Russian Users MikroTik | Форум пользователей MikroTik

Код: Выделить всё

===

# jun/29/2018 21:01:42 by RouterOS 6.42.5
# software id = RG2W-6FVW
#
# model = RouterBOARD 952Ui-5ac2nD
# serial number = XXXXXXXXX
/interface lte
set [ find ] comment="Yota LTE" mac-address=XX:XX:XX:XX:XX:XX mtu=1400 name=\
lte1
/interface bridge
add admin-mac=XX:XX:XX:XX:XX:XX arp=proxy-arp auto-mac=no comment=defconf \
fast-forward=no name=bridge
/interface ethernet
set [ find default-name=ether1 ] comment=WAN
set [ find default-name=ether2 ] name=ether2-master
set [ find default-name=ether5 ] poe-out=off
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce \
comment=WIFI country=russia disabled=no distance=indoors frequency=auto \
mode=ap-bridge rx-chains=0 ssid=XXX-NET tx-chains=0 tx-power=11 \
tx-power-mode=all-rates-fixed wireless-protocol=802.11 wps-mode=disabled
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
20/40/80mhz-Ceee country=russia distance=indoors frequency=auto mode=\
station-bridge ssid=XXXXXX-5G wireless-protocol=nv2-nstreme-802.11
/interface wireless manual-tx-power-table
set wlan1 comment=WIFI
/interface wireless nstreme
set wlan1 comment=WIFI enable-polling=no
/interface list
add exclude=dynamic name=discover
add name=mactel
add name=mac-winbox
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
dynamic-keys supplicant-identity=MikroTik wpa-pre-shared-key=XXXXXX \
wpa2-pre-shared-key=XXXXXX
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc
/ip pool
add name=dhcp ranges=192.168.2.2-192.168.2.30
/ip dhcp-server
add address-pool=dhcp authoritative=after-2sec-delay disabled=no interface=\
bridge lease-time=2d name=defconf src-address=192.168.2.1
/ppp profile
set *0 change-tcp-mss=no use-compression=no use-encryption=yes use-mpls=no \
use-upnp=no
set *FFFFFFFE use-compression=no use-mpls=no use-upnp=no
/interface pptp-client
add allow=mschap2 comment="PPTP VPN" connect-to=X.X.X.X disabled=no \
max-mru=1480 max-mtu=1480 name=pptp-home password=XXXXXX profile=\
default user=george
/snmp community
set [ find default=yes ] addresses=0.0.0.0/0
/interface bridge port
add bridge=bridge comment=defconf interface=ether2-master
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
add bridge=bridge interface=ether1
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=discover
/ip settings
set allow-fast-path=no
/interface list member
add interface=ether2-master list=discover
add interface=ether3 list=discover
add interface=ether4 list=discover
add interface=ether5 list=discover
add interface=lte1 list=discover
add interface=wlan1 list=discover
add interface=wlan2 list=discover
add interface=bridge list=discover
add interface=pptp-home list=discover
add interface=bridge list=mactel
add interface=lte1 list=mactel
add interface=bridge list=mac-winbox
add interface=lte1 list=mac-winbox
/interface wireless access-list
add disabled=yes interface=wlan1 mac-address=XX:XX:XX:XX:XX:XX
/ip address
add address=192.168.2.1/24 comment=defconf interface=bridge network=\
192.168.2.0
/ip arp
add address=192.168.2.6 comment=XEROX-WC35 interface=bridge mac-address=\
00:00:AA:66:01:DA
add address=192.168.2.7 comment=XEROX-C75 interface=bridge mac-address=\
00:E0:81:E1:D3:89
add address=192.168.2.8 comment=HP-Z2100 interface=bridge mac-address=\
00:40:CA:99:B0:D7
add address=192.168.2.25 interface=bridge mac-address=XX:XX:XX:XX:XX:XX
add address=192.168.2.26 interface=bridge mac-address=XX:XX:XX:XX:XX:XX
add address=192.168.2.27 interface=bridge mac-address=XX:XX:XX:XX:XX:XX
/ip dhcp-client
add dhcp-options=clientid,hostname disabled=no interface=lte1
add dhcp-options=clientid,hostname interface=ether1
/ip dhcp-server lease
add address=192.168.2.2 client-id=XX:XX:XX:XX:X:X comment="My MacOS" \
mac-address=XX:XX:XX:XX:X:X server=defconf
/ip dhcp-server network
add address=192.168.2.0/24 comment=defconf gateway=192.168.2.1 netmask=24
/ip dns
set allow-remote-requests=yes max-udp-packet-size=512
/ip firewall address-list
add address=0.0.0.0/0 list=vpn
/ip firewall filter
add action=accept chain=input comment=\
"Accept established & related connections" connection-state=\
established,related
add action=accept chain=forward connection-state=established,related
add action=accept chain=input comment="Allows Ping" protocol=icmp
add action=accept chain=forward protocol=icmp
add action=accept chain=input comment="Allow TCP" protocol=tcp
add action=accept chain=forward protocol=tcp
add action=accept chain=output protocol=gre
add action=accept chain=input comment="Allow UDP" disabled=yes protocol=udp
add action=accept chain=forward protocol=udp
add action=drop chain=input comment="Drop invalid connections" \
connection-state=invalid
add action=drop chain=forward connection-state=invalid
add action=drop chain=input in-interface=lte1
/ip firewall mangle
add action=mark-routing chain=prerouting dst-address=!192.168.2.0/24 \
dst-address-list=vpn new-routing-mark=home-vpn passthrough=yes \
src-address=192.168.2.0/24
add action=change-mss chain=forward in-interface=pptp-home new-mss=\
clamp-to-pmtu passthrough=yes protocol=tcp tcp-flags=syn,!rst tcp-mss=\
1453-65535
add action=change-mss chain=forward new-mss=clamp-to-pmtu out-interface=\
pptp-home passthrough=yes protocol=tcp tcp-flags=syn,!rst tcp-mss=\
1453-65535
/ip firewall nat
add action=masquerade chain=srcnat comment="NAT for LTE1" out-interface=lte1
add action=masquerade chain=srcnat comment="defconf: masquerade" \
out-interface=pptp-home
add action=masquerade chain=srcnat out-interface=bridge
add action=netmap chain=dstnat comment=Synology dst-address=X.X.X.X \
in-interface=pptp-home protocol=tcp to-addresses=192.168.2.19 to-ports=21
/ip firewall service-port
set tftp disabled=yes
/ip route
add distance=1 gateway=pptp-home routing-mark=home-vpn
add distance=1 dst-address=192.168.1.0/24 gateway=pptp-home
add distance=1 dst-address=192.168.3.0/24 gateway=pptp-home
/ip service
set telnet disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip smb
set allow-guests=no domain= interfaces=bridge
/ip smb shares
set [ find default=yes ] directory=/pub
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=bridge type=internal
add interface=pptp-home type=external
add interface=lte1 type=external
/system clock
set time-zone-name=Europe/Moscow
/system ntp client
set enabled=yes primary-ntp=17.253.52.253 secondary-ntp=193.171.23.163
/system routerboard settings
set silent-boot=no
/system scheduler
add comment="Send IP for www.changeip.com" disabled=yes interval=1m name=\
send_my_ip on-event=":local interfacename (\"bridge\");\
\n:local ddns (\"XXXXX.qpoe.com\");\
\n:local login (\"xxx@xxxx.ru\");\
\n:local password (\"XXXXXXXX\");\
\n\
\n:local CurrentDynDNSIP [:resolve \$ddns]\
\n:local TMPDynDNSIP [/ip address get [/ip address find interface=\$interf\
acename] address]\
\n:local RealDynDNSIP [:pick \$TMPDynDNSIP 0 ([:len \$TMPDynDNSIP]-3)]\
\n:if (\$CurrentDynDNSIP!=\$RealDynDNSIP) do={/tool dns-update name=\$ddns\
\_address=\$RealDynDNSIP key-name=\$login key=\$password}" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-time=startup
/system watchdog
set watch-address=192.168.2.1
/tool mac-server
set allowed-interface-list=mactel
/tool mac-server mac-winbox
set allowed-interface-list=mac-winbox
/tool netwatch
add comment="Reset USB Modem" disabled=yes down-script=\
"/system routerboard usb power-reset duration=5s" host=8.8.8.8 timeout=3s
add comment="Reboot USB Modem" down-script=reboot_yota host=192.168.8.1 \
interval=30s