API tools faq
paste
Advertisement
Guest User

Untitled

a guest
May 21st, 2017
132
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Diff 12.14 KB | None | 0 0
raw download clone embed print report
  1. --- cryo-rtr-RB951x-0.2.9-default.rsc   2017-02-24 17:08:28.000000000 +0200
  2. +++ cryo-rtr-RB951x-0.3.0-default.rsc   2017-05-21 19:52:06.422832076 +0300
  3. @@ -1,4 +1,4 @@
  4. -:global version                "0.2.9"
  5. +:global version                "0.3.0"
  6.  
  7.  #Wifi settings
  8.  :global wifiname       "Cryo"
  9. @@ -6,26 +6,34 @@
  10.  
  11.  #VPN1 settings
  12.  :global ifacevpn1      "l2tp-out1"
  13. -:global vpnserver1     "vpn01.healthycold.com"
  14. +:global vpnserver1     "server.cryomedpro.com"
  15.  :global l2tpuser1      "default"
  16.  :global l2tppassword1  "default"
  17. -:global vpnsrvip1      "185.44.105.96"
  18. +:global vpnsrvip1      "87.197.111.47"
  19.  :global vpnpsk1                "X501:410:ffff:200:86ff"
  20. +:global vpn1disabled   "no"
  21.  
  22.  #VPN2 settings
  23. +:global vpnserver2     "vpn01.cryomedpro.com"
  24.  :global ifacevpn2      "l2tp-out2"
  25. -:global vpnserver2     "server.healthycold.com"
  26.  :global l2tpuser2      "default"
  27.  :global l2tppassword2  "default"
  28. -:global vpnsrvip2      "87.197.111.47"
  29. +:global vpnsrvip2      "185.44.105.96"
  30.  :global vpnpsk2                "X501:410:ffff:200:86ff"
  31. +:global vpn2disabled   "yes"
  32. +
  33. +#Hosts to ping
  34. +:global hosts2ping 10.10.0.2,10.10.0.3
  35.  
  36.  #Do not edit other lines.
  37.  :if ([:len [/file find name="sys-note.txt"]] > 0) do={ /file remove sys-note.txt; }
  38. +
  39.  /system note
  40.  set note="Config version: $version"
  41. +
  42.  /interface bridge
  43.  add auto-mac=yes name=bridge-local
  44. +
  45.  /interface ethernet
  46.  set [ find default-name=ether1 ] name=ether1-gateway
  47.  set [ find default-name=ether2 ] name=ether2-master-local
  48. @@ -35,46 +43,60 @@
  49.      ether4-slave-local
  50.  set [ find default-name=ether5 ] master-port=ether2-master-local name=\
  51.      ether5-slave-local
  52. +
  53.  /ip neighbor discovery
  54.  set ether1-gateway discover=yes
  55. +
  56.  /interface wireless security-profiles
  57.  set [ find default=yes ] supplicant-identity=MikroTik
  58.  add authentication-types=wpa2-psk management-protection=allowed mode=\
  59.      dynamic-keys name=Cryo supplicant-identity=MikroTik wpa2-pre-shared-key=\
  60.      "$wifipassword"
  61. +
  62.  /interface wireless
  63.  set [ find default-name=wlan1 ] band=2ghz-b/g/n disabled=no distance=dynamic \
  64.      frequency=2427 mode=ap-bridge security-profile=Cryo ssid="$wifiname" \
  65.      wireless-protocol=802.11
  66. +
  67.  /ip ipsec proposal
  68.  set [ find default=yes ] disabled=yes
  69. +
  70.  /ip pool
  71.  add name=dhcp ranges=10.10.0.10-10.10.0.99
  72. +
  73.  /ip dhcp-server
  74.  add address-pool=dhcp disabled=no interface=bridge-local name=default
  75. +
  76.  /interface l2tp-client
  77. -add allow=chap,mschap2 connect-to="$vpnserver1" disabled=no \
  78. -    keepalive-timeout=30 max-mru=1300 max-mtu=1300 name=l2tp-out1 password=\
  79. -    "$l2tppassword1" profile=default user="$l2tpuser1"
  80. -add allow=chap,mschap2 connect-to="$vpnserver2" disabled=no \
  81. -    keepalive-timeout=30 max-mru=1300 max-mtu=1300 name=l2tp-out2 password=\
  82. -    "$l2tppassword2" profile=default user="$l2tpuser2"
  83. +add allow=chap,mschap2 connect-to="$vpnserver1" \
  84. +    keepalive-timeout=30 max-mru=1300 max-mtu=1300 name="$ifacevpn1" password=\
  85. +    "$l2tppassword1" profile=default user="$l2tpuser1" disabled="$vpn1disabled"
  86. +add allow=chap,mschap2 connect-to="$vpnserver2" \
  87. +    keepalive-timeout=30 max-mru=1300 max-mtu=1300 name="$ifacevpn2" password=\
  88. +    "$l2tppassword2" profile=default user="$l2tpuser2" disabled="$vpn2disabled"
  89. +
  90.  /interface bridge port
  91.  add bridge=bridge-local interface=ether2-master-local
  92.  add bridge=bridge-local interface=wlan1
  93. +
  94.  /ip address
  95.  add address=10.10.0.1/24 comment="default configuration" interface=\
  96.      bridge-local network=10.10.0.0
  97. +
  98.  /ip dhcp-client
  99.  add comment="default configuration" dhcp-options=hostname,clientid disabled=\
  100.      no interface=ether1-gateway
  101. +
  102.  /ip dhcp-server network
  103.  add address=10.10.0.0/24 comment="default configuration" dns-server=\
  104.      8.8.8.8,8.8.4.4 gateway=10.10.0.1 netmask=24
  105. +
  106.  /ip dns
  107.  set allow-remote-requests=yes
  108. +
  109.  /ip dns static
  110.  add address=10.10.0.1 name=router
  111. +
  112.  /ip firewall filter
  113.  add chain=input protocol=icmp
  114.  add chain=input connection-state=established,related
  115. @@ -86,8 +108,7 @@
  116.  add action=drop chain=input in-interface=ether1-gateway
  117.  add action=fasttrack-connection chain=forward comment="default configuration" connection-state=established,related
  118.  add chain=forward connection-state=established,related
  119. -add chain=forward dst-address=10.10.0.2 dst-port=22,80,5900,61682 in-interface=all-ppp protocol=tcp
  120. -add chain=forward dst-address=10.10.0.2 dst-port=21,22,80,5900,61682 in-interface=all-ppp protocol=tcp
  121. +add chain=forward dst-address=10.10.0.2 dst-port=20,21,22,80,5900,61682 in-interface=all-ppp protocol=tcp
  122.  add chain=forward dst-address=10.10.0.2 dst-port=61682 in-interface=all-ppp protocol=udp
  123.  add chain=forward dst-address=10.10.0.3 dst-port=20,21,23,5001,8080 in-interface=all-ppp protocol=tcp
  124.  add chain=forward dst-address=192.168.88.1 dst-port=22,80 in-interface=all-ppp protocol=tcp
  125. @@ -98,12 +119,13 @@
  126.  add action=drop chain=forward connection-nat-state=!dstnat connection-state=new in-interface=ether1-gateway
  127.  add action=reject chain=forward in-interface=all-ppp
  128.  add action=reject chain=forward in-interface=ether1-gateway
  129. +
  130.  /ip firewall nat
  131.  add action=masquerade chain=srcnat out-interface=all-ppp
  132.  add action=masquerade chain=srcnat out-interface=ether1-gateway
  133.  add action=dst-nat chain=dstnat dst-port=5021 in-interface=all-ppp protocol=tcp to-addresses=10.10.0.2 to-ports=21
  134.  add action=dst-nat chain=dstnat dst-port=5022 in-interface=all-ppp protocol=tcp to-addresses=10.10.0.2 to-ports=22
  135. -add action=dst-nat chain=dstnat dst-port=80,5900,61682 in-interface=all-ppp protocol=tcp to-addresses=10.10.0.2
  136. +add action=dst-nat chain=dstnat dst-port=80,5900,8000,20248,61682 in-interface=all-ppp protocol=tcp to-addresses=10.10.0.2
  137.  add action=dst-nat chain=dstnat dst-port=61682 in-interface=all-ppp protocol=udp to-addresses=10.10.0.2 to-ports=61682
  138.  add action=dst-nat chain=dstnat dst-port=20,21,23,5001,8080 in-interface=all-ppp protocol=tcp to-addresses=10.10.0.3
  139.  add action=dst-nat chain=dstnat dst-port=222 in-interface=all-ppp protocol=tcp to-addresses=10.10.0.1 to-ports=22
  140. @@ -114,8 +136,10 @@
  141.  add action=dst-nat chain=dstnat dst-port=2222 in-interface=ether1-gateway protocol=tcp to-addresses=192.168.88.1 to-ports=22
  142.  add action=dst-nat chain=dstnat dst-port=88 in-interface=all-ppp protocol=tcp to-addresses=192.168.88.1 to-ports=80
  143.  add action=dst-nat chain=dstnat dst-port=88 in-interface=ether1-gateway protocol=tcp to-addresses=192.168.88.1 to-ports=80
  144. +
  145.  /ip ipsec policy
  146.  set 0 disabled=yes
  147. +
  148.  /ip route
  149.  add check-gateway=ping distance=1 dst-address=10.0.0.0/24 gateway=10.0.0.1
  150.  add check-gateway=ping distance=10 dst-address=10.1.0.0/24 gateway=10.0.0.1
  151. @@ -123,14 +147,25 @@
  152.  add check-gateway=ping distance=10 dst-address=10.0.0.0/24 gateway=10.1.0.1
  153.  add check-gateway=ping distance=1 dst-address=10.1.0.0/24 gateway=10.1.0.1
  154.  add check-gateway=ping distance=10 dst-address=192.168.1.0/24 gateway=10.1.0.1
  155. +
  156.  /system clock
  157.  set time-zone-autodetect=yes
  158. +
  159.  /system identity
  160. -set name="cryo-rtr-$version"
  161. +set name="cryo-rtr-$version-$l2tpuser1"
  162. +
  163. +/system logging action
  164. +add disk-file-count=2 disk-file-name=flash/script-warnings-log disk-lines-per-file=5000 name=file target=disk
  165. +
  166. +/system logging
  167. +set 2 topics=warning,!script
  168. +add action=file topics=script,warning
  169. +
  170.  /system ntp client
  171.  set enabled=yes server-dns-names=pool.ntp.org
  172. +
  173.  /user set admin password=Cryosauna group=full
  174. -/user add name=pilson password=PfkegjukfprF group=full
  175. +
  176.  /system script
  177.  add name=ipsecwanip source="# IPsec remote host and PSK\
  178.      \n:local vpnsrv1 \"$vpnserver1\";\
  179. @@ -150,8 +185,8 @@
  180.      \n# Get IP from IPsec policy and return \"0\" if fail\
  181.      \n:local getipoldstaddr do={\
  182.      \n    :do {\
  183. -    \n        :local ipaddr [/ip ipsec policy get value-name=src-address [find sa-dst-address=\"\$1\"]];\
  184. -    \n        :return \"\$ipaddr\";\
  185. +    \n        :local ip [/ip ipsec policy get value-name=src-address [find dst-address=\"\$1/32\"]];\
  186. +    \n        :return \"\$ip\";\
  187.      \n    } on-error={return \"0\"};\
  188.      \n}\
  189.      \n\
  190. @@ -166,12 +201,12 @@
  191.      \n:local dhost2 [\$getipfromname \$vpnsrv2];\
  192.      \n\
  193.      \nif (\$dhost1 = 0 ) do={\
  194. -    \n    :log warning \"Could not resolve IP of \$vpnsrv1, using \$vpnsrv1default\";\
  195. +    \n    :log info \"Could not resolve IP of \$vpnsrv1, using \$vpnsrv1default\";\
  196.      \n    :set dhost1 \"\$vpnsrv1default\";\
  197.      \n}\
  198.      \n\
  199.      \nif (\$dhost2 = 0 ) do={\
  200. -    \n    :log warning \"Could not resolve IP of \$vpnsrv2, using \$vpnsrv2default\";\
  201. +    \n    :log info \"Could not resolve IP of \$vpnsrv2, using \$vpnsrv2default\";\
  202.      \n    :set dhost2 \"\$vpnsrv2default\";\
  203.      \n}\
  204.      \n\
  205. @@ -182,9 +217,13 @@
  206.      \n:if ( \$policywanip1 != \$ipsecwanip or \$policywanip2 != \$ipsecwanip) do={\
  207.      \n    :local ipsecdhost1 \"\$dhost1/32\"\
  208.      \n    :local ipsecdhost2 \"\$dhost2/32\"\
  209. +    \n    :local vpn1disabled [/system scheduler get l2tp-out1-up disabled];\
  210. +    \n    :local vpn2disabled [/system scheduler get l2tp-out2-up disabled];\
  211. +    \n\
  212. +    \n    :log info \"policywanip1: \$policywanip1, policywanip2: \$policywanip2, ipsecwanip: \$ipsecwanip\";\
  213. +    \n    :log info \"Reinstalling IPsec rules. WAN IP: \$wanip, remote ip1: \$dhost1\";\
  214. +    \n    :log info \"Reinstalling IPsec rules. WAN IP: \$wanip, remote ip2: \$dhost2\";\
  215.      \n\
  216. -    \n    :log warning \"Reinstalling IPsec rules. WAN IP: \$wanip, remote ip1: \$dhost1\";\
  217. -    \n    :log warning \"Reinstalling IPsec rules. WAN IP: \$wanip, remote ip2: \$dhost2\";\
  218.      \n    # Remove IPsec rules\
  219.      \n    /interface l2tp-client disable \"\$ifacevpn1\";\
  220.      \n    /interface l2tp-client disable \"\$ifacevpn2\";\
  221. @@ -225,15 +264,19 @@
  222.      \n        proposal=\"\$dhost2\" protocol=udp sa-dst-address=\"\$dhost2\" \\\
  223.      \n        sa-src-address=\"\$wanip\" src-address=\"\$ipsecwanip\" comment=\"\$vpnsrv2\";\
  224.      \n        :delay 0.5;\
  225. -    \n        /interface l2tp-client enable \"\$ifacevpn1\";\
  226. -    \n        /interface l2tp-client enable \"\$ifacevpn2\";\
  227. +    \n    :if (\$vpn1disabled = \"false\") do={\
  228. +    \n            /interface l2tp-client enable \"\$ifacevpn1\";\
  229. +    \n    }\
  230. +    \n    :if (\$vpn2disabled = \"false\") do={\
  231. +    \n            /interface l2tp-client enable \"\$ifacevpn2\";\
  232. +    \n    }\
  233.      \n}\
  234.      \n"
  235.  add name=l2tp-out1-up source="# Auto-UP $ifacevpn1\
  236.      \n\
  237.      \nlocal l2ifr [/interface l2tp-client get $ifacevpn1 running];\
  238.      \nif ( \$l2ifr != true ) do={\
  239. -    \n    :log warning \"$ifacevpn1 is not active. Restarting...\"\
  240. +    \n    :log info \"$ifacevpn1 is not active. Restarting...\"\
  241.      \n    /interface l2tp-client disable $ifacevpn1;\
  242.      \n    :delay 5;\
  243.      \n    /interface l2tp-client enable $ifacevpn1;\
  244. @@ -243,26 +286,40 @@
  245.      \n\
  246.      \nlocal l2ifr [/interface l2tp-client get $ifacevpn2 running];\
  247.      \nif ( \$l2ifr != true ) do={\
  248. -    \n    :log warning \"$ifacevpn2 is not active. Restarting...\"\
  249. +    \n    :log info \"$ifacevpn2 is not active. Restarting...\"\
  250.      \n    /interface l2tp-client disable $ifacevpn2;\
  251.      \n    :delay 5;\
  252.      \n    /interface l2tp-client enable $ifacevpn2;\
  253.      \n}\
  254.      \n"
  255. +add name=pinger source="# Pinger\
  256. +    \n:local hosts $hosts2ping;\
  257. +    \n:foreach host in=\"\$hosts\" do={\
  258. +    \n    :if ([/ping \$host count=5] = 0) do={\
  259. +    \n        :log warning \"$l2tpuser1 \$host ping failed\";\
  260. +    \n    }\
  261. +    \n}\
  262. +    \n"
  263.  add name=vars source="# Global variables\
  264.      \n\
  265.      \nlocal version \"$version\";\
  266.      \n:execute \":global version \\\"$version\\\"\";\
  267.      \n"
  268. +
  269.  set ipsecwanip owner=ipsecwanip
  270.  set l2tp-out1-up owner=l2tp-out1-up
  271.  set l2tp-out2-up owner=l2tp-out2-up
  272.  set vars owner=vars
  273. +set pinger owner=pinger
  274. +
  275.  /system scheduler
  276.  add interval=0s name=vars on-event=vars start-time=startup
  277.  add interval=1m name=ipsecwanip on-event=ipsecwanip \
  278.      start-time=startup
  279.  add interval=1m name=l2tp-out1-up on-event=l2tp-out1-up \
  280. -    start-time=startup
  281. +    start-time=startup disabled="$vpn1disabled"
  282.  add interval=1m name=l2tp-out2-up on-event=l2tp-out2-up \
  283. +    start-time=startup disabled="$vpn2disabled"
  284. +add interval=1m name=pinger on-event=pinger \
  285.      start-time=startup
  286. +
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!