Russian Users MikroTik | Форум пользователей MikroTik

Код: Выделить всё

# oct/19/2020 12:43:23 by RouterOS 6.47.4
# software id = H828-MRPH
#
# model = RB2011UiAS
# serial number = ЧЧЧЧЧЧЧЧЧ
/interface bridge
add admin-mac=48:8F:5A:42:7C:40 auto-mac=no comment=defconf name=bridge_LAN
/interface ethernet
set [ find default-name=ether4 ] comment="Cisco 3650 (GigabitEthernet1/0/22)"
set [ find default-name=ether5 ] comment=HPE-MSA-Storage-3b89b7
/interface sstp-server
add name=sstp-in1 user=гыук
/interface gre
add local-address=217.29.61.50 name=gre-vCloud remote-address=185.58.220.18
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec profile
add dh-group=modp2048 enc-algorithm=aes-256 hash-algorithm=sha256 name=\
    profile-vCloud nat-traversal=no
/ip ipsec peer
add address=185.58.220.18/32 exchange-mode=ike2 name=Edge_mikrotik profile=\
    profile-vCloud
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256 enc-algorithms=aes-256-cbc \
    pfs-group=modp2048
/ip pool
add name=dhcp ranges=20.20.20.10-20.20.20.250
add name=vpn ranges=100.64.0.100-100.64.0.199
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge_LAN name=LAN
add address-pool=vpn interface=ether1 name=VPN
/ppp profile
set *FFFFFFFE local-address=100.64.0.1 only-one=no remote-address=vpn \
    use-compression=yes use-mpls=no use-upnp=yes
/snmp community
set [ find default=yes ] addresses=10.10.0.58/32
/user group
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\
    sword,web,sniff,sensitive,api,romon,dude,tikapp"
/interface bridge port
add bridge=bridge_LAN comment=defconf interface=ether2
add bridge=bridge_LAN comment=defconf interface=ether3
add bpdu-guard=yes bridge=bridge_LAN comment=\
    "Cisco 3650 (GigabitEthernet1/0/22)" interface=ether4
add bridge=bridge_LAN comment=defconf interface=ether5
add bridge=bridge_LAN comment=defconf interface=ether6
add bridge=bridge_LAN comment=defconf interface=ether7
add bridge=bridge_LAN comment=defconf interface=ether8
add bridge=bridge_LAN comment=defconf interface=ether9
add bridge=bridge_LAN comment=defconf interface=ether10
add bridge=bridge_LAN comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface l2tp-server server
set ipsec-secret=111111111111 use-ipsec=yes
/interface list member
add comment=defconf interface=bridge_LAN list=LAN
add comment=defconf interface=ether1 list=WAN
/interface ovpn-server server
set certificate=CA
/interface sstp-server server
set authentication=mschap2 certificate=217.29.61.50 default-profile=\
    default-encryption enabled=yes force-aes=yes
/ip address
add address=20.20.20.1/24 comment=defconf interface=ether4 network=20.20.20.0
add address=217.29.61.50/27 interface=ether1 network=217.29.61.32
add address=192.168.113.1/30 interface=gre-vCloud network=192.168.113.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=20.20.20.0/24 comment=defconf gateway=20.20.20.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static
add address=20.20.20.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="allow IPsec " src-address=\
    185.58.220.18
add action=accept chain=output comment="allow IPsec " dst-address=\
    185.58.220.18
add action=accept chain=input comment="allow IPsec NAT" dst-port=4500 \
    protocol=udp
add action=accept chain=input comment="allow IKE" dst-port=500 protocol=udp
add action=accept chain=input comment="allow l2tp" dst-port=1701 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=accept chain=srcnat comment=IPSEC dst-address=192.168.133.2 \
    src-address=192.168.133.1
add action=accept chain=srcnat comment=IPSEC dst-address=192.168.133.1 \
    src-address=192.168.133.2
add action=accept chain=srcnat comment=IPSEC dst-address=11.11.11.0/24 \
    src-address=20.20.20.0/24
add action=accept chain=srcnat comment=IPSEC dst-address=20.20.20.0/24 \
    src-address=11.11.11.0/24
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="masq. vpn traffic" src-address=\
    100.64.0.0/24
/ip firewall raw
add action=accept chain=prerouting dst-address=192.168.113.1 src-address=\
    192.168.113.2
add action=accept chain=prerouting dst-address=192.168.113.2 src-address=\
    192.168.113.1
add action=accept chain=prerouting dst-address=11.11.11.0/24 src-address=\
    20.20.20.0/24
add action=accept chain=prerouting dst-address=20.20.20.0/24 src-address=\
    11.11.11.0/24
/ip ipsec identity
add notrack-chain=prerouting peer=Edge_mikrotik secret=ццццццццццццццц
/ip ipsec policy
set 0 disabled=yes
add disabled=yes dst-address=185.58.220.18/32 peer=Edge_mikrotik \
    sa-dst-address=185.58.220.18 sa-src-address=217.29.61.50 src-address=\
    217.29.61.50/32 tunnel=yes
/ip route
add distance=1 gateway=217.29.61.33
add check-gateway=ping distance=1 dst-address=10.10.0.0/24 gateway=20.20.20.2
add check-gateway=ping distance=1 dst-address=10.10.10.0/24 gateway=\
    20.20.20.2
add check-gateway=ping distance=1 dst-address=10.100.199.0/24 gateway=\
    20.20.20.2
add distance=1 dst-address=11.11.11.0/24 gateway=192.168.133.2
add distance=1 dst-address=192.168.1.0/26 gateway=20.20.20.2
add distance=1 dst-address=192.168.4.0/24 gateway=20.20.20.2
add distance=1 dst-address=192.168.4.0/26 gateway=20.20.20.2
add distance=1 dst-address=192.168.5.0/26 gateway=20.20.20.2
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set www-ssl certificate=217.29.61.50 disabled=no port=0000
set api disabled=yes
/ppp secret
add name=гыук password=11111111111 profile=default-encryption service=sstp
add name=гыук password=1111111111
/snmp
set contact=admin enabled=yes location=COD trap-generators=start-trap \
    trap-version=2
/system clock
set time-zone-name=Europe/Moscow
/system ntp client
set enabled=yes primary-ntp=88.147.254.227 secondary-ntp=109.195.19.73
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN