API tools faq
paste
Guest User

sxt

a guest
Dec 8th, 2020
25
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.17 KB | None | 0 0
raw download clone embed print report
  1. # dec/08/2020 12:36:56 by RouterOS 6.47.8
  2. # software id = QDQU-CI02
  3. #
  4. # model = RBSXTR
  5. # serial number = B72B0BD60706
  6. /interface bridge
  7. add admin-mac=C4:AD:34:76:26:BB auto-mac=no comment=defconf name=bridge
  8. /interface lte
  9. set [ find ] name=lte1
  10. /interface list
  11. add comment=defconf name=WAN
  12. add comment=defconf name=LAN
  13. /interface lte apn
  14. set [ find default=yes ] ip-type=ipv4-ipv6
  15. /interface wireless security-profiles
  16. set [ find default=yes ] supplicant-identity=MikroTik
  17. /ip hotspot profile
  18. set [ find default=yes ] html-directory=flash/hotspot
  19. /ip pool
  20. add name=default-dhcp ranges=192.168.88.10-192.168.88.254
  21. /ip dhcp-server
  22. add address-pool=default-dhcp disabled=no interface=bridge name=defconf
  23. /interface bridge port
  24. add bridge=bridge comment=defconf interface=ether1
  25. add bridge=bridge comment=defconf interface=ether2
  26. /ip neighbor discovery-settings
  27. set discover-interface-list=LAN
  28. /interface list member
  29. add comment=defconf interface=bridge list=LAN
  30. add comment=defconf interface=lte1 list=WAN
  31. /ip address
  32. add address=192.168.88.1/24 comment=defconf interface=bridge network=\
  33. 192.168.88.0
  34. /ip dhcp-server network
  35. add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
  36. /ip dns
  37. set allow-remote-requests=yes
  38. /ip dns static
  39. add address=192.168.88.1 comment=defconf name=router.lan
  40. /ip firewall filter
  41. add action=accept chain=input comment=\
  42. "defconf: accept established,related,untracked" connection-state=\
  43. established,related,untracked
  44. add action=drop chain=input comment="defconf: drop invalid" connection-state=\
  45. invalid
  46. add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
  47. add action=accept chain=input comment=\
  48. "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
  49. add action=drop chain=input comment="defconf: drop all not coming from LAN" \
  50. in-interface-list=!LAN
  51. add action=accept chain=forward comment="defconf: accept in ipsec policy" \
  52. ipsec-policy=in,ipsec
  53. add action=accept chain=forward comment="defconf: accept out ipsec policy" \
  54. ipsec-policy=out,ipsec
  55. add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
  56. connection-state=established,related
  57. add action=accept chain=forward comment=\
  58. "defconf: accept established,related, untracked" connection-state=\
  59. established,related,untracked
  60. add action=drop chain=forward comment="defconf: drop invalid" \
  61. connection-state=invalid
  62. add action=drop chain=forward comment=\
  63. "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
  64. connection-state=new in-interface-list=WAN
  65. /ip firewall nat
  66. add action=masquerade chain=srcnat comment="defconf: masquerade" \
  67. ipsec-policy=out,none out-interface=lte1
  68. /ipv6 firewall address-list
  69. add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
  70. add address=::1/128 comment="defconf: lo" list=bad_ipv6
  71. add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
  72. add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
  73. add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
  74. add address=100::/64 comment="defconf: discard only " list=bad_ipv6
  75. add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
  76. add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
  77. add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
  78. add address=::224.0.0.0/100 comment="defconf: other" list=bad_ipv6
  79. add address=::127.0.0.0/104 comment="defconf: other" list=bad_ipv6
  80. add address=::/104 comment="defconf: other" list=bad_ipv6
  81. add address=::255.0.0.0/104 comment="defconf: other" list=bad_ipv6
  82. /ipv6 firewall filter
  83. add action=accept chain=input comment=\
  84. "defconf: accept established,related,untracked" connection-state=\
  85. established,related,untracked
  86. add action=drop chain=input comment="defconf: drop invalid" connection-state=\
  87. invalid
  88. add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
  89. icmpv6
  90. add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
  91. 33434-33534 protocol=udp
  92. add action=accept chain=input comment=\
  93. "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
  94. udp src-address=fe80::/10
  95. add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
  96. protocol=udp
  97. add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
  98. ipsec-ah
  99. add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
  100. ipsec-esp
  101. add action=accept chain=input comment=\
  102. "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
  103. add action=drop chain=input comment=\
  104. "defconf: drop everything else not coming from LAN" in-interface-list=\
  105. !LAN
  106. add action=accept chain=forward comment=\
  107. "defconf: accept established,related,untracked" connection-state=\
  108. established,related,untracked
  109. add action=drop chain=forward comment="defconf: drop invalid" \
  110. connection-state=invalid
  111. add action=drop chain=forward comment=\
  112. "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
  113. add action=drop chain=forward comment=\
  114. "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
  115. add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
  116. hop-limit=equal:1 protocol=icmpv6
  117. add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
  118. icmpv6
  119. add action=accept chain=forward comment="defconf: accept HIP" protocol=139
  120. add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
  121. 500,4500 protocol=udp
  122. add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
  123. ipsec-ah
  124. add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
  125. ipsec-esp
  126. add action=accept chain=forward comment=\
  127. "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
  128. add action=drop chain=forward comment=\
  129. "defconf: drop everything else not coming from LAN" in-interface-list=\
  130. !LAN
  131. /system clock
  132. set time-zone-name=Europe/Kiev
  133. /system routerboard settings
  134. set auto-upgrade=yes
  135. /tool mac-server
  136. set allowed-interface-list=LAN
  137. /tool mac-server mac-winbox
  138. set allowed-interface-list=LAN
  139.  
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!