2WAN PCC 3:2 PPPoE

# Begin Script
# Please change upon your design decision
# Port 1 or ether1-WAN1 is WAN1 (Dynamic PPPoE Client Mode : WAN1-PPPoE)
# Port 2 or ether2-WAN2 is WAN2 (Dynamic PPPoE Client Mode : WAN2-PPPoE)
# Port 3 or ether3 is LAN (Bridge Member of Interface : "bridge1-Home")
# Port 4 or ether4 is LAN (Bridge Member of Interface : "bridge1-Home")
# Port 5 or ether5 is LAN (Bridge Member of Interface : "bridge1-Home")


/interface bridge
add comment="bridge1-Home : ether3-5" name="bridge1-Home" arp=enabled

/interface ethernet
set [ find default-name=ether1 ] disabled=no name="ether1-WAN1" arp=enabled
set [ find default-name=ether2 ] disabled=no name="ether2-WAN2" arp=enabled

/ip address
add address=192.168.88.1/24 interface="bridge1-Home" network=192.168.88.0 comment="Home (bridge1-Home : ether3-5) = 192.168.88.1/24"


/interface bridge port
add bridge="bridge1-Home" interface=ether3 auto-isolate=no
add bridge="bridge1-Home" interface=ether4 auto-isolate=no
add bridge="bridge1-Home" interface=ether5 auto-isolate=no



/ip service
set api disabled=yes
set api-ssl disabled=yes
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set winbox port=8291 disabled=no
set www port=81 disabled=no
set www-ssl disabled=yes

/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes

/system clock
set time-zone-name=Asia/Bangkok

/ip cloud
set enabled=yes update-time=yes

/ip dns
set allow-remote-requests=yes max-udp-packet-size=548 cache-size=512KiB servers=8.8.8.8,8.8.4.4,208.67.222.222,208.67.220.220

/ip dns static
add address=192.168.88.1 name="DNS-Home"

/ip pool
add name="pool1-Home" ranges=192.168.88.20-192.168.88.240

/ip dhcp-server
add add-arp=yes address-pool="pool1-Home" disabled=no interface="bridge1-Home" name="dhcp1-Home" lease-time=3d

/ip dhcp-server network
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1 netmask=24 wins-server=192.168.88.1



/interface pppoe-client
add add-default-route=no comment="WAN1-PPPoE on ether1-WAN1" interface="ether1-WAN1" name="WAN1-PPPoE" user="aaaa@bbbb" password="xxxx" disabled=no
add add-default-route=no comment="WAN2-PPPoE on ether2-WAN2" interface="ether2-WAN2" name="WAN2-PPPoE" user="cccc@dddd" password="xxxx" disabled=no

/ip neighbor discovery
set "ether1-WAN1" discover=no
set "WAN1-PPPoE" discover=no
set "ether2-WAN2" discover=no
set "WAN2-PPPoE" discover=no

/ip firewall address-list
add address=192.168.88.0/24 disabled=no list="All-Client-IP"



/ip firewall nat
add action=masquerade chain=srcnat disabled=no out-interface="WAN1-PPPoE"
add action=masquerade chain=srcnat disabled=no out-interface="WAN2-PPPoE"
add action=masquerade chain=srcnat disabled=no src-address-list="All-Client-IP" dst-address-list="All-Client-IP"

/ip firewall mangle
add action=accept chain=prerouting comment="Accept traffic From All-Client-IP to All-Client-IP" disabled=no dst-address-list="All-Client-IP" src-address-list="All-Client-IP"

add action=mark-connection chain=input  connection-state=new in-interface="WAN1-PPPoE"  new-connection-mark="wan1_conn" passthrough=yes comment="ALL WAN TO ROUTER "
add action=mark-connection chain=input  connection-state=new in-interface="WAN2-PPPoE"  new-connection-mark="wan2_conn" passthrough=yes

add action=mark-connection chain=prerouting connection-state=related in-interface="WAN1-PPPoE"  new-connection-mark="wan1_conn" passthrough=yes
add action=mark-connection chain=prerouting connection-state=related in-interface="WAN2-PPPoE"  new-connection-mark="wan2_conn" passthrough=yes

add action=mark-routing chain=output connection-mark="wan1_conn" new-routing-mark="to_wan1" passthrough=yes
add action=mark-routing chain=output connection-mark="wan2_conn" new-routing-mark="to_wan2" passthrough=yes

add chain=prerouting src-address-list="All-Client-IP" dst-address-type=!local per-connection-classifier=both-addresses-and-ports:5/0 action=mark-connection new-connection-mark="pcc_wan1_conn" passthrough=yes comment="Loadbalance PCC WAN1:WAN2 = 3:2"
add chain=prerouting src-address-list="All-Client-IP" dst-address-type=!local per-connection-classifier=both-addresses-and-ports:5/1 action=mark-connection new-connection-mark="pcc_wan1_conn" passthrough=yes
add chain=prerouting src-address-list="All-Client-IP" dst-address-type=!local per-connection-classifier=both-addresses-and-ports:5/2 action=mark-connection new-connection-mark="pcc_wan1_conn" passthrough=yes
add chain=prerouting src-address-list="All-Client-IP" dst-address-type=!local per-connection-classifier=both-addresses-and-ports:5/3 action=mark-connection new-connection-mark="pcc_wan2_conn" passthrough=yes
add chain=prerouting src-address-list="All-Client-IP" dst-address-type=!local per-connection-classifier=both-addresses-and-ports:5/4 action=mark-connection new-connection-mark="pcc_wan2_conn" passthrough=yes

add chain=prerouting connection-mark="pcc_wan1_conn" src-address-list="All-Client-IP" action=mark-routing new-routing-mark="pcc_wan1_route" passthrough=yes
add chain=prerouting connection-mark="pcc_wan2_conn" src-address-list="All-Client-IP" action=mark-routing new-routing-mark="pcc_wan2_route" passthrough=yes


/ip route
add dst-address=0.0.0.0/0 gateway="WAN1-PPPoE" distance=1 check-gateway=arp
add dst-address=0.0.0.0/0 gateway="WAN2-PPPoE" distance=2 check-gateway=arp

add check-gateway=ping distance=1 gateway="WAN1-PPPoE" routing-mark="to_wan1"
add check-gateway=ping distance=1 gateway="WAN2-PPPoE" routing-mark="to_wan2"

add dst-address=0.0.0.0/0 gateway="WAN1-PPPoE" check-gateway=arp distance=1 routing-mark="pcc_wan1_route"
add dst-address=0.0.0.0/0 gateway="WAN2-PPPoE" check-gateway=arp distance=2 routing-mark="pcc_wan1_route"

add dst-address=0.0.0.0/0 gateway="WAN2-PPPoE" check-gateway=arp distance=1 routing-mark="pcc_wan2_route"
add dst-address=0.0.0.0/0 gateway="WAN1-PPPoE" check-gateway=arp distance=2 routing-mark="pcc_wan2_route"


#Block Bogon IP addresses
/ip firewall filter
add chain=forward src-address=0.0.0.0/8 action=drop \ comment="Block Bogon IP addresses"
add chain=forward dst-address=0.0.0.0/8 action=drop
add chain=forward src-address=127.0.0.0/8 action=drop
add chain=forward dst-address=127.0.0.0/8 action=drop
add chain=forward src-address=224.0.0.0/3 action=drop
add chain=forward dst-address=224.0.0.0/3 action=drop


#ป้องกันการขอใช้ DNS Caching จากภายนอก
/ip firewall filter
add chain=input in-interface="WAN1-PPPoE" protocol=udp dst-port=53 action=drop
add chain=input in-interface="WAN1-PPPoE" protocol=tcp dst-port=53 action=drop
add chain=input in-interface="WAN2-PPPoE" protocol=udp dst-port=53 action=drop
add chain=input in-interface="WAN2-PPPoE" protocol=tcp dst-port=53 action=drop

#ป้องกันการโดนทำ DHCP Relay จากภายนอก จัดไป
/ip firewall filter
add chain=forward protocol=udp dst-port=53 out-interface=!"WAN1-PPPoE" action=drop
add chain=forward protocol=tcp dst-port=53 out-interface=!"WAN1-PPPoE" action=drop
add chain=forward protocol=udp dst-port=53 out-interface=!"WAN2-PPPoE" action=drop
add chain=forward protocol=tcp dst-port=53 out-interface=!"WAN2-PPPoE" action=drop

#Customer protection (forward chain - traffic passing through the router)
/ip firewall filter
add chain=forward connection-state=invalid \ action=drop comment="drop invalid connections"
add chain=forward connection-state=established action=accept \ comment="allow already established connections"
add chain=forward connection-state=related action=accept \ comment="allow related connections"

#ยอมให้มีการใช้ icmp
/ip firewall filter
add chain=icmp protocol=icmp icmp-options=0:0 action=accept \ comment="echo reply"
add chain=icmp protocol=icmp icmp-options=3:0 action=accept \ comment="net unreachable"
add chain=icmp protocol=icmp icmp-options=3:1 action=accept \ comment="host unreachable"
add chain=icmp protocol=icmp icmp-options=4:0 action=accept \ comment="allow source quench"
add chain=icmp protocol=icmp icmp-options=8:0 action=accept \ comment="allow echo request"
add chain=icmp protocol=icmp icmp-options=11:0 action=accept \ comment="allow time exceed"
add chain=icmp protocol=icmp icmp-options=12:0 action=accept \ comment="allow parameter bad"
add chain=icmp action=drop comment="deny all other types"

#Login FTP
/ip firewall filter
add chain=input protocol=tcp dst-port=21 src-address-list="ftp_blacklist" action=drop \ comment="drop ftp brute forcers"
add chain=output action=accept protocol=tcp content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m
add chain=output action=add-dst-to-address-list protocol=tcp content="530 Login incorrect" \ address-list="ftp_blacklist" address-list-timeout=3h

#Prevent a SSH brute forcer to be banned for 10 days after repetitive attempts
/ip firewall filter
add chain=input protocol=tcp dst-port=22 src-address-list="ssh_blacklist" action=drop \ comment="drop ssh brute forcers" disabled=no
add chain=input protocol=tcp dst-port=22 connection-state=new \ src-address-list="ssh_stage3" action=add-src-to-address-list address-list="ssh_blacklist" \ address-list-timeout=10d comment="" disabled=no
add chain=input protocol=tcp dst-port=22 connection-state=new \ src-address-list="ssh_stage2" action=add-src-to-address-list address-list="ssh_stage3" \ address-list-timeout=1m comment="" disabled=no
add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list="ssh_stage1" \ action=add-src-to-address-list address-list="ssh_stage2" address-list-timeout=1m comment="" disabled=no
add chain=input protocol=tcp dst-port=22 connection-state=new action=add-src-to-address-list \ address-list="ssh_stage1" address-list-timeout=1m comment="" disabled=no
add chain=forward protocol=tcp dst-port=22 src-address-list="ssh_blacklist" action=drop \ comment="drop ssh brute downstream" disabled=no

#Drop port scanners
/ip firewall filter
add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="Port scanners to list " disabled=no
add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="NMAP FIN Stealth scan"
add chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="SYN/FIN scan"
add chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="SYN/RST scan"
add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="FIN/PSH/URG scan"
add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="ALL/ALL scan"
add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="NMAP NULL scan"

#Drop those IPs in both Input & Forward chains:
/ip firewall filter
add chain=input src-address-list="port scanners" action=drop comment="dropping port scanners" disabled=no
add chain=forward src-address-list="port scanners" action=drop comment="dropping port scanners" disabled=no

#Make jumps to new chains
/ip firewall filter
add chain=forward protocol=tcp action=jump jump-target=tcp \ comment="Make jumps to new chains"
add chain=forward protocol=udp action=jump jump-target=udp
add chain=forward protocol=icmp action=jump jump-target=icmp

#Create TCP chain and deny some TCP ports in it (revise port numbers as needed)
/ip firewall filter
add chain=tcp protocol=tcp dst-port=69 action=drop \ comment="deny TFTP"
add chain=tcp protocol=tcp dst-port=111 action=drop \ comment="deny RPC portmapper"
add chain=tcp protocol=tcp dst-port=135 action=drop \ comment="deny RPC portmapper"
add chain=tcp protocol=tcp dst-port=137-139 action=drop \ comment="deny NBT"
add chain=tcp protocol=tcp dst-port=445 action=drop \ comment="deny cifs"
add chain=tcp protocol=tcp dst-port=2049 action=drop comment="deny NFS"
add chain=tcp protocol=tcp dst-port=12345-12346 action=drop comment="deny NetBus"
add chain=tcp protocol=tcp dst-port=20034 action=drop comment="deny NetBus"
add chain=tcp protocol=tcp dst-port=3133 action=drop comment="deny  BackOriffice"
add chain=tcp protocol=tcp dst-port=67-68 action=drop comment="deny DHCP"

#Create UDP chain and deny some UDP ports in it  (revise port numbers as needed)
/ip firewall filter
add chain=udp protocol=udp dst-port=69 action=drop comment="deny TFTP"
add chain=udp protocol=udp dst-port=111 action=drop comment="deny PRC portmapper"
add chain=udp protocol=udp dst-port=135 action=drop comment="deny PRC portmapper"
add chain=udp protocol=udp dst-port=137-139 action=drop comment="deny NBT"
add chain=udp protocol=udp dst-port=2049 action=drop comment="deny NFS"
add chain=udp protocol=udp dst-port=3133 action=drop comment="deny BackOriffice"

/ip upnp
set allow-disable-external-interface=yes enabled=yes
/ip upnp interfaces
add interface="bridge1-Home" type=internal
add interface="WAN1-PPPoE" type=external
add interface="WAN2-PPPoE" type=external

/ip firewall connection tracking
set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s tcp-close-wait-timeout=1m tcp-established-timeout=1h tcp-fin-wait-timeout=1m \
    tcp-last-ack-timeout=30s tcp-syn-received-timeout=1m tcp-syn-sent-timeout=10s tcp-time-wait-timeout=1m udp-stream-timeout=3m udp-timeout=30s


/system script
add name=reboot policy=reboot source="/system reboot"
add name=Force_WAN_Reconnect policy=\
    ftp,read,write,policy,test,password,sniff,sensitive source="/interface dis\
    able WAN1-PPPoE\r\
    \n/interface disable WAN2-PPPoE\r\
    \n/ip upnp set enabled=no\r\
    \n/log info message=\"WAN1 & WAN2 Disable!\"\r\
    \n:delay 30s\r\
    \n/interface enable WAN1-PPPoE\r\
    \n/interface enable WAN2-PPPoE\r\
    \n/log info message=\"WAN1 & WAN2 Enable!\"\r\
    \n:delay 10s\r\
    \n/ip upnp set enabled=yes\r\
    \n:delay 3s\r\
    \n/log info message=\"WAN1 & WAN2 forced reconnect. Done!\""

/system scheduler
add disabled=yes interval=1d name=Force_Reboot on-event=Force_Reboot policy=reboot start-date=jan/01/2002 start-time=05:00:00
add interval=1d name=Force_WAN_Reconnect on-event=Force_WAN_Reconnect policy=ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive,api start-date=jan/01/2002 start-time=05:00:00

/tool graphing interface
add interface="WAN1-PPPoE"
add interface="WAN2-PPPoE"
add interface="bridge1-Home"

/system reboot