC / \$leaseActIP\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send deassignment to iptrack.vntx.net \
|
|
on attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
|
|
\n }\
|
|
\n\
|
|
\n # Try url (gaiia) - deassignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
|
|
\_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
|
|
\\\":\\\"\\\"}\"\
|
|
\n :set success2 1;\
|
|
\n :log info \"DHCP deassignment successfully sent to gaiia AWS API f\
|
|
or \$leaseActMAC / \$leaseActIP\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send deassignment to gaiia AWS API on \
|
|
attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
|
|
\n }\
|
|
\n\
|
|
\n :if (\$success1 != 1 || \$success2 != 1) do={\
|
|
\n :delay 3s;\
|
|
\n }\
|
|
\n } else {\
|
|
\n :delay 1s;\
|
|
\n :local remoteID [/ip dhcp-server lease get [find where address=\$lea\
|
|
seActIP] agent-remote-id];\
|
|
\n\
|
|
\n # Try url2 (iptrack.vntx.net) - assignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
|
|
t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
|
|
\\\":\\\"\$remoteID\\\"}\"\
|
|
\n :set success1 1;\
|
|
\n :log info \"DHCP assignment successfully sent to iptrack.vntx.net \
|
|
for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send assignment to iptrack.vntx.net on\
|
|
\_attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\"\
|
|
;\
|
|
\n }\
|
|
\n\
|
|
\n # Try url (gaiia) - assignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
|
|
\_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
|
|
\\\":\\\"\$remoteID\\\"}\"\
|
|
\n :set success2 1;\
|
|
\n :log info \"DHCP assignment successfully sent to gaiia AWS API for\
|
|
\_\$leaseActMAC / \$leaseActIP / \$remoteID\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send assignment to gaiia AWS API on at\
|
|
tempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
|
|
\n }\
|
|
\n\
|
|
\n :if (\$success1 != 1 || \$success2 != 1) do={\
|
|
\n :delay 30s;\
|
|
\n }\
|
|
\n }\
|
|
\n :if (\$success1 = 1 && \$success2 = 1) do {\
|
|
\n :set attempts \$max;\
|
|
\n }\
|
|
\n} while ( \$attempts < \$max )\
|
|
\n}\
|
|
\n" lease-time=1h name=dhcp1
|
|
/ip pool
|
|
add name=mgmt next-pool=public ranges=10.10.160.1-10.10.174.254
|
|
/ip dhcp-server
|
|
add add-arp=yes address-pool=mgmt interface=management lease-script="{\
|
|
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
|
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/cd\
|
|
c24944-c947-4e01-9c54-07a1653d2e3e\"\
|
|
\n:local url2 \"https://iptrack.vntx.net/api/dhcp\"\
|
|
\n:local max 1\
|
|
\n\
|
|
\n:local attempts 0\
|
|
\n:local success1 0\
|
|
\n:local success2 0\
|
|
\n:do {\
|
|
\n :set attempts (\$attempts+1);\
|
|
\n :if (\$leaseBound = 0) do {\
|
|
\n # Try url2 (iptrack.vntx.net) - deassignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
|
|
t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\"}\"\
|
|
\n :set success1 1;\
|
|
\n :log info \"DHCP deassignment successfully sent to iptrack.vntx.ne\
|
|
t for \$leaseActMAC / \$leaseActIP\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send deassignment to iptrack.vntx.net \
|
|
on attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
|
|
\n }\
|
|
\n\
|
|
\n # Try url (gaiia) - deassignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
|
|
\_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
|
|
\\\":\\\"\\\"}\"\
|
|
\n :set success2 1;\
|
|
\n :log info \"DHCP deassignment successfully sent to gaiia AWS API f\
|
|
or \$leaseActMAC / \$leaseActIP\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send deassignment to gaiia AWS API on \
|
|
attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
|
|
\n }\
|
|
\n\
|
|
\n :if (\$success1 != 1 || \$success2 != 1) do={\
|
|
\n :delay 3s;\
|
|
\n }\
|
|
\n } else {\
|
|
\n :delay 1s;\
|
|
\n :local remoteID [/ip dhcp-server lease get [find where address=\$lea\
|
|
seActIP] agent-remote-id];\
|
|
\n\
|
|
\n # Try url2 (iptrack.vntx.net) - assignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
|
|
t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
|
|
\\\":\\\"\$remoteID\\\"}\"\
|
|
\n :set success1 1;\
|
|
\n :log info \"DHCP assignment successfully sent to iptrack.vntx.net \
|
|
for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send assignment to iptrack.vntx.net on\
|
|
\_attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\"\
|
|
;\
|
|
\n }\
|
|
\n\
|
|
\n # Try url (gaiia) - assignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
|
|
\_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
|
|
\\\":\\\"\$remoteID\\\"}\"\
|
|
\n :set success2 1;\
|
|
\n :log info \"DHCP assignment successfully sent to gaiia AWS API for\
|
|
\_\$leaseActMAC / \$leaseActIP / \$remoteID\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send assignment to gaiia AWS API on at\
|
|
tempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
|
|
\n }\
|
|
\n\
|
|
\n :if (\$success1 != 1 || \$success2 != 1) do={\
|
|
\n :delay 30s;\
|
|
\n }\
|
|
\n }\
|
|
\n :if (\$success1 = 1 && \$success2 = 1) do {\
|
|
\n :set attempts \$max;\
|
|
\n }\
|
|
\n} while ( \$attempts < \$max )\
|
|
\n}\
|
|
\n" lease-time=1h name=dhcp2
|
|
/ip smb users
|
|
set [ find default=yes ] disabled=yes
|
|
/ppp profile
|
|
set *0 dns-server=204.110.191.240,204.110.191.250 local-address=\
|
|
204.110.188.94 remote-address=public use-upnp=no
|
|
add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \
|
|
local-address=100.64.175.254 name=494 on-down="{\
|
|
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
|
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
|
|
7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
|
|
\n:local url2 \"https://iptrack.vntx.net/api/pppoe\"\
|
|
\n:local max 1\
|
|
\n\
|
|
\n:local localAddr \$\"local-address\"\
|
|
\n:local remoteAddr \$\"remote-address\"\
|
|
\n:local callerId \$\"caller-id\"\
|
|
\n:local calledId \$\"called-id\"\
|
|
\n:local interfaceName [/interface get \$interface name]\
|
|
\n\
|
|
\n:local attempts 0\
|
|
\n:local success1 0\
|
|
\n:local success2 0\
|
|
\n:do {\
|
|
\n :set attempts (\$attempts+1);\
|
|
\n\
|
|
\n # Try url2 (iptrack.vntx.net)\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=post \
|
|
http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"boun\
|
|
d\\\":\\\"0\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\
|
|
\\\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
|
|
\n :set success1 1;\
|
|
\n :log info \"PPPoE deassignment successfully sent to iptrack.vntx.net\
|
|
\_for \$user / \$remoteAddr\";\
|
|
\n } on-error={\
|
|
\n :log error \"PPPoE FAILED to send deassignment to iptrack.vntx.net o\
|
|
n attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
|
|
\n }\
|
|
\n\
|
|
\n # Try url (AWS API)\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post h\
|
|
ttp-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bound\
|
|
\\\":\\\"0\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\\\
|
|
\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
|
|
\n :set success2 1;\
|
|
\n :log info \"PPPoE deassignment successfully sent to gaiia AWS API fo\
|
|
r \$user / \$remoteAddr\";\
|
|
\n } on-error={\
|
|
\n :log error \"PPPoPoE FAILED to send deassignment to gaiia AWS API on\
|
|
\_attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
|
|
\n }\
|
|
\n\
|
|
\n :if (\$success1 = 1 && \$success2 = 1) do {\
|
|
\n :set attempts \$max;\
|
|
\n } else {\
|
|
\n :delay 3s;\
|
|
\n }\
|
|
\n} while ( \$attempts < \$max )\
|
|
\n}\
|
|
\n" on-up="{\
|
|
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
|
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
|
|
7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
|
|
\n:local url2 \"https://iptrack.vntx.net/api/pppoe\"\
|
|
\n:local max 5\
|
|
\n\
|
|
\n:local localAddr \$\"local-address\"\
|
|
\n:local remoteAddr \$\"remote-address\"\
|
|
\n:local callerId \$\"caller-id\"\
|
|
\n:local calledId \$\"called-id\"\
|
|
\n:local interfaceName [/interface get \$interface name]\
|
|
\n\
|
|
\n:local attempts 0\
|
|
\n:local success1 0\
|
|
\n:local success2 0\
|
|
\n:do {\
|
|
\n :set attempts (\$attempts+1);\
|
|
\n\
|
|
\n # Try url2 (iptrack.vntx.net)\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=post \
|
|
http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"boun\
|
|
d\\\":\\\"1\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\
|
|
\\\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
|
|
\n :set success1 1;\
|
|
\n :log info \"PPPoE assignment successfully sent to iptrack.vntx.net f\
|
|
or \$user / \$remoteAddr\";\
|
|
\n } on-error={\
|
|
\n :log error \"PPPoE FAILED to send assignment to iptrack.vntx.net on \
|
|
attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
|
|
\n }\
|
|
\n\
|
|
\n # Try url (gaiia)\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post h\
|
|
ttp-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bound\
|
|
\\\":\\\"1\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\\\
|
|
\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
|
|
\n :set success2 1;\
|
|
\n :log info \"PPPoE assignment successfully sent to gaiia AWS API for \
|
|
\$user / \$remoteAddr\";\
|
|
\n } on-error={\
|
|
\n :log error \"PPPoE FAILED to send assignment to gaiia AWS API on att\
|
|
empt \$attempts out of \$max for \$user / \$remoteAddr\";\
|
|
\n }\
|
|
\n\
|
|
\n :if (\$success1 = 1 && \$success2 = 1) do {\
|
|
\n :set attempts \$max;\
|
|
\n } else {\
|
|
\n :delay 3s;\
|
|
\n }\
|
|
\n} while ( \$attempts < \$max )\
|
|
\n}\
|
|
\n" remote-address=cgnat use-upnp=no
|
|
/queue type
|
|
add kind=fq-codel name=fq-codel
|
|
/queue interface
|
|
set ether1 queue=fq-codel
|
|
set ether2-climax queue=fq-codel
|
|
set ether3 queue=fq-codel
|
|
set ether4 queue=fq-codel
|
|
set ether5 queue=fq-codel
|
|
set ether6 queue=fq-codel
|
|
set ether7 queue=fq-codel
|
|
set ether8 queue=fq-codel
|
|
set sfp-sfpplus1 queue=fq-codel
|
|
/routing id
|
|
add disabled=no id=10.254.254.111 name=id-1 select-dynamic-id=any \
|
|
select-from-vrf=main
|
|
/routing ospf instance
|
|
add disabled=no in-filter-chain=ospf-in name=ospf-instance-1 \
|
|
originate-default=never out-filter-chain=ospf-out router-id=id-1
|
|
/routing ospf area
|
|
add disabled=no instance=ospf-instance-1 name=ospf-area-1
|
|
/snmp community
|
|
set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
|
|
kdyyJrT0Mm
|
|
/system logging action
|
|
add name=netsvr remote=204.110.191.229 remote-port=1514 target=remote
|
|
/interface bridge port
|
|
add bridge=494 interface=ether8 internal-path-cost=10 path-cost=10
|
|
add bridge=494 interface=ether7 internal-path-cost=10 path-cost=10
|
|
add bridge=494 interface=ether6 internal-path-cost=10 path-cost=10
|
|
add bridge=494 interface=ether5 internal-path-cost=10 path-cost=10
|
|
add bridge=management interface=vlan10_ether5 internal-path-cost=10 \
|
|
path-cost=10
|
|
add bridge=management interface=vlan10_ether6 internal-path-cost=10 \
|
|
path-cost=10
|
|
add bridge=management interface=vlan10_ether7 internal-path-cost=10 \
|
|
path-cost=10
|
|
add bridge=management interface=vlan10_ether8 internal-path-cost=10 \
|
|
path-cost=10
|
|
/ip firewall connection tracking
|
|
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
|
|
tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
|
|
tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
|
|
tcp-time-wait-timeout=2m udp-stream-timeout=2m
|
|
/ip neighbor discovery-settings
|
|
set discover-interface-list=!dynamic
|
|
/ip settings
|
|
set tcp-syncookies=yes
|
|
/interface pppoe-server server
|
|
add default-profile=494 disabled=no interface=494 max-mru=1492 max-mtu=1492 \
|
|
one-session-per-host=yes service-name=494
|
|
/ip address
|
|
add address=10.254.254.111 comment=Loopback interface=lo network=\
|
|
10.254.254.111
|
|
add address=10.250.1.65/29 interface=ether2-climax network=10.250.1.64
|
|
add address=204.110.188.94/27 interface=494 network=204.110.188.64
|
|
add address=10.10.175.254/20 interface=management network=10.10.160.0
|
|
add address=100.64.175.254/20 interface=494 network=100.64.160.0
|
|
/ip dhcp-client
|
|
# Interface not active
|
|
add interface=ether1
|
|
# Interface not active
|
|
add interface=ether3
|
|
/ip dhcp-server lease
|
|
add address=10.10.175.10 mac-address=78:8A:20:AC:C5:32
|
|
add address=10.10.175.11 mac-address=58:C1:7A:75:4D:F2
|
|
/ip dhcp-server network
|
|
add address=10.10.160.0/20 dns-server=204.110.191.240,204.110.191.20 domain=\
|
|
vntx.net gateway=10.10.175.254 ntp-server=204.110.191.19
|
|
add address=100.64.160.0/20 dns-server=204.110.191.240,204.110.191.20 domain=\
|
|
vntx.net gateway=100.64.175.254 ntp-server=204.110.191.19
|
|
/ip dns
|
|
set servers=9.9.9.9,1.1.1.1
|
|
/ip firewall address-list
|
|
add address=154.66.115.255 list=CPF
|
|
add address=10.0.0.0/8 list=CPF
|
|
add address=192.168.0.0/16 list=CPF
|
|
add address=172.16.0.0/12 list=CPF
|
|
/ip firewall filter
|
|
add action=accept chain=forward comment=\
|
|
"bypass fasttrack for MPLS spine (out)" out-interface=ether2-climax
|
|
add action=accept chain=forward comment=\
|
|
"bypass fasttrack for MPLS spine (in)" in-interface=ether2-climax
|
|
add action=fasttrack-connection chain=forward comment=\
|
|
"fasttrack established/related" connection-state=established,related
|
|
add action=drop chain=forward src-address-list=suspended
|
|
add action=drop chain=forward dst-address-list=suspended
|
|
add action=drop chain=forward dst-port=23 protocol=tcp
|
|
add action=accept chain=forward comment="accept established/related" \
|
|
connection-state=established,related
|
|
/ip ipsec profile
|
|
set [ find default=yes ] dh-group=modp2048 dpd-interval=2m \
|
|
dpd-maximum-failures=5 enc-algorithm=aes-256,aes-128 hash-algorithm=\
|
|
sha256
|
|
/ip proxy
|
|
set port=43133
|
|
/ip route
|
|
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\
|
|
10.250.1.70%ether2-climax pref-src="" routing-table=main scope=30 \
|
|
target-scope=10
|
|
/ip service
|
|
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
|
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
|
set www address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
|
set www-ssl address=204.110.188.0/22,10.0.0.0/8
|
|
set ssh address=204.110.188.0/22,10.0.0.0/8 port=1022
|
|
set winbox address=204.110.188.0/22,10.0.0.0/8
|
|
set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10
|
|
set api-ssl address=0.0.0.0/0 certificate=myCa
|
|
/ip ssh
|
|
set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
|
|
/ipv6 nd
|
|
set [ find default=yes ] advertise-dns=yes
|
|
/mpls interface
|
|
add interface=ether2-climax mpls-mtu=1508
|
|
/mpls ldp
|
|
add disabled=no lsr-id=10.254.254.111 transport-addresses=10.254.254.111 vrf=\
|
|
main
|
|
/mpls ldp interface
|
|
add interface=ether2-climax
|
|
/ppp aaa
|
|
set interim-update=15m use-radius=yes
|
|
/radius
|
|
add address=204.110.191.248 require-message-auth=no service=ppp src-address=\
|
|
204.110.188.94 timeout=300ms
|
|
add address=204.110.191.2 require-message-auth=no service=ppp src-address=\
|
|
204.110.188.94 timeout=300ms
|
|
add accounting-backup=yes address=45.76.56.5 disabled=yes \
|
|
require-message-auth=no service=ppp src-address=204.110.188.94 timeout=\
|
|
300ms
|
|
/routing bfd configuration
|
|
add disabled=no interfaces=ether2-climax min-rx=200ms min-tx=200ms \
|
|
multiplier=5 vrf=main
|
|
/routing filter rule
|
|
add chain=ospf-in disabled=no rule="accept;\r\
|
|
\n"
|
|
add chain=ospf-out disabled=no rule="accept;"
|
|
/routing ospf interface-template
|
|
add area=ospf-area-1 auth=sha512 auth-id=1 disabled=no interfaces=\
|
|
ether2-climax type=ptp use-bfd=yes
|
|
add area=ospf-area-1 disabled=no passive
|
|
/routing ospf static-neighbor
|
|
add address=10.250.1.70%ether2-climax area=ospf-area-1 disabled=no \
|
|
poll-interval=10s
|
|
/snmp
|
|
set contact=graham@vntx.net enabled=yes location="33.208204, -96.462530"
|
|
/system clock
|
|
set time-zone-name=America/Chicago
|
|
/system identity
|
|
set name=494
|
|
/system logging
|
|
add action=netsvr prefix=test1 topics=system,info
|
|
add action=netsvr prefix=test1 topics=warning
|
|
add action=netsvr prefix=test1 topics=critical
|
|
add action=netsvr prefix=test1 topics=error,!ospf,!route
|
|
/system ntp client
|
|
set enabled=yes
|
|
/system ntp client servers
|
|
add address=ntp.vntx.net
|
|
add address=0.us.pool.ntp.org
|
|
/system package update
|
|
set channel=long-term
|
|
/system routerboard settings
|
|
# Firmware upgraded successfully, please reboot for changes to take effect!
|
|
set auto-upgrade=yes
|
|
/system scheduler
|
|
add name=reboot on-event="/system reboot" policy=\
|
|
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
|
|
start-date=2025-02-16 start-time=03:40:00
|