689 lines
37 KiB
Text
689 lines
37 KiB
Text
# may/08/2026 17:46:02 by RouterOS 6.49.18
|
|
# software id = 8XZE-R7EJ
|
|
#
|
|
# model = CCR2004-1G-12S+2XS
|
|
# serial number = C8A70C55A930
|
|
/interface bridge
|
|
add name=cgnat
|
|
add fast-forward=no name=loopback
|
|
/interface ethernet
|
|
set [ find default-name=ether1 ] rx-flow-control=auto tx-flow-control=auto
|
|
set [ find default-name=sfp-sfpplus7 ] auto-negotiation=no name=\
|
|
sfp-sfpplus7-core-direct
|
|
set [ find default-name=sfp-sfpplus8 ] name=sfp-sfpplus8-server-switch \
|
|
rx-flow-control=auto tx-flow-control=auto
|
|
set [ find default-name=sfp-sfpplus10 ] rx-flow-control=auto tx-flow-control=\
|
|
auto
|
|
set [ find default-name=sfp-sfpplus11 ] name=sfp-sfpplus11-preseem \
|
|
rx-flow-control=auto tx-flow-control=auto
|
|
set [ find default-name=sfp-sfpplus12 ] l2mtu=1500 name=\
|
|
sfp-sfpplus12-spectrum rx-flow-control=auto tx-flow-control=auto
|
|
/interface vlan
|
|
add interface=sfp-sfpplus8-server-switch name=vlan9_sfpplus8 vlan-id=9
|
|
/interface wireless security-profiles
|
|
set [ find default=yes ] supplicant-identity=MikroTik
|
|
/ip dhcp-server
|
|
add disabled=no interface=vlan9_sfpplus8 name=servers-public
|
|
/ip pool
|
|
add name=380building ranges=10.0.0.150-10.0.0.239
|
|
add name=servers-public ranges=204.110.191.193-204.110.191.217
|
|
/ip dhcp-server
|
|
add address-pool=380building disabled=no interface=sfp-sfpplus8-server-switch \
|
|
name=380-building
|
|
/ppp profile
|
|
add name=RWB_sstp_profile
|
|
/queue simple
|
|
add burst-limit=1M/1M burst-threshold=1M/1M burst-time=1s/1s disabled=yes \
|
|
limit-at=1M/1M max-limit=1M/1M name=Delinquent packet-marks=Delenquent \
|
|
priority=2/2 target=""
|
|
add burst-limit=1/1 burst-threshold=1/1 burst-time=1s/1s disabled=yes \
|
|
limit-at=1/1 max-limit=1/1 name=Inactive packet-marks=Inactive priority=\
|
|
2/2 target=""
|
|
/routing bgp instance
|
|
set default as=393837 out-filter=twc-out router-id=204.110.191.190
|
|
/routing ospf instance
|
|
set [ find default=yes ] distribute-default=always-as-type-1 router-id=\
|
|
10.254.254.254
|
|
/routing ospf-v3 instance
|
|
set [ find default=yes ] distribute-default=always-as-type-1 \
|
|
redistribute-connected=as-type-1 router-id=10.254.254.254
|
|
/snmp community
|
|
set [ find default=yes ] name=onehuargd4a8974y79a497yi
|
|
add addresses=204.110.188.0/22,10.0.0.0/8 name=kdyyJrT0Mm
|
|
/system logging action
|
|
add name=logs remote=204.110.191.229 remote-port=1514 src-address=\
|
|
10.254.254.254 target=remote
|
|
/user group
|
|
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\
|
|
sword,web,sniff,sensitive,api,romon,dude,tikapp"
|
|
/ip firewall connection tracking
|
|
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
|
|
tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
|
|
tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
|
|
tcp-time-wait-timeout=2m udp-stream-timeout=2m udp-timeout=30s
|
|
/ip neighbor discovery-settings
|
|
set discover-interface-list=!dynamic
|
|
/ip settings
|
|
set rp-filter=strict tcp-syncookies=yes
|
|
/ip address
|
|
add address=71.41.226.118/30 interface=sfp-sfpplus12-spectrum network=\
|
|
71.41.226.116
|
|
add address=204.110.191.186/30 interface=sfp-sfpplus11-preseem network=\
|
|
204.110.191.184
|
|
add address=204.110.191.254/26 interface=vlan9_sfpplus8 network=\
|
|
204.110.191.192
|
|
add address=10.254.254.254 interface=loopback network=10.254.254.254
|
|
add address=204.110.191.182/30 interface=sfp-sfpplus7-core-direct network=\
|
|
204.110.191.180
|
|
add address=10.0.0.254/24 interface=sfp-sfpplus8-server-switch network=\
|
|
10.0.0.0
|
|
add address=204.110.190.129/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.130/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.131/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.132/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.133/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.134/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.135/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.136/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.137/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.138/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.139/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.140/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.141/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.142/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.143/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.144/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.145/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.146/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.147/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.148/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.149/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.150/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.151/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.152/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.153/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.154/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.155/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.156/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.157/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.158/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.159/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.160/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.161/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.162/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.163/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.164/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.165/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.166/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.167/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.168/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.169/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.170/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.171/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.172/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.173/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.174/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.175/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.176/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.177/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.178/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.179/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.180/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.181/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.182/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.183/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.184/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.185/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.186/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.187/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.188/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.189/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.190/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.191/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.192/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.193/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.194/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.195/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.196/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.197/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.198/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.199/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.200/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.201/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.202/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.203/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.204/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.205/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.206/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.207/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.208/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.209/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.210/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.211/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.212/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.213/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.214/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.215/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.216/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.217/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.218/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.219/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.220/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.221/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.222/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.223/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.224/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.225/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.226/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.227/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.228/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.229/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.230/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.231/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.232/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.233/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.234/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.235/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.236/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.237/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.238/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.239/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.240/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.241/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.242/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.243/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.244/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.245/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.246/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.247/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.248/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.249/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.250/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.251/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.252/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.253/25 interface=cgnat network=204.110.190.128
|
|
add address=204.110.190.254/25 interface=cgnat network=204.110.190.128
|
|
/ip dhcp-server lease
|
|
add address=10.0.0.249 client-id=1:0:21:9b:91:5c:b6 mac-address=\
|
|
00:21:9B:91:5C:B6 server=380-building
|
|
add address=204.110.191.205 mac-address=BC:24:11:8B:C0:9C
|
|
add address=10.0.0.250 client-id=1:48:a9:8a:38:3b:2d mac-address=\
|
|
48:A9:8A:38:3B:2D server=380-building
|
|
add address=10.0.0.253 client-id=\
|
|
ff:ca:53:9:5a:0:2:0:0:ab:11:2c:53:dd:b2:c1:50:9a:35 comment=truenas \
|
|
mac-address=BC:24:11:29:2B:5A server=380-building
|
|
add address=10.0.0.252 client-id=1:bc:24:11:f5:81:d6 mac-address=\
|
|
BC:24:11:F5:81:D6 server=380-building
|
|
add address=10.0.0.251 client-id=1:bc:24:11:6b:73:53 mac-address=\
|
|
BC:24:11:6B:73:53 server=380-building
|
|
/ip dhcp-server network
|
|
add address=10.0.0.0/24 dns-server=9.9.9.9,1.1.1.1 domain=vntx.net gateway=\
|
|
10.0.0.254 ntp-server=23.150.41.122
|
|
add address=204.110.191.192/26 dns-server=\
|
|
204.110.191.240,204.110.191.250,1.1.1.1 gateway=204.110.191.254
|
|
/ip dns
|
|
set servers=204.110.191.240,204.110.191.250
|
|
/ip firewall address-list
|
|
add address=204.110.188.0/22 list=trusted
|
|
add address=100.64.0.0/10 list=trusted
|
|
add address=10.0.0.0/8 list=trusted
|
|
add address=35.197.73.77 list=preseem
|
|
add address=35.199.29.237 list=preseem
|
|
add address=98.97.82.0/24 comment=starlink list=trusted
|
|
add address=129.222.72.0/24 comment=starlink list=trusted
|
|
add address=129.222.73.0/24 comment=starlink list=trusted
|
|
add address=129.222.74.0/24 comment=starlink list=trusted
|
|
add address=129.222.75.0/24 comment=starlink list=trusted
|
|
add address=129.222.76.0/24 comment=starlink list=trusted
|
|
add address=129.222.77.0/24 comment=starlink list=trusted
|
|
add address=129.222.78.0/24 comment=starlink list=trusted
|
|
add address=129.222.79.0/24 comment=starlink list=trusted
|
|
add address=98.97.80.0/24 comment=starlink list=trusted
|
|
add address=98.97.81.0/24 comment=starlink list=trusted
|
|
add address=98.97.83.0/24 comment=starlink list=trusted
|
|
add address=98.97.84.0/24 comment=starlink list=trusted
|
|
add address=98.97.85.0/24 comment=starlink list=trusted
|
|
add address=98.97.86.0/24 comment=starlink list=trusted
|
|
add address=98.97.87.0/24 comment=starlink list=trusted
|
|
add address=98.97.88.0/24 comment=starlink list=trusted
|
|
add address=98.97.89.0/24 comment=starlink list=trusted
|
|
add address=98.97.90.0/24 comment=starlink list=trusted
|
|
add address=98.97.91.0/24 comment=starlink list=trusted
|
|
add address=98.97.92.0/24 comment=starlink list=trusted
|
|
add address=98.97.93.0/24 comment=starlink list=trusted
|
|
add address=98.97.94.0/24 comment=starlink list=trusted
|
|
add address=98.97.95.0/24 comment=starlink list=trusted
|
|
add address=52.158.209.86 list=trusted
|
|
add address=3.210.85.72 list=gaiia
|
|
add address=3.81.237.51 list=gaiia
|
|
add address=3.215.70.188 list=gaiia
|
|
add address=3.228.90.246 list=gaiia
|
|
add address=47.147.43.145 list=trusted
|
|
add address=71.41.226.117 comment=TWC list=BGP-NEIGHBORS
|
|
add address=204.110.191.185 comment=Preseem list=BGP-NEIGHBORS
|
|
add address=204.110.191.252 comment="Virtual RouterOS" list=BGP-NEIGHBORS
|
|
add address=204.110.188.0/22 list=bgp-networks
|
|
add address=151.243.11.0/24 list=abusive
|
|
add address=172.245.56.83 list=trusted
|
|
/ip firewall filter
|
|
add action=accept chain=input comment="BGP Input" dst-port=179 protocol=tcp
|
|
add action=accept chain=output comment="BGP Output" protocol=tcp src-port=179
|
|
add action=accept chain=forward comment="BGP Forward" dst-port=179 protocol=\
|
|
tcp
|
|
add action=accept chain=forward comment="BGP Forward Reply" protocol=tcp \
|
|
src-port=179
|
|
add action=accept chain=input comment="OSPF Input" protocol=ospf
|
|
add action=accept chain=output comment="OSPF Output" protocol=ospf
|
|
add action=accept chain=forward comment="OSPF Forward" protocol=ospf
|
|
add action=accept chain=input comment="Established Input" connection-state=\
|
|
established,related
|
|
add action=accept chain=forward comment="Established Forward" \
|
|
connection-state=established,related
|
|
add action=accept chain=input comment="Allow Remote Winbox" disabled=yes \
|
|
in-interface=*18
|
|
add action=fasttrack-connection chain=forward comment=\
|
|
"fasttrack established/related" connection-state=established,related
|
|
add action=accept chain=forward comment="accept established/related" \
|
|
connection-state=established,related
|
|
add action=drop chain=forward dst-address=91.190.98.0/24 log=yes
|
|
add action=accept chain=forward dst-port=23 protocol=tcp src-address=\
|
|
204.110.190.208
|
|
add action=accept chain=forward dst-address=204.110.191.219
|
|
add action=accept chain=forward dst-address=204.110.191.222
|
|
add action=accept chain=forward dst-address=204.110.191.252
|
|
add action=accept chain=forward dst-address=204.110.191.8
|
|
add action=accept chain=forward dst-address=204.110.191.192/26 src-address=\
|
|
52.158.209.86
|
|
add action=accept chain=forward dst-address=204.110.191.210
|
|
add action=accept chain=forward disabled=yes dst-address=204.110.191.248 \
|
|
dst-port=3306 log=yes protocol=tcp
|
|
add action=accept chain=forward dst-address=204.110.191.248 dst-port=3306 \
|
|
protocol=tcp src-address-list=gaiia
|
|
add action=accept chain=forward disabled=yes dst-address=204.110.191.248
|
|
add action=accept chain=forward dst-address=204.110.191.231
|
|
add action=accept chain=forward dst-address=204.110.191.232 in-interface=\
|
|
sfp-sfpplus12-spectrum
|
|
add action=tarpit chain=input protocol=tcp src-address-list=abusive
|
|
add action=drop chain=forward src-address-list=abusive
|
|
add action=accept chain=forward connection-state=established,related \
|
|
disabled=yes
|
|
add action=accept chain=input connection-state=established,related,untracked \
|
|
disabled=yes
|
|
add action=drop chain=forward disabled=yes dst-port=3389 in-interface=\
|
|
sfp-sfpplus12-spectrum protocol=tcp
|
|
add action=drop chain=forward disabled=yes dst-port=3389 in-interface=\
|
|
sfp-sfpplus12-spectrum protocol=udp
|
|
add action=drop chain=forward comment="Drop anyone in Black List (SSH)." \
|
|
in-interface=sfp-sfpplus12-spectrum log-prefix="BL_Black List (SSH)" \
|
|
src-address-list="Black List (SSH)"
|
|
add action=drop chain=forward comment="block incoming ftp" disabled=yes \
|
|
dst-port=21 in-interface=sfp-sfpplus12-spectrum protocol=tcp
|
|
add action=drop chain=forward comment="block incoming telnet" dst-port=23 \
|
|
in-interface=sfp-sfpplus12-spectrum protocol=tcp
|
|
add action=drop chain=input comment="Drop all packets from public internet whi\
|
|
ch should not exist in public network" in-interface=\
|
|
sfp-sfpplus12-spectrum src-address-list=NotPublic
|
|
add action=drop chain=input disabled=yes dst-port=3784 in-interface=\
|
|
sfp-sfpplus12-spectrum log=yes protocol=udp
|
|
add action=drop chain=forward comment=bfd dst-port=3784 in-interface=\
|
|
sfp-sfpplus12-spectrum protocol=udp
|
|
add action=drop chain=input comment=bfd dst-port=3784 in-interface=\
|
|
sfp-sfpplus12-spectrum protocol=udp
|
|
add action=drop chain=input comment="Drop Invalid connections" \
|
|
connection-state=invalid
|
|
add action=add-src-to-address-list address-list=winbox_blacklist \
|
|
address-list-timeout=4w3d chain=input connection-state=new disabled=yes \
|
|
dst-port=8291 log=yes protocol=tcp src-address-list=winbox_stage3
|
|
add action=add-src-to-address-list address-list=winbox_stage3 \
|
|
address-list-timeout=1m chain=input connection-state=new disabled=yes \
|
|
dst-port=8291 protocol=tcp src-address-list=winbox_stage2
|
|
add action=add-src-to-address-list address-list=winbox_stage2 \
|
|
address-list-timeout=1m chain=input connection-state=new disabled=yes \
|
|
dst-port=8291 protocol=tcp src-address-list=winbox_stage1
|
|
add action=add-src-to-address-list address-list=winbox_stage1 \
|
|
address-list-timeout=1m chain=input connection-state=new disabled=yes \
|
|
dst-port=8291 protocol=tcp src-address-list=!vntx
|
|
add action=drop chain=forward comment="drop winbox brute downstream" \
|
|
disabled=yes dst-port=8291 protocol=tcp src-address-list=winbox_blacklist
|
|
add action=accept chain=input comment="BGP Neighbors" dst-port=179 protocol=\
|
|
tcp src-address-list=BGP-NEIGHBORS
|
|
add action=drop chain=input comment="Drop anyone in Black List (SSH)." \
|
|
disabled=yes in-interface=sfp-sfpplus12-spectrum log-prefix=\
|
|
"BL_Black List (SSH)" src-address-list="Black List (SSH)"
|
|
add action=jump chain=input comment="Jump to Black List (SSH) chain." \
|
|
dst-port=22 in-interface=sfp-sfpplus12-spectrum jump-target=\
|
|
"Black List (SSH) Chain" protocol=tcp
|
|
add action=drop chain=input comment=. dst-port=23 in-interface=\
|
|
sfp-sfpplus12-spectrum protocol=tcp
|
|
add action=drop chain=forward comment=. dst-port=23 in-interface=\
|
|
sfp-sfpplus12-spectrum protocol=tcp
|
|
add action=jump chain=forward comment="Jump to Black List (SSH) chain." \
|
|
dst-port=22 in-interface=sfp-sfpplus12-spectrum jump-target=\
|
|
"Black List (SSH) Chain" protocol=tcp
|
|
add action=add-src-to-address-list address-list="Black List (SSH)" \
|
|
address-list-timeout=4w2d chain="Black List (SSH) Chain" comment="Transfer\
|
|
\_repeated attempts from Black List (SSH) Stage 3 to Black List (SSH)." \
|
|
connection-state=new in-interface=sfp-sfpplus12-spectrum log-prefix=\
|
|
"Add_Black List (SSH)" src-address-list="Black List (SSH) Stage 3"
|
|
add action=add-src-to-address-list address-list="Black List (SSH) Stage 3" \
|
|
address-list-timeout=1m chain="Black List (SSH) Chain" comment=\
|
|
"Add successive attempts to Black List (SSH) Stage 3." connection-state=\
|
|
new in-interface=sfp-sfpplus12-spectrum log-prefix=\
|
|
"Add_Black List (SSH) S3" src-address-list="Black List (SSH) Stage 2"
|
|
add action=add-src-to-address-list address-list="Black List (SSH) Stage 2" \
|
|
address-list-timeout=1m chain="Black List (SSH) Chain" comment=\
|
|
"Add successive attempts to Black List (SSH) Stage 2." connection-state=\
|
|
new in-interface=sfp-sfpplus12-spectrum log-prefix=\
|
|
"Add_Black List (SSH) S2" src-address-list="Black List (SSH) Stage 1"
|
|
add action=add-src-to-address-list address-list="Black List (SSH) Stage 1" \
|
|
address-list-timeout=1m chain="Black List (SSH) Chain" comment=\
|
|
"Add initial attempt to Black List (SSH) Stage 1." connection-state=new \
|
|
in-interface=sfp-sfpplus12-spectrum log-prefix="Add_Black List (SSH) S1" \
|
|
src-address-list=!trusted
|
|
add action=return chain="Black List (SSH) Chain" comment=\
|
|
"Return From Black List (SSH) chain."
|
|
add action=accept chain=forward disabled=yes dst-address=204.110.191.192/26 \
|
|
dst-port=3306 log=yes protocol=tcp src-address=162.243.131.32
|
|
add action=accept chain=forward dst-address=204.110.191.197
|
|
add action=accept chain=forward comment=micromirror dst-address=\
|
|
204.110.191.235
|
|
add action=accept chain=forward dst-address=204.110.191.219
|
|
add action=accept chain=forward dst-address=204.110.191.8
|
|
add action=accept chain=forward dst-address=204.110.191.192/26 protocol=icmp
|
|
add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=80 \
|
|
protocol=tcp
|
|
add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=443 \
|
|
protocol=tcp
|
|
add action=accept chain=forward dst-address=204.110.191.232 dst-port=14580 \
|
|
protocol=tcp
|
|
add action=accept chain=forward dst-address=204.110.191.232 dst-port=14501 \
|
|
protocol=tcp
|
|
add action=accept chain=forward comment=wireguard dst-address=204.110.191.247 \
|
|
dst-port=51820 protocol=udp
|
|
add action=accept chain=forward dst-address=204.110.191.247 dst-port=22 \
|
|
protocol=tcp
|
|
add action=drop chain=forward disabled=yes dst-address=204.110.191.192/26 \
|
|
dst-port=3306 log=yes protocol=tcp
|
|
add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=53 \
|
|
protocol=udp src-address-list=trusted
|
|
add action=accept chain=forward comment=ns2 dst-address=204.110.191.239 \
|
|
dst-port=53 protocol=udp
|
|
add action=accept chain=forward comment=ns1 dst-address=204.110.191.249 \
|
|
dst-port=53 protocol=udp
|
|
add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=22 \
|
|
protocol=tcp src-address-list=trusted
|
|
add action=accept chain=forward dst-address=204.110.191.192/26 dst-port=22 \
|
|
protocol=tcp src-address-list=preseem
|
|
add action=accept chain=forward dst-address=204.110.191.192/26 \
|
|
src-address-list=trusted
|
|
add action=drop chain=forward dst-address=204.110.191.192/26 \
|
|
src-address-list=!trusted
|
|
add action=drop chain=input dst-port=8921 protocol=tcp src-address-list=\
|
|
!trusted
|
|
add action=drop chain=forward dst-port=8921 protocol=tcp src-address-list=\
|
|
!trusted
|
|
add action=drop chain=input disabled=yes in-interface=sfp-sfpplus12-spectrum \
|
|
src-address=100.64.0.0/10
|
|
add action=drop chain=output disabled=yes dst-address=100.64.0.0/10 \
|
|
out-interface=sfp-sfpplus12-spectrum
|
|
add action=drop chain=forward disabled=yes in-interface=\
|
|
sfp-sfpplus12-spectrum src-address=100.64.0.0/10
|
|
add action=drop chain=forward disabled=yes out-interface=\
|
|
sfp-sfpplus12-spectrum src-address=100.64.0.0/10
|
|
add action=drop chain=forward disabled=yes dst-address=100.64.0.0/10 \
|
|
out-interface=sfp-sfpplus12-spectrum
|
|
add action=accept chain=input comment="Established Input" connection-state=\
|
|
established,related
|
|
add action=accept chain=forward comment="Established Forward" \
|
|
connection-state=established,related
|
|
add action=accept chain=input comment=BGP dst-port=179 protocol=tcp
|
|
add action=accept chain=output comment=BGP protocol=tcp src-port=179
|
|
add action=accept chain=forward comment=BGP dst-port=179 protocol=tcp
|
|
add action=accept chain=forward comment=BGP protocol=tcp src-port=179
|
|
add action=accept chain=input comment=OSPF protocol=ospf
|
|
add action=accept chain=output comment=OSPF protocol=ospf
|
|
add action=accept chain=forward comment=OSPF protocol=ospf
|
|
add action=drop chain=forward dst-port=23 log-prefix=TELNET protocol=tcp
|
|
/ip firewall mangle
|
|
add action=mark-packet chain=prerouting disabled=yes new-packet-mark=Inactive \
|
|
passthrough=no src-address-list=Inactive
|
|
add action=mark-packet chain=prerouting disabled=yes dst-address-list=\
|
|
Inactive new-packet-mark=Inactive passthrough=no
|
|
add action=accept chain=postrouting disabled=yes protocol=tcp tcp-flags=ack
|
|
/ip firewall nat
|
|
add action=src-nat chain=srcnat comment="Internal NAT catch-all" \
|
|
out-interface=sfp-sfpplus12-spectrum src-address=10.0.0.0/8 to-addresses=\
|
|
204.110.191.190
|
|
add action=src-nat chain=srcnat out-interface=sfp-sfpplus12-spectrum \
|
|
src-address=10.0.0.0/24 to-addresses=204.110.190.254
|
|
add action=src-nat chain=srcnat comment="Loopback NAT" out-interface=\
|
|
sfp-sfpplus12-spectrum src-address=10.254.254.0/24 to-addresses=\
|
|
204.110.191.190
|
|
add action=src-nat chain=srcnat comment="Loopback NAT" out-interface=\
|
|
sfp-sfpplus12-spectrum src-address=10.254.254.0/24 to-addresses=\
|
|
204.110.191.190
|
|
add action=src-nat chain=srcnat out-interface=sfp-sfpplus12-spectrum \
|
|
src-address=10.0.0.0/8 to-addresses=204.110.191.190
|
|
add action=src-nat chain=srcnat comment="Internal Network NAT" out-interface=\
|
|
sfp-sfpplus12-spectrum src-address=10.250.1.0/24 to-addresses=\
|
|
204.110.191.190
|
|
add action=src-nat chain=srcnat comment="Internal Network NAT" out-interface=\
|
|
sfp-sfpplus12-spectrum src-address=10.250.1.0/24 to-addresses=\
|
|
204.110.191.190
|
|
add action=src-nat chain=srcnat comment="fallthrough CGNAT" disabled=yes \
|
|
out-interface=sfp-sfpplus12-spectrum src-address=100.64.0.0/10 \
|
|
to-addresses=204.110.190.254
|
|
add action=netmap chain=srcnat ipsec-policy=out,none out-interface=\
|
|
sfp-sfpplus12-spectrum src-address=100.64.0.0/10 to-addresses=\
|
|
204.110.190.128/25
|
|
add action=netmap chain=dstmap comment=\
|
|
"Port Forwarding Solution for CGNAT (TCP)" dst-address=204.110.190.128/25 \
|
|
dst-port=1024-65535 protocol=tcp to-addresses=100.64.0.0/10
|
|
add action=netmap chain=dstmap comment=\
|
|
"Port Forwarding Solution for CGNAT (UDP)" dst-address=204.110.190.128/25 \
|
|
dst-port=1024-65535 protocol=udp to-addresses=100.64.0.0/10
|
|
/ip firewall raw
|
|
add action=drop chain=prerouting src-address-list="Black List (SSH)"
|
|
add action=drop chain=prerouting disabled=yes src-address-list=abusive
|
|
add action=drop chain=prerouting disabled=yes src-address-list=\
|
|
winbox_blacklist
|
|
/ip proxy
|
|
set port=23435
|
|
/ip proxy access
|
|
add src-address=204.110.188.0/22
|
|
/ip route
|
|
add distance=1 gateway=71.41.226.117
|
|
add distance=1 dst-address=10.10.0.0/20 gateway=204.110.191.185
|
|
add distance=1 dst-address=10.10.16.0/20 gateway=204.110.191.185
|
|
add distance=1 dst-address=10.250.1.8/29 gateway=204.110.191.185
|
|
add distance=1 dst-address=10.250.1.8/29 gateway=204.110.191.185
|
|
add distance=1 dst-address=10.250.1.24/29 gateway=204.110.191.185
|
|
add distance=1 dst-address=10.250.1.64/29 gateway=204.110.191.185
|
|
add distance=1 dst-address=10.250.1.64/29 gateway=204.110.191.185
|
|
add distance=1 dst-address=10.250.1.88/29 gateway=204.110.191.185
|
|
add distance=1 dst-address=10.250.1.88/29 gateway=204.110.191.185
|
|
add distance=1 dst-address=10.254.254.101/32 gateway=204.110.191.185
|
|
add distance=1 dst-address=10.254.254.102/32 gateway=204.110.191.185
|
|
add distance=1 dst-address=100.64.0.0/10 gateway=204.110.191.185
|
|
add distance=1 dst-address=100.64.0.0/22 gateway=204.110.191.185
|
|
add distance=1 dst-address=100.64.4.0/22 gateway=204.110.191.185
|
|
add distance=1 dst-address=100.64.4.0/22 gateway=204.110.191.185
|
|
add distance=1 dst-address=100.64.12.0/22 gateway=204.110.191.185
|
|
add distance=1 dst-address=172.63.0.0/20 gateway=204.110.191.253
|
|
add distance=1 dst-address=204.110.188.0/22 gateway=204.110.191.181
|
|
add distance=1 dst-address=204.110.188.0/27 gateway=204.110.191.253
|
|
add distance=1 dst-address=204.110.188.32/27 gateway=204.110.191.185
|
|
add distance=1 dst-address=204.110.188.32/27 gateway=204.110.191.185
|
|
add distance=1 dst-address=204.110.188.224/27 gateway=204.110.191.185
|
|
add distance=1 dst-address=204.110.191.0/27 gateway=204.110.191.185
|
|
/ip service
|
|
set telnet disabled=yes
|
|
set ftp disabled=yes
|
|
set www address=204.110.188.0/22 port=2080
|
|
set ssh address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10 port=1022
|
|
set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10
|
|
set api-ssl address=0.0.0.0/0 certificate=server
|
|
/ip ssh
|
|
set always-allow-password-login=yes forwarding-enabled=remote strong-crypto=\
|
|
yes
|
|
/ipv6 address
|
|
add address=2605:6000:0:8::f:373/127 advertise=no interface=\
|
|
sfp-sfpplus12-spectrum
|
|
add address=2606:1c80::1 interface=vlan9_sfpplus8
|
|
add address=2606:1c80:0:1002::1 interface=sfp-sfpplus11-preseem
|
|
/ipv6 firewall address-list
|
|
add address=2606:1c80::/32 list=bgp-networks
|
|
/ipv6 firewall filter
|
|
add action=accept chain=input comment="IPv6 BGP Input" dst-port=179 protocol=\
|
|
tcp
|
|
add action=accept chain=output comment="IPv6 BGP Output" protocol=tcp \
|
|
src-port=179
|
|
add action=accept chain=forward comment="IPv6 BGP Forward" dst-port=179 \
|
|
protocol=tcp
|
|
add action=accept chain=forward comment="IPv6 BGP Forward Reply" protocol=tcp \
|
|
src-port=179
|
|
add action=accept chain=input comment="IPv6 Established Input" \
|
|
connection-state=established,related
|
|
add action=accept chain=forward comment="IPv6 Established Forward" \
|
|
connection-state=established,related
|
|
/mpls interface
|
|
set [ find default=yes ] mpls-mtu=1530
|
|
add interface=sfp-sfpplus8-server-switch mpls-mtu=1530
|
|
/mpls ldp
|
|
set distribute-for-default-route=yes enabled=yes loop-detect=yes lsr-id=\
|
|
10.254.254.254 transport-address=10.254.254.254
|
|
/mpls ldp accept-filter
|
|
add
|
|
/mpls ldp advertise-filter
|
|
add
|
|
/mpls ldp interface
|
|
add disabled=yes interface=ether1
|
|
add disabled=yes interface=sfp-sfpplus11-preseem transport-address=\
|
|
10.254.254.254
|
|
add disabled=yes interface=vlan9_sfpplus8 transport-address=10.254.254.254
|
|
add interface=sfp-sfpplus8-server-switch
|
|
/routing bfd interface
|
|
set [ find default=yes ] disabled=yes
|
|
add interface=sfp-sfpplus7-core-direct
|
|
add interface=sfp-sfpplus11-preseem
|
|
/routing bgp network
|
|
add network=204.110.188.0/22 synchronize=no
|
|
add network=2606:1c80::/32 synchronize=no
|
|
/routing bgp peer
|
|
add in-filter=twc-in name=twc out-filter=twc-out remote-address=71.41.226.117 \
|
|
remote-as=11427 ttl=default
|
|
add address-families=ipv6 in-filter=twc-in name=twc-v6 out-filter=twc-out \
|
|
remote-address=2605:6000:0:8::f:372 remote-as=11427 ttl=default
|
|
add comment="TEAM-CYMRU BOGON Server #1" disabled=yes in-filter=\
|
|
BOGON-SERVER-IN max-prefix-limit=50 multihop=yes name=CYMRU-1 out-filter=\
|
|
BGP-DROP remote-address=38.229.6.20 remote-as=65332 tcp-md5-key=\
|
|
mC9LaaOi0P
|
|
add comment="TEAM-CYMRU BOGON Server #2" disabled=yes in-filter=\
|
|
BOGON-SERVER-IN max-prefix-limit=50 multihop=yes name=CYMRU-1 out-filter=\
|
|
BGP-DROP remote-address=38.229.46.20 remote-as=65332 tcp-md5-key=\
|
|
mC9LaaOi0P
|
|
add address-families=ip,ipv6 default-originate=always disabled=yes name=\
|
|
edge_core_preseem nexthop-choice=propagate out-filter=bgp-default-only \
|
|
remote-address=204.110.191.185 remote-as=393837
|
|
/routing filter
|
|
add action=accept chain=twc-out comment=blackhole disabled=yes prefix=\
|
|
204.110.188.197 prefix-length=32 set-bgp-communities=7486:666
|
|
add action=accept chain=twc-in prefix=0.0.0.0/0
|
|
add action=accept chain=twc-in prefix=0.0.0.0/0 prefix-length=0
|
|
add action=discard chain=twc-in disabled=yes prefix=0.0.0.0 prefix-length=\
|
|
0-32 protocol=""
|
|
add action=accept chain=twc-out prefix=204.110.188.0/22
|
|
add action=accept chain=twc-out prefix=2606:1c80::/32
|
|
add action=discard chain=twc-out
|
|
add action=discard chain=BGP-DROP
|
|
add action=accept bgp-communities=65333:888 chain=BOGON-SERVER-IN disabled=\
|
|
yes set-type=blackhole
|
|
add action=discard chain=BOGON-SERVER-IN disabled=yes
|
|
add action=discard chain=BGP-DROP
|
|
add action=accept chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \
|
|
prefix-length=0
|
|
add action=discard chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \
|
|
prefix-length=0-32
|
|
/routing ospf interface
|
|
add interface=sfp-sfpplus12-spectrum network-type=broadcast passive=yes
|
|
add interface=sfp-sfpplus11-preseem network-type=point-to-point use-bfd=yes
|
|
add cost=20 interface=sfp-sfpplus9 network-type=nbma use-bfd=yes
|
|
add interface=sfp-sfpplus10 network-type=nbma passive=yes
|
|
add cost=20 interface=ether1 network-type=broadcast
|
|
add interface=sfp-sfpplus8-server-switch network-type=broadcast
|
|
add cost=100 interface=sfp-sfpplus7-core-direct network-type=point-to-point \
|
|
use-bfd=yes
|
|
add interface=vlan9_sfpplus8 network-type=nbma
|
|
/routing ospf nbma-neighbor
|
|
add address=204.110.191.189 poll-interval=10s
|
|
add address=10.250.1.94
|
|
add address=10.250.1.57
|
|
add address=10.250.1.201
|
|
add address=10.250.2.1
|
|
add address=204.110.191.185 poll-interval=10s
|
|
add address=204.110.191.252 poll-interval=10s
|
|
/routing ospf network
|
|
add area=backbone
|
|
/routing ospf-v3 interface
|
|
add area=backbone
|
|
add area=backbone interface=sfp-sfpplus12-spectrum network-type=broadcast \
|
|
passive=yes
|
|
/routing rip
|
|
set distribute-default=always redistribute-connected=yes redistribute-ospf=\
|
|
yes
|
|
/routing rip interface
|
|
add interface=sfp-sfpplus11-preseem
|
|
add interface=sfp-sfpplus7-core-direct
|
|
add interface=sfp-sfpplus8-server-switch
|
|
/routing rip network
|
|
add
|
|
/snmp
|
|
set contact="Verona Networks" enabled=yes location="Verona Networks"
|
|
/system clock
|
|
set time-zone-name=America/Chicago
|
|
/system identity
|
|
set name=edge
|
|
/system logging
|
|
add action=logs topics=info
|
|
/system note
|
|
set note="__ __\
|
|
\n\\ \\ / /__ _ __ ___ _ __ __ _\
|
|
\n \\ \\ / / _ \\ '__/ _ \\| '_ \\ / _` |\
|
|
\n \\ V / __/ | | (_) | | | | (_| |\
|
|
\n \\_/ \\___|_| \\___/|_| |_|\\__,_|\
|
|
\n _ _ _ _\
|
|
\n| \\ | | ___| |___ _____ _ __| | _____\
|
|
\n| \\| |/ _ \\ __\\ \\ /\\ / / _ \\| '__| |/ / __|\
|
|
\n| |\\ | __/ |_ \\ V V / (_) | | | <\\__ \\\
|
|
\n|_| \\_|\\___|\\__| \\_/\\_/ \\___/|_| |_|\\_\\___/\
|
|
\n\
|
|
\n###############################################################\
|
|
\n# Welcome to Verona Networks #\
|
|
\n# All connections are monitored and recorded #\
|
|
\n# Disconnect IMMEDIATELY if you are not an authorized user! #\
|
|
\n###############################################################\
|
|
\n\
|
|
\n" show-at-login=no
|
|
/system ntp client
|
|
set enabled=yes primary-ntp=162.159.200.1 secondary-ntp=45.79.1.70
|
|
/system routerboard settings
|
|
set auto-upgrade=yes
|
|
/system scheduler
|
|
add name=reboot on-event="/system reboot\r\
|
|
\n" policy=\
|
|
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
|
|
start-date=jun/14/2023 start-time=03:00:00
|
|
add comment=RWB_IP_RESOLVER interval=5m name=RWB_IP_RESOLVER on-event=\
|
|
RWB_IP_RESOLVER policy=\
|
|
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
|
|
start-date=oct/13/2022 start-time=22:59:02
|
|
/tool graphing interface
|
|
add allow-address=204.110.188.0/22
|
|
/tool graphing queue
|
|
add allow-address=204.110.188.0/22
|
|
/tool graphing resource
|
|
add allow-address=204.110.188.0/22
|
|
/tool romon
|
|
set enabled=yes
|
|
/user aaa
|
|
set default-group=full
|