API tools faq
paste
kondratyev

Untitled

kondratyev
Jan 2nd, 2024 (edited)
1,173
0
Never
9
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 8.81 KB | None | 0 0
raw download clone embed print report
  1. # 2024-01-02 10:59:26 by RouterOS 7.11.2
  2. # software id = JVBD-W32S
  3. #
  4. # model = C53UiG+5HPaxD2HPaxD
  5. /interface bridge
  6.     add admin-mac=48:A9:8A:BD:F6:4C auto-mac=no comment=defconf name=bridge
  7. /interface ethernet
  8.     set [ find default-name=ether3 ] comment="QNAP NAS"
  9.     set [ find default-name=ether5 ] comment="Rpi server"
  10. /interface wifiwave2
  11.     set [ find default-name=wifi1 ] channel.skip-dfs-channels=10min-cac comment="5 GHz WLAN" configuration.country=Ukraine .mode=ap .ssid=WiFi \
  12.     disabled=no security.authentication-types=wpa2-psk,wpa3-psk
  13. set [ find default-name=wifi2 ] channel.skip-dfs-channels=10min-cac comment="2.4 GHz WLAN" configuration.country=Ukraine .mode=ap .ssid=WiFi_2 \
  14.     disabled=no mtu=1500 security.authentication-types=wpa2-psk,wpa3-psk
  15. add configuration.hide-ssid=no .mode=ap .ssid=connect-bridge disabled=no mac-address=4A:A9:8A:BD:F6:50 master-interface=wifi1 mtu=1500 name=wifi3 \
  16.     security.authentication-types=wpa2-psk .encryption=ccmp,gcmp,ccmp-256,gcmp-256 .wps=disable
  17. /interface pppoe-client
  18.     add add-default-route=yes disabled=no interface=ether1 name=PPPoE use-peer-dns=yes user=username
  19. /interface list
  20.     add comment=defconf name=WAN
  21.     add comment=defconf name=LAN
  22. /ip pool
  23.     add name=dhcp ranges=192.168.88.10-192.168.88.254
  24.     add comment="Pool for OpenVPN" name=openvpn ranges=172.12.10.10-172.12.10.100
  25. /ip dhcp-server
  26.     add address-pool=dhcp always-broadcast=yes interface=bridge lease-time=10m name=defconf server-address=192.168.88.1
  27. /ppp profile
  28.     add comment="Profile for OpenVPN" local-address=172.12.10.1 name="OpenVPN Server" remote-address=openvpn
  29. /interface bridge port
  30.     add bridge=bridge comment=defconf interface=ether2
  31.     add bridge=bridge comment=defconf interface=ether3
  32.     add bridge=bridge comment=defconf interface=ether4
  33.     add bridge=bridge comment=defconf interface=ether5
  34.     add bridge=bridge comment=defconf interface=wifi1
  35.     add bridge=bridge comment=defconf interface=wifi2
  36.     add bridge=bridge interface=wifi3
  37. /ip neighbor discovery-settings
  38.     set discover-interface-list=LAN
  39. /interface detect-internet
  40.     set detect-interface-list=WAN
  41. /interface list member
  42.     add comment=defconf interface=bridge list=LAN
  43.     add comment=defconf disabled=yes interface=ether1 list=WAN
  44.     add interface=PPPoE list=WAN
  45. /interface ovpn-server server
  46.     set auth=sha1,md5,sha256 certificate=100.100.100.100 cipher=blowfish128,aes128-cbc,aes256-cbc,aes128-gcm,aes256-gcm default-profile="OpenVPN Server" \
  47.     enabled=yes protocol=udp
  48. /ip address
  49.     add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
  50. /ip dhcp-server lease
  51.     add address=192.168.88.44 client-id=1:cc:2d:e0:32:95:85 mac-address=CC:2D:E0:32:95:85 server=defconf
  52.     add address=192.168.88.18 client-id=1:b8:27:eb:cb:31:56 mac-address=B8:27:EB:CB:31:56 server=defconf
  53. /ip dhcp-server network
  54.     add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1
  55. /ip dns
  56.     set allow-remote-requests=yes
  57. /ip dns static
  58.     add address=192.168.88.1 comment=defconf name=router.lan
  59. /ip firewall filter
  60.     add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
  61.     add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
  62.     add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
  63.     add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
  64.     add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
  65.     add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
  66.     add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
  67.     add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
  68.     add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
  69.     add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
  70.     add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new disabled=yes \
  71.     in-interface-list=WAN
  72.     add action=drop chain=input comment="Drop PPPoE input" in-interface=PPPoE
  73.     add action=accept chain=input comment="Accept OpenVPN connection" dst-port=1194 in-interface=PPPoE log=yes log-prefix=OVPN- protocol=udp
  74. /ip firewall nat
  75.     add action=masquerade chain=srcnat comment="Masquerade for DHCP client" disabled=yes ipsec-policy=out,none out-interface-list=WAN
  76.     add action=masquerade chain=srcnat comment="Masquerade PPPoE traffic" log=yes log-prefix=OVPN-MASQUERADE- out-interface=PPPoE
  77.     add action=netmap chain=dstnat comment="Forward SMB/CIFS from NAS to WAN" disabled=yes dst-port=445 in-interface=PPPoE protocol=tcp to-addresses=\
  78.     192.168.88.200 to-ports=445
  79.     add action=netmap chain=dstnat comment="Forward NAS UI to WAN" disabled=yes dst-port=4438 in-interface=PPPoE log=yes protocol=tcp to-addresses=\
  80.     192.168.88.200 to-ports=443
  81. /ip firewall service-port
  82.     set ftp disabled=yes
  83.     set tftp disabled=yes
  84.     set sip disabled=yes
  85. /ipv6 firewall address-list
  86.     add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
  87.     add address=::1/128 comment="defconf: lo" list=bad_ipv6
  88.     add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
  89.     add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
  90.     add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
  91.     add address=100::/64 comment="defconf: discard only " list=bad_ipv6
  92.     add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
  93.     add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
  94.     add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
  95. /ipv6 firewall filter
  96.     add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
  97.     add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
  98.     add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
  99.     add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
  100.     add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
  101.     add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
  102.     add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
  103.     add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
  104.     add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
  105.     add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
  106.     add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
  107.     add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
  108.     add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
  109.     add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
  110.     add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
  111.     add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
  112.     add action=accept chain=forward comment="defconf: accept HIP" protocol=139
  113.     add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
  114.     add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
  115.     add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
  116.     add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
  117.     add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
  118. /ppp secret
  119.     add comment="Secret for OpenVPN user andrii" name=andrii profile="OpenVPN Server" service=ovpn
  120. /system clock
  121.     set time-zone-name=Europe/Kiev
  122. /system identity
  123.     set name=brvk
  124. /system note
  125.     set note=%C9
  126. /system ntp client
  127.     set enabled=yes
  128. /system ntp client servers
  129.     add address=0.ua.pool.ntp.org
  130. /tool mac-server
  131.     set allowed-interface-list=LAN
  132. /tool mac-server mac-winbox
  133.     set allowed-interface-list=LAN
  134. /tool sniffer
  135.     set filter-interface=PPPoE filter-ip-protocol=udp filter-port=1194 streaming-enabled=yes streaming-server=192.168.88.10
Advertisement
Comments
  • User was banned
  • User was banned
  • User was banned
  • User was banned
  • User was banned
  • User was banned
  • User was banned
  • User was banned
  • User was banned
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!