MikroTik RouterOS settings

# nov/26/2012 by RouterOS 5.21
# Door: Pogostokje
# Bruikbaar voor een KPN fiber verbinding
# Alleen internet configuratie.
#
/interface ethernet
#
# Poort 1 (ether1) = FIBER (vul eigen MAC in ipv xx:xx...)
#
set 1 arp=proxy-arp auto-negotiation=yes bandwidth=unlimited/unlimited \
    disabled=no full-duplex=yes l2mtu=1598 mac-address=XX:XX:XX... \
    master-port=none mtu=1500 name=ether1-gateway speed=1Gbps
#
# Poort 2 (ether2) = LAN (gaat bij mij naar een switch)
#
set 2 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited \
    disabled=no full-duplex=yes l2mtu=1598 \
    master-port=none mtu=1500 name=ether2 speed=1Gbps
#
# VLAN 6 = internet, deze koppelen we aan de fysieke interface ether1
#
/interface vlan
add arp=enabled disabled=no interface=ether1-gateway l2mtu=1594 mtu=1500 \
    name=vlan1.6 use-service-tag=no vlan-id=6
#
# PPPOE profiel
#
/ppp profile
set 0 change-tcp-mss=yes name=default only-one=default use-compression=\
    default use-encryption=default use-mpls=default use-vj-compression=\
    default
#
# PPPOE CLIENT, deze koppelen we aan de VLAN6 interface die hierboven gemaakt is.
# (vul eigen MAC in ipv xx-xx...) Let op: hier worden streepjes gebruikt ipv dubbele punten
#
/interface pppoe-client
add ac-name="" add-default-route=yes allow=pap,chap,mschap1,mschap2 \
    dial-on-demand=no disabled=no interface=vlan1.6 max-mru=1480 max-mtu=1480 \
    mrru=disabled name=pppoe password=kpn profile=default service-name="" \
    use-peer-dns=no user=XX-XX-XX...@direct-adsl

#
# BGP, alleen maar even om zeker te zijn dat hij disabled is
#
/routing bgp instance
set default as=65530 client-to-client-reflection=yes disabled=yes \
    ignore-as-path-len=no name=default out-filter="" redistribute-connected=\
    no redistribute-ospf=no redistribute-other-bgp=no redistribute-rip=no \
    redistribute-static=no router-id=0.0.0.0 routing-table=""
#
# Bridges, ofwel verzameling switchpoorten die bij elkaar horen. Let op: poort 1 zit niet in de LAN bridgepoort!
#
/interface bridge port
add bridge=bridge-local disabled=no edge=auto external-fdb=auto horizon=none \
    interface=ether2 path-cost=10 point-to-point=auto priority=0x80
add bridge=bridge-local disabled=no edge=auto external-fdb=auto horizon=none \
    interface=ether3 path-cost=10 point-to-point=auto priority=0x80
add bridge=bridge-local disabled=no edge=auto external-fdb=auto horizon=none \
    interface=ether4 path-cost=10 point-to-point=auto priority=0x80
add bridge=bridge-local disabled=no edge=auto external-fdb=auto horizon=none \
    interface=ether5 path-cost=10 point-to-point=auto priority=0x80
add bridge=bridge-local disabled=no edge=auto external-fdb=auto horizon=none \
    interface=ether6-master-local path-cost=10 point-to-point=auto priority=\
    0x80
add bridge=bridge-local disabled=no edge=auto external-fdb=auto horizon=none \
    interface=wlan1 path-cost=10 point-to-point=auto priority=0x80
/interface bridge settings
set use-ip-firewall=no use-ip-firewall-for-pppoe=no use-ip-firewall-for-vlan=\
    no
/interface ethernet switch port
set 0 vlan-header=leave-as-is vlan-mode=disabled
set 1 vlan-header=leave-as-is vlan-mode=disabled
set 2 vlan-header=leave-as-is vlan-mode=disabled
set 3 vlan-header=leave-as-is vlan-mode=disabled
set 4 vlan-header=leave-as-is vlan-mode=disabled
set 5 vlan-header=leave-as-is vlan-mode=disabled
set 6 vlan-header=leave-as-is vlan-mode=disabled
set 7 vlan-header=leave-as-is vlan-mode=disabled
set 8 vlan-header=leave-as-is vlan-mode=disabled
set 9 vlan-header=leave-as-is vlan-mode=disabled
set 10 vlan-header=leave-as-is vlan-mode=disabled
set 11 vlan-header=leave-as-is vlan-mode=disabled
set 12 vlan-header=leave-as-is vlan-mode=disabled
#
# Lokaal adres van de router
#
/ip address
add address=192.168.5.250/24 disabled=no interface=ether2 network=192.168.5.0
#
# De router zelf gebruikt de DNS van Google, lekker betrouwbaar.
#
/ip dns
set allow-remote-requests=no cache-max-ttl=1w cache-size=2048KiB \
    max-udp-packet-size=4096 servers=8.8.8.8,8.8.4.4
#
# De 3 standaard rules voor de firewall
#
/ip firewall filter
add action=accept chain=input disabled=no in-interface=pppoe protocol=icmp
add action=accept chain=input connection-state=related disabled=no
add action=accept chain=input connection-state=established disabled=no
#
# De NAT regel om vanaf LAN het internet te kunnen gebruiken, vervang evt het src adres door je eigen LAN IP reeks.
#
/ip firewall nat
add action=masquerade chain=srcnat disabled=no out-interface=pppoe \
    src-address=192.168.0.0/16 to-addresses=0.0.0.0
#
# Geen rotzooi naar KPN sturen, dus we disablen discovery op de poorten naar KPN.
#
/ip neighbor discovery
set sfp1-gateway disabled=yes
set ether1-gateway disabled=yes
set ether2 disabled=no
set ether3 disabled=no
set ether4 disabled=no
set ether5 disabled=no
set ether6-master-local disabled=no
set ether7-slave-local disabled=no
set ether8-slave-local disabled=no
set ether9-slave-local disabled=no
set ether10-slave-local disabled=no
set wlan1 disabled=yes
set bridge-local disabled=no
set pppoe disabled=yes
set pptp-in1 disabled=yes
set vlan1.6 disabled=yes

#
# Hou de PPPoE verbinding aktief door elke 15 seconden een ping te sturen
#
/tool netwatch
add host=195.190.241.23 interval=15s

#
# Algemene andere dingetjes
#
/ip traffic-flow
set active-flow-timeout=30m cache-entries=4k enabled=no \
    inactive-flow-timeout=15s interfaces=all
/ip upnp
set allow-disable-external-interface=no enabled=yes show-dummy-rule=yes
/ip upnp interfaces
add disabled=no interface=bridge-local type=internal
add disabled=no interface=pppoe type=external
/lcd
set backlight-timeout=30m enabled=yes
/system clock
set time-zone-name=Europe/Amsterdam