API tools faq
paste
Advertisement
Guest User

mikrotik

a guest
Jun 8th, 2022
81
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 7.42 KB | None | 0 0
raw download clone embed print report
  1. # jun/08/2022 16:01:07 by RouterOS 7.3
  2. # software id = WIS2-L98X
  3. #
  4. # model = RBD53iG-5HacD2HnD
  5. # serial number = E72A0EE866CF
  6. /interface bridge
  7. add admin-mac=2C:C8:1B:92:42:69 auto-mac=no comment=defconf name=bridge
  8. /interface wireless
  9. set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
  10. disabled=no distance=indoors frequency=auto installation=indoor mode=\
  11. ap-bridge ssid=MikroTik-92426D wireless-protocol=802.11
  12. set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
  13. 20/40/80mhz-XXXX disabled=no distance=indoors frequency=auto \
  14. installation=indoor mode=ap-bridge ssid=MikroTik-92426E \
  15. wireless-protocol=802.11
  16. /interface vlan
  17. add interface=ether1 name=vlan3-telefono vlan-id=3
  18. add interface=ether1 name=vlan6-internet vlan-id=6
  19. /interface pppoe-client
  20. add add-default-route=yes disabled=no interface=vlan6-internet name=internet \
  21. use-peer-dns=yes user=adslppp@telefonicanetpa
  22. /interface list
  23. add comment=defconf name=WAN
  24. add comment=defconf name=LAN
  25. /interface wireless security-profiles
  26. set [ find default=yes ] supplicant-identity=MikroTik
  27. /ip pool
  28. add name=default-dhcp ranges=192.168.1.2-192.168.1.254
  29. /ip dhcp-server
  30. add address-pool=default-dhcp interface=bridge name=defconf
  31. /routing rip instance
  32. add afi=ipv4 disabled=no name=rip
  33. /interface bridge port
  34. add bridge=bridge comment=defconf interface=ether2
  35. add bridge=bridge comment=defconf interface=ether3
  36. add bridge=bridge comment=defconf interface=ether4
  37. add bridge=bridge comment=defconf interface=ether5
  38. add bridge=bridge comment=defconf interface=wlan1
  39. add bridge=bridge comment=defconf interface=wlan2
  40. /ip neighbor discovery-settings
  41. set discover-interface-list=LAN
  42. /interface list member
  43. add comment=defconf interface=bridge list=LAN
  44. add comment=defconf interface=internet list=WAN
  45. /ip address
  46. add address=192.168.88.1/24 comment=defconf interface=bridge network=\
  47. 192.168.88.0
  48. /ip cloud
  49. set ddns-enabled=yes
  50. /ip dhcp-client
  51. add comment=defconf interface=ether1
  52. add add-default-route=no interface=vlan3-telefono use-peer-dns=no \
  53. use-peer-ntp=no
  54. /ip dhcp-server network
  55. add address=192.168.1.0/24 comment=defconf dns-server=8.8.8.8 gateway=\
  56. 192.168.1.1
  57. /ip dns
  58. set allow-remote-requests=yes
  59. /ip dns static
  60. add address=192.168.88.1 comment=defconf name=router.lan
  61. /ip firewall filter
  62. add action=accept chain=input comment=\
  63. "defconf: accept established,related,untracked" connection-state=\
  64. established,related,untracked
  65. add action=drop chain=input comment="defconf: drop invalid" connection-state=\
  66. invalid
  67. add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
  68. add action=accept chain=input comment=\
  69. "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
  70. add action=accept chain=input comment="voip: accept rip multicast traffic" \
  71. dst-address=224.0.0.9 dst-port=520 in-interface=vlan3-telefono protocol=\
  72. udp
  73. add action=drop chain=input comment="defconf: drop all not coming from LAN" \
  74. in-interface-list=!LAN
  75. add action=accept chain=forward comment="defconf: accept in ipsec policy" \
  76. ipsec-policy=in,ipsec
  77. add action=accept chain=forward comment="defconf: accept out ipsec policy" \
  78. ipsec-policy=out,ipsec
  79. add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
  80. connection-state=established,related hw-offload=yes
  81. add action=accept chain=forward comment=\
  82. "defconf: accept established,related, untracked" connection-state=\
  83. established,related,untracked
  84. add action=drop chain=forward comment="defconf: drop invalid" \
  85. connection-state=invalid
  86. add action=drop chain=forward comment=\
  87. "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
  88. connection-state=new in-interface-list=WAN
  89. /ip firewall mangle
  90. add action=set-priority chain=postrouting new-priority=4 out-interface=\
  91. vlan3-telefono
  92. add action=set-priority chain=postrouting new-priority=1 out-interface=\
  93. internet
  94. /ip firewall nat
  95. add action=masquerade chain=srcnat comment="defconf: masquerade" \
  96. ipsec-policy=out,none out-interface-list=WAN
  97. add action=masquerade chain=srcnat comment="voip: masq voip" out-interface=\
  98. vlan3-telefono
  99. /ipv6 firewall address-list
  100. add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
  101. add address=::1/128 comment="defconf: lo" list=bad_ipv6
  102. add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
  103. add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
  104. add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
  105. add address=100::/64 comment="defconf: discard only " list=bad_ipv6
  106. add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
  107. add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
  108. add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
  109. /ipv6 firewall filter
  110. add action=accept chain=input comment=\
  111. "defconf: accept established,related,untracked" connection-state=\
  112. established,related,untracked
  113. add action=drop chain=input comment="defconf: drop invalid" connection-state=\
  114. invalid
  115. add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
  116. icmpv6
  117. add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
  118. 33434-33534 protocol=udp
  119. add action=accept chain=input comment=\
  120. "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
  121. udp src-address=fe80::/10
  122. add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
  123. protocol=udp
  124. add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
  125. ipsec-ah
  126. add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
  127. ipsec-esp
  128. add action=accept chain=input comment=\
  129. "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
  130. add action=drop chain=input comment=\
  131. "defconf: drop everything else not coming from LAN" in-interface-list=\
  132. !LAN
  133. add action=accept chain=forward comment=\
  134. "defconf: accept established,related,untracked" connection-state=\
  135. established,related,untracked
  136. add action=drop chain=forward comment="defconf: drop invalid" \
  137. connection-state=invalid
  138. add action=drop chain=forward comment=\
  139. "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
  140. add action=drop chain=forward comment=\
  141. "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
  142. add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
  143. hop-limit=equal:1 protocol=icmpv6
  144. add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
  145. icmpv6
  146. add action=accept chain=forward comment="defconf: accept HIP" protocol=139
  147. add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
  148. 500,4500 protocol=udp
  149. add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
  150. ipsec-ah
  151. add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
  152. ipsec-esp
  153. add action=accept chain=forward comment=\
  154. "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
  155. add action=drop chain=forward comment=\
  156. "defconf: drop everything else not coming from LAN" in-interface-list=\
  157. !LAN
  158. /routing rip interface-template
  159. add instance=rip interfaces=vlan3-telefono mode=passive
  160. /system clock
  161. set time-zone-name=Europe/Madrid
  162. /tool mac-server
  163. set allowed-interface-list=LAN
  164. /tool mac-server mac-winbox
  165. set allowed-interface-list=LAN
  166.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!