API tools faq
paste
Advertisement
hadarelv

mikrotik-config

hadarelv
Jan 17th, 2022
74
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 4.38 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [admin@MikroTik] > /export hide-sensitive
  3.  
  4. # jan/02/1970 00:10:01 by RouterOS 6.45.9
  5.  
  6. # software id = URXX-AABC
  7.  
  8. #
  9.  
  10. # model = RBwAPG-5HacT2HnD
  11.  
  12. # serial number = D8F80CB0C736
  13.  
  14. /interface bridge
  15.  
  16. add comment=defconf name=bridge
  17.  
  18. /interface list
  19.  
  20. add comment=defconf name=WAN
  21.  
  22. add comment=defconf name=LAN
  23.  
  24. /interface wireless security-profiles
  25.  
  26. set [ find default=yes ] supplicant-identity=MikroTik
  27.  
  28. add authentication-types=wpa-psk,wpa2-psk management-protection=allowed mode=dynamic-keys name=profile1 supplicant-identity=MikroTik
  29.  
  30. /interface wireless
  31.  
  32. set [ find default-name=wlan1 ] band=2ghz-b disabled=no distance=indoors frequency=auto installation=outdoor mode=ap-bridge security-profile=profile1 ssid=MikroTik-AA400E-2.4GHz wireless-protocol=802.11
  33.  
  34. set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX disabled=no distance=indoors frequency=auto installation=outdoor mode=ap-bridge security-profile=profile1 ssid=MikroTik-AA400D-5GHz wireless-protocol=802.11
  35.  
  36. /ip pool
  37.  
  38. add name=dhcp ranges=192.168.88.10-192.168.88.254
  39.  
  40. /ip dhcp-server
  41.  
  42. add address-pool=dhcp disabled=no interface=bridge name=defconf
  43.  
  44. /queue simple
  45.  
  46. add max-limit=10M/10M name=in-parent queue=default/default target=""
  47.  
  48. add limit-at=1M/1M max-limit=10M/10M name=in-high-prio packet-marks=high-prio parent=in-parent priority=1/1 target=192.168.88.0/24
  49.  
  50. add limit-at=2M/2M max-limit=10M/10M name=in-bulk packet-marks=bulk parent=in-parent queue=default/default target=192.168.88.0/24
  51.  
  52. /interface bridge port
  53.  
  54. add bridge=bridge comment=defconf interface=wlan1
  55.  
  56. add bridge=bridge comment=defconf interface=wlan2
  57.  
  58. add bridge=bridge interface=ether1
  59.  
  60. /interface bridge settings
  61.  
  62. set use-ip-firewall=yes
  63.  
  64. /ip neighbor discovery-settings
  65.  
  66. set discover-interface-list=LAN
  67.  
  68. /interface list member
  69.  
  70. add comment=defconf interface=bridge list=LAN
  71.  
  72. add comment=defconf interface=ether1 list=WAN
  73.  
  74. /ip address
  75.  
  76. add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
  77.  
  78. /ip dhcp-client
  79.  
  80. # DHCP client can not run on slave interface!
  81.  
  82. add comment=defconf dhcp-options=hostname,clientid disabled=no interface=ether1
  83.  
  84. /ip dhcp-server network
  85.  
  86. add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
  87.  
  88. /ip dns
  89.  
  90. set allow-remote-requests=yes
  91.  
  92. /ip dns static
  93.  
  94. add address=192.168.88.1 comment=defconf name=router.lan
  95.  
  96. /ip firewall filter
  97.  
  98. add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
  99.  
  100. add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
  101.  
  102. add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
  103.  
  104. add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
  105.  
  106. add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
  107.  
  108. add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
  109.  
  110. add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
  111.  
  112. add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related disabled=yes
  113.  
  114. add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
  115.  
  116. add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
  117.  
  118. add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
  119.  
  120. /ip firewall mangle
  121.  
  122. add action=mark-packet chain=forward dst-port=5150 new-packet-mark=high-prio passthrough=yes protocol=tcp src-address=192.168.88.21
  123.  
  124. add action=mark-packet chain=forward new-packet-mark=high-prio passthrough=yes protocol=tcp src-address=192.168.88.254 src-port=5150
  125.  
  126. add action=mark-packet chain=forward dst-port=!5150 new-packet-mark=bulk passthrough=yes protocol=tcp src-address=192.168.88.21
  127.  
  128. add action=mark-packet chain=forward new-packet-mark=bulk passthrough=yes protocol=tcp src-address=192.168.88.254 src-port=!5150
  129.  
  130. /ip firewall nat
  131.  
  132. add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
  133.  
  134. /tool mac-server
  135.  
  136. set allowed-interface-list=LAN
  137.  
  138. /tool mac-server mac-winbox
  139.  
  140. set allowed-interface-list=LAN
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!