API tools faq
paste
Advertisement
ashishwadekar

Mikrotik Config M

ashishwadekar
Mar 5th, 2022 (edited)
160
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 8.36 KB | None | 0 0
raw download clone embed print report
  1. # mar/05/2022 11:46:38 by RouterOS 7.1.3
  2. # software id = 43HK-WYHZ
  3. #
  4. # model = RBD53iG-5HacD2HnD
  5. # serial number = E7290E8134F3
  6. /interface bridge
  7. add admin-mac=2C:C8:1B:A5:B2:D9 auto-mac=no comment=defconf name=bridge
  8. /interface pppoe-client
  9. add add-default-route=yes disabled=no interface=ether1 max-mtu=1500 name=\
  10. WAN1-PPPOE_OUT use-peer-dns=yes user=natrajr_101
  11. add add-default-route=yes disabled=no interface=ether2 name=WAN2-PPPOE_OUT \
  12. use-peer-dns=yes user=aw688
  13. /interface list
  14. add comment=defconf name=WAN
  15. add comment=defconf name=LAN
  16. /interface lte apn
  17. set [ find default=yes ] ip-type=ipv4
  18. /interface wireless security-profiles
  19. set [ find default=yes ] supplicant-identity=MikroTik
  20. add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=\
  21. mokashi supplicant-identity=""
  22. /interface wireless
  23. set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
  24. country=india disabled=no distance=indoors frequency=auto installation=\
  25. indoor mode=ap-bridge security-profile=mokashi ssid=Dominus \
  26. wireless-protocol=802.11
  27. # no supported channel
  28. # no supported channels
  29. set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
  30. 20/40/80/160mhz-XXXXXXXX country=india disabled=no distance=indoors \
  31. frequency=auto installation=indoor mode=ap-bridge security-profile=\
  32. mokashi ssid=InfinityB_5G wireless-protocol=802.11
  33. /ip pool
  34. add name=default-dhcp ranges=10.11.1.10-10.11.1.254
  35. /ip dhcp-server
  36. add address-pool=default-dhcp interface=bridge name=defconf
  37. /routing table
  38. add fib name=TO_WAN1
  39. add fib name=TO_WAN2
  40. /interface bridge port
  41. add bridge=bridge comment=defconf ingress-filtering=no interface=ether3
  42. add bridge=bridge comment=defconf ingress-filtering=no interface=ether4
  43. add bridge=bridge comment=defconf ingress-filtering=no interface=ether5
  44. add bridge=bridge comment=defconf ingress-filtering=no interface=wlan1
  45. add bridge=bridge comment=defconf ingress-filtering=no interface=wlan2
  46. /ip neighbor discovery-settings
  47. set discover-interface-list=LAN
  48. /ipv6 settings
  49. set disable-ipv6=yes max-neighbor-entries=8192
  50. /interface list member
  51. add comment=defconf interface=bridge list=LAN
  52. add comment=defconf interface=ether1 list=WAN
  53. add interface=ether2 list=WAN
  54. add interface=WAN1-PPPOE_OUT list=WAN
  55. add interface=WAN2-PPPOE_OUT list=WAN
  56. /ip address
  57. add address=10.11.1.1/24 comment=defconf interface=bridge network=10.11.1.0
  58. /ip dhcp-client
  59. add comment=defconf interface=ether1
  60. /ip dhcp-server network
  61. add address=10.11.1.0/24 comment=defconf dns-server=10.11.1.1 gateway=\
  62. 10.11.1.1
  63. /ip dns
  64. set allow-remote-requests=yes
  65. /ip dns static
  66. add address=192.168.88.1 comment=defconf name=router.lan
  67. /ip firewall address-list
  68. add address=10.11.1.0/24 list=not_in_internet
  69. add address=192.168.2.0/24 list=not_in_internet
  70. /ip firewall filter
  71. add action=accept chain=input comment=\
  72. "defconf: accept established,related,untracked" connection-state=\
  73. established,related,untracked
  74. add action=drop chain=input comment="defconf: drop invalid" connection-state=\
  75. invalid log=yes log-prefix="INVALID DROP"
  76. add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
  77. add action=accept chain=input comment=\
  78. "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
  79. add action=drop chain=input comment="defconf: drop all not coming from LAN" \
  80. in-interface-list=!LAN log=yes log-prefix="NOT IN LAN BRIDGE"
  81. add action=accept chain=forward comment="defconf: accept in ipsec policy" \
  82. ipsec-policy=in,ipsec
  83. add action=accept chain=forward comment="defconf: accept out ipsec policy" \
  84. ipsec-policy=out,ipsec
  85. add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
  86. connection-state=established,related hw-offload=yes
  87. add action=accept chain=forward comment=\
  88. "defconf: accept established,related, untracked" connection-state=\
  89. established,related,untracked
  90. add action=drop chain=forward comment="defconf: drop invalid" \
  91. connection-state=invalid
  92. add action=drop chain=forward comment=\
  93. "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
  94. connection-state=new in-interface-list=WAN
  95. /ip firewall mangle
  96. add action=mark-connection chain=prerouting comment="WAN1 Connection Marking" \
  97. connection-mark=no-mark in-interface=WAN1-PPPOE_OUT new-connection-mark=\
  98. WAN1_CONN passthrough=no
  99. add action=mark-connection chain=prerouting comment="WAN2 Connection Marking" \
  100. connection-mark=no-mark in-interface=WAN2-PPPOE_OUT new-connection-mark=\
  101. WAN2_CONN passthrough=no
  102. add action=mark-connection chain=prerouting comment=\
  103. "PCC Rule for WAN1 HTTP, HTTPS traffic" connection-mark=no-mark \
  104. dst-address-list=!not_in_internet dst-address-type=!local dst-port=80,443 \
  105. in-interface=bridge new-connection-mark=WAN1_CONN passthrough=yes \
  106. per-connection-classifier=both-addresses-and-ports:2/0 protocol=tcp
  107. add action=mark-connection chain=prerouting comment=\
  108. "PCC Rule for WAN1 HTTP3, QUIC traffic" connection-mark=no-mark \
  109. dst-address-list=!not_in_internet dst-address-type=!local dst-port=80,443 \
  110. in-interface=bridge new-connection-mark=WAN1_CONN passthrough=yes \
  111. per-connection-classifier=both-addresses-and-ports:2/0 protocol=udp
  112. add action=mark-connection chain=prerouting comment="NTH Rule for WAN1" \
  113. connection-mark=no-mark dst-address-list=!not_in_internet \
  114. dst-address-type=!local in-interface=bridge new-connection-mark=WAN1_CONN \
  115. nth=2,1 passthrough=yes
  116. add action=mark-connection chain=prerouting comment=\
  117. "PCC Rule for WAN2 HTTP, HTTPS traffic" connection-mark=no-mark \
  118. dst-address-list=!not_in_internet dst-address-type=!local dst-port=80,443 \
  119. in-interface=bridge new-connection-mark=WAN2_CONN passthrough=yes \
  120. per-connection-classifier=both-addresses-and-ports:2/1 protocol=tcp
  121. add action=mark-connection chain=prerouting comment=\
  122. "PCC Rule for WAN2 HTTP3, QUIC traffic" connection-mark=no-mark \
  123. dst-address-list=!not_in_internet dst-address-type=!local dst-port=80,443 \
  124. in-interface=bridge new-connection-mark=WAN2_CONN passthrough=yes \
  125. per-connection-classifier=both-addresses-and-ports:2/1 protocol=udp
  126. add action=mark-connection chain=prerouting comment="NTH Rule for WAN2" \
  127. connection-mark=no-mark dst-address-list=!not_in_internet \
  128. dst-address-type=!local in-interface=bridge new-connection-mark=WAN2_CONN \
  129. nth=2,2 passthrough=yes
  130. add action=mark-routing chain=prerouting comment="LAN Routing for WAN1" \
  131. connection-mark=WAN1_CONN in-interface=bridge new-routing-mark=TO_WAN1 \
  132. passthrough=no
  133. add action=mark-routing chain=prerouting comment="LAN Routing for WAN2" \
  134. connection-mark=WAN2_CONN in-interface=bridge new-routing-mark=TO_WAN2 \
  135. passthrough=no
  136. add action=mark-routing chain=output comment=\
  137. "Routing for Incoming traffic from WAN1" connection-mark=WAN1_CONN \
  138. new-routing-mark=TO_WAN1 out-interface=WAN1-PPPOE_OUT passthrough=no
  139. add action=mark-routing chain=output comment=\
  140. "Routing for Incoming traffic from WAN2" connection-mark=WAN2_CONN \
  141. new-routing-mark=TO_WAN2 out-interface=WAN2-PPPOE_OUT passthrough=no
  142. /ip firewall nat
  143. add action=masquerade chain=srcnat out-interface=WAN1-PPPOE_OUT src-address=\
  144. 10.11.1.0/24
  145. add action=masquerade chain=srcnat out-interface=WAN2-PPPOE_OUT src-address=\
  146. 10.11.1.0/24
  147. add action=dst-nat chain=dstnat comment="HTTP DST NAT" dst-port=\
  148. 80,443,22000,25000 in-interface=WAN2-PPPOE_OUT protocol=tcp to-addresses=\
  149. 10.11.1.228
  150. add action=dst-nat chain=dstnat comment="VPN Port Forward" dst-port=\
  151. 500,1701,4500 in-interface=WAN2-PPPOE_OUT protocol=udp to-addresses=\
  152. 10.11.1.228
  153. add action=dst-nat chain=dstnat comment="iPerf Testing" disabled=yes \
  154. dst-port=5201 in-interface=all-wireless protocol=udp to-addresses=\
  155. 10.11.1.228 to-ports=5201
  156. /ip route
  157. add check-gateway=ping comment="Load balancing Route to ISP1" disabled=no \
  158. dst-address=0.0.0.0/0 gateway=WAN1-PPPOE_OUT routing-table=TO_WAN1
  159. add check-gateway=ping comment="Load balancing Route to ISP2" disabled=no \
  160. distance=2 dst-address=0.0.0.0/0 gateway=WAN2-PPPOE_OUT routing-table=\
  161. TO_WAN2
  162. /system clock
  163. set time-zone-name=Asia/Kolkata
  164. /system routerboard settings
  165. set cpu-frequency=auto
  166. /tool mac-server
  167. set allowed-interface-list=LAN
  168. /tool mac-server mac-winbox
  169. set allowed-interface-list=LAN
  170.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!