API tools faq
paste
isjq992

RouterOS

isjq992
Oct 22nd, 2014
74
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 8.68 KB | None | 0 0
raw download clone embed print report
  1. # oct/22/2014 16:09:58 by RouterOS 6.15
  2. # software id = D878-190M
  3. #
  4. /interface bridge
  5. add l2mtu=1594 name=bridge-iptv
  6. add arp=proxy-arp l2mtu=1598 name=bridge-local
  7. add l2mtu=1594 name=bridge-tel
  8. /interface ethernet
  9. set [ find default-name=ether1 ] arp=proxy-arp name=ether1-gateway speed=\
  10. 1Gbps
  11. set [ find default-name=ether2 ] speed=1Gbps
  12. /interface pptp-server
  13. add name=pptp-in1 user=""
  14. /ip neighbor discovery
  15. set ether1-gateway discover=no
  16. set sfp1 discover=no
  17. /interface vlan
  18. add interface=ether1-gateway l2mtu=1594 name=vlan1.4 vlan-id=4
  19. add interface=ether1-gateway l2mtu=1594 name=vlan1.6 vlan-id=6
  20. add interface=ether1-gateway l2mtu=1594 name=vlan1.7 vlan-id=7
  21. add disabled=yes interface=ether10 name=vlan10.4 vlan-id=4
  22. add interface=ether10 l2mtu=1594 name=vlan10.7 vlan-id=7
  23. /ip neighbor discovery
  24. set vlan1.6 discover=no
  25. /interface wireless security-profiles
  26. add authentication-types=wpa-psk,wpa2-psk eap-methods="" \
  27. management-protection=allowed mode=dynamic-keys name=wireless \
  28. supplicant-identity="" wpa-pre-shared-key=WIFIPASS wpa2-pre-shared-key=\
  29. WIFIPASS
  30. /interface wireless
  31. set [ find default-name=wlan1 ] band=2ghz-b/g/n country=netherlands disabled=\
  32. no l2mtu=2290 mode=ap-bridge security-profile=wireless ssid=wbd65_web
  33. /ip neighbor discovery
  34. set wlan1 discover=no
  35. /ip hotspot user profile
  36. set [ find default=yes ] idle-timeout=none keepalive-timeout=2m \
  37. mac-cookie-timeout=3d
  38. /ip pool
  39. add name=thuisnetwerk ranges=192.168.100.51-192.168.100.200
  40. /ip dhcp-server
  41. add address-pool=thuisnetwerk authoritative=yes disabled=no interface=\
  42. bridge-local lease-time=1h30m name=dhcp-thuis
  43. /port
  44. set 0 name=serial0
  45. /interface pppoe-client
  46. add ac-name="" add-default-route=yes allow=pap,mschap2 \
  47. default-route-distance=1 dial-on-demand=no disabled=no interface=vlan1.6 \
  48. keepalive-timeout=20 max-mru=1480 max-mtu=1480 mrru=disabled name=pppoe \
  49. password=kpn profile=default service-name="" use-peer-dns=no user=\
  50. MACADDRESS@direct-adsl
  51. /ip neighbor discovery
  52. set pppoe discover=no
  53. /routing bgp instance
  54. set default disabled=yes
  55. /interface bridge port
  56. add bridge=bridge-local interface=ether2
  57. add bridge=bridge-local interface=ether3
  58. add bridge=bridge-local interface=ether4
  59. add bridge=bridge-local interface=ether5
  60. add bridge=bridge-local interface=wlan1
  61. add bridge=bridge-iptv interface=vlan1.4
  62. add bridge=bridge-iptv interface=ether6
  63. add bridge=bridge-tel interface=vlan1.7
  64. add bridge=bridge-iptv interface=ether7
  65. add bridge=bridge-tel interface=vlan10.7
  66. add bridge=bridge-iptv disabled=yes interface=vlan10.4
  67. /interface pptp-server server
  68. set enabled=yes max-mru=1460 max-mtu=1460
  69. /ip address
  70. add address=192.168.100.250/24 interface=bridge-local network=192.168.100.0
  71. /ip dhcp-server config
  72. set store-leases-disk=15m
  73. /ip dhcp-server lease
  74. add address=192.168.100.144 comment="TP Link beneden" mac-address=\
  75. F8:1A:67:95:BC:BE server=dhcp-thuis
  76. add address=192.168.100.132 client-id=1:0:1d:d8:2d:21:c9 comment=Xbox \
  77. mac-address=00:1D:D8:2D:21:C9 server=dhcp-thuis
  78. add address=192.168.100.145 comment="TP Link praktijk" mac-address=\
  79. F8:1A:67:95:B4:08 server=dhcp-thuis
  80. add address=192.168.100.147 comment="MB Live Duo" mac-address=\
  81. 00:90:A9:B6:98:47 server=dhcp-thuis
  82. add address=192.168.100.149 comment="Brother printer" mac-address=\
  83. 78:E4:00:A6:07:3E server=dhcp-thuis
  84. add address=192.168.100.143 client-id=1:9c:b6:54:58:c8:75 comment="HP 8600" \
  85. mac-address=9C:B6:54:58:C8:75 server=dhcp-thuis
  86. add address=192.168.100.142 comment=OpenELEC mac-address=00:21:6B:0A:09:80 \
  87. server=dhcp-thuis
  88. add address=192.168.100.141 comment=X360XBMC mac-address=00:13:77:B2:91:53 \
  89. server=dhcp-thuis
  90. add address=192.168.100.133 client-id=1:0:4:20:2d:e9:68 comment=Internetradio \
  91. mac-address=00:04:20:2D:E9:68 server=dhcp-thuis
  92. /ip dhcp-server network
  93. add address=192.168.100.0/24 dns-server=192.168.100.250 domain=thuis.local \
  94. gateway=192.168.100.250
  95. /ip dns
  96. set allow-remote-requests=yes cache-max-ttl=1d servers=8.8.8.8,8.8.4.4
  97. /ip firewall address-list
  98. add address=192.168.100.0/24 comment="LAN Access" list=support
  99. /ip firewall filter
  100. add chain=input in-interface=pppoe protocol=icmp
  101. add chain=input connection-state=related
  102. add chain=input connection-state=established
  103. add action=reject chain=input in-interface=pppoe protocol=tcp reject-with=\
  104. icmp-port-unreachable
  105. add action=reject chain=input in-interface=pppoe protocol=udp reject-with=\
  106. icmp-port-unreachable
  107. add action=drop chain=input comment="Drop invalid connections" \
  108. connection-state=invalid
  109. add action=drop chain=input comment="Drop DNS WAN requests" dst-port=53 \
  110. protocol=udp src-address=!192.168.100.0/24
  111. add chain=input comment=VPN dst-port=1723 protocol=tcp
  112. add chain=input protocol=gre
  113. add action=add-src-to-address-list address-list="port scanners" \
  114. address-list-timeout=2w chain=input comment="Port scanners to list " \
  115. protocol=tcp psd=21,3s,3,1
  116. add action=add-src-to-address-list address-list="port scanners" \
  117. address-list-timeout=2w chain=input comment="NMAP FIN Stealth scan" \
  118. protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
  119. add action=add-src-to-address-list address-list="port scanners" \
  120. address-list-timeout=2w chain=input comment="SYN/FIN scan" protocol=tcp \
  121. tcp-flags=fin,syn
  122. add action=add-src-to-address-list address-list="port scanners" \
  123. address-list-timeout=2w chain=input comment="SYN/RST scan" protocol=tcp \
  124. tcp-flags=syn,rst
  125. add action=add-src-to-address-list address-list="port scanners" \
  126. address-list-timeout=2w chain=input comment="FIN/PSH/URG scan" protocol=\
  127. tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
  128. add action=add-src-to-address-list address-list="port scanners" \
  129. address-list-timeout=2w chain=input comment="ALL/ALL scan" protocol=tcp \
  130. tcp-flags=fin,syn,rst,psh,ack,urg
  131. add action=add-src-to-address-list address-list="port scanners" \
  132. address-list-timeout=2w chain=input comment="NMAP NULL scan" protocol=tcp \
  133. tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
  134. add action=drop chain=input comment="Dropping port scanners" \
  135. src-address-list="port scanners"
  136. add action=jump chain=input comment="Jump for icmp input flow" jump-target=\
  137. ICMP protocol=icmp
  138. add action=drop chain=input comment=\
  139. "Block all access to the winbox - except to support list" dst-port=8291 \
  140. protocol=tcp src-address-list=!support
  141. add action=drop chain=input comment=\
  142. "Block all access to the webfig - except to support list" dst-port=80 \
  143. protocol=tcp src-address-list=!support
  144. add action=jump chain=forward comment="Jump for icmp forward flow" \
  145. jump-target=ICMP protocol=icmp
  146. add chain=input comment="Accept established connections" connection-state=\
  147. established
  148. add chain=input comment="Accept related connections" connection-state=related
  149. add chain=input comment="Full access to SUPPORT address list" \
  150. src-address-list=support
  151. add action=drop chain=input comment="Drop everything else"
  152. add chain=ICMP comment="Echo request - Avoiding Ping Flood" icmp-options=8:0 \
  153. limit=1,5 protocol=icmp
  154. add chain=ICMP comment="Echo reply" icmp-options=0:0 protocol=icmp
  155. add chain=ICMP comment="Time Exceeded" icmp-options=11:0 protocol=icmp
  156. add chain=ICMP comment="Destination unreachable" icmp-options=3:0-1 protocol=\
  157. icmp
  158. add chain=ICMP comment=PMTUD icmp-options=3:4 protocol=icmp
  159. add action=drop chain=ICMP comment="Drop to the other ICMPs" protocol=icmp
  160. add action=jump chain=output comment="Jump for icmp output" jump-target=ICMP \
  161. protocol=icmp
  162. /ip firewall nat
  163. add action=masquerade chain=srcnat out-interface=pppoe src-address=\
  164. 192.168.0.0/16 to-addresses=0.0.0.0
  165. /ip traffic-flow
  166. set cache-entries=4k
  167. /ip upnp
  168. set allow-disable-external-interface=no enabled=yes show-dummy-rule=no
  169. /ip upnp interfaces
  170. add interface=bridge-local type=internal
  171. add interface=pppoe type=external
  172. /lcd
  173. set backlight-timeout=5m
  174. /lcd interface
  175. set sfp1 interface=sfp1
  176. set ether1-gateway interface=ether1-gateway
  177. set ether2 interface=ether2
  178. set ether3 interface=ether3
  179. set ether4 interface=ether4
  180. set ether5 interface=ether5
  181. set ether6 interface=ether6
  182. set ether7 interface=ether7
  183. set ether8 interface=ether8
  184. set ether9 interface=ether9
  185. set ether10 interface=ether10
  186. set wlan1 interface=wlan1
  187. /lcd interface pages
  188. set 0 interfaces="sfp1,ether1-gateway,ether2,ether3,ether4,ether5,ether6,ether\
  189. 7,ether8,ether9,ether10,wlan1"
  190. /ppp secret
  191. add local-address=192.168.100.250 name=wbd65 password=VPNPASS profile=\
  192. default-encryption remote-address=192.168.10.130 service=pptp
  193. /system clock
  194. set time-zone-name=Europe/Amsterdam
  195. /system ntp client
  196. set enabled=yes primary-ntp=50.7.160.12 secondary-ntp=213.136.0.252
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!