Russian Users MikroTik | Форум пользователей MikroTik

Код: Выделить всё

# apr/04/2017 08:21:17 by RouterOS 6.38.5
# software id = 7NJD-JYVG
#
/interface bridge
add admin-mac=xxxxxxxxx auto-mac=no mtu=1492 name=bridge-local
/interface ethernet
set [ find default-name=ether1 ] advertise=1000M-half,1000M-full comment=WAN \
    l2mtu=1492 mtu=1492 name=ether1-gateway speed=1Gbps
set [ find default-name=ether2 ] advertise=\
    100M-half,100M-full,1000M-half,1000M-full comment=LAN name=\
    ether2-master-local speed=1Gbps
set [ find default-name=ether3 ] master-port=ether2-master-local name=\
    ether3-slave-local speed=1Gbps
set [ find default-name=ether4 ] master-port=ether2-master-local name=\
    ether4-slave-local speed=1Gbps
set [ find default-name=ether5 ] master-port=ether2-master-local name=\
    ether5-slave-local speed=1Gbps
/ip neighbor discovery
set ether1-gateway discover=no
set ether2-master-local discover=no
set ether3-slave-local discover=no
set ether4-slave-local discover=no
set ether5-slave-local discover=no
set bridge-local discover=no
/interface ethernet switch port
set 0 vlan-mode=fallback
set 1 vlan-mode=fallback
set 2 vlan-mode=fallback
set 3 vlan-mode=fallback
set 4 vlan-mode=fallback
set 5 vlan-mode=fallback
/interface wireless security-profiles
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=\
    AP_WPA2 supplicant-identity="" wpa-pre-shared-key=\
    123 wpa2-pre-shared-key=123
/interface wireless
set [ find default-name=wlan1 ] adaptive-noise-immunity=ap-and-client-mode \
    band=2ghz-b/g/n basic-rates-a/g="" basic-rates-b="" comment=WIFI country=\
    russia disabled=no distance=indoors frequency-mode=regulatory-domain \
    guard-interval=long ht-basic-mcs=mcs-0 ht-supported-mcs="mcs-0,mcs-7,mcs-8\
    ,mcs-14,mcs-15,mcs-16,mcs-17,mcs-18,mcs-19,mcs-20,mcs-21,mcs-22,mcs-23" \
    hw-protection-mode=rts-cts hw-retries=15 max-station-count=15 mode=\
    ap-bridge security-profile=AP_WPA2 ssid=MISP supported-rates-a/g="" \
    supported-rates-b="" tx-power=15 tx-power-mode=all-rates-fixed \
    wds-default-bridge=bridge-local wds-mode=dynamic wireless-protocol=\
    unspecified wmm-support=enabled
/interface wireless manual-tx-power-table
set wlan1 comment=WIFI manual-tx-powers="1Mbps:17,2Mbps:17,5.5Mbps:17,11Mbps:1\
    7,6Mbps:17,9Mbps:17,12Mbps:17,18Mbps:17,24Mbps:17,36Mbps:17,48Mbps:17,54Mb\
    ps:17,HT20-0:0,HT20-1:0,HT20-2:0,HT20-3:0,HT20-4:0,HT20-5:0,HT20-6:0,HT20-\
    7:0,HT40-0:0,HT40-1:0,HT40-2:0,HT40-3:0,HT40-4:0,HT40-5:0,HT40-6:0,HT40-7:\
    0"
/interface wireless nstreme
set wlan1 comment=WIFI enable-polling=no
/ip neighbor discovery
set wlan1 discover=no
/ip firewall layer7-protocol
add name=soribada regexp="^GETMP3\r\
    \nFilename|^\01.\?.\?.\?(Q:\\+|Q2:)|^\10[\14-\16]\10[\15-\17].\?.\?.\?.\?\
    \$"
add name=rdp regexp=rdpdr.*cliprdr.*rdpsnd
add name=shoutcast regexp=\
    "icy [1-5][0-9][0-9] [\t-\r -~]*(content-type:audio|icy-)"
add name=quake-halflife regexp="^\FF\FF\FF\FFget(info|challenge)"
add name=x11 regexp="^[lb].\?\0B"
add name=xboxlive regexp="^X\80........\F3|^\06XN"
add name=zmaap regexp="^\1B\D7;H[\01\02]\01\?\01"
add name=rlogin regexp="^[a-z][a-z0-9][a-z0-9]+/[1-9][0-9]\?[0-9]\?[0-9]\?00"
add name=sip regexp=\
    "^(invite|register|cancel) sip[\t-\r -~]*sip/[0-2]\\.[0-9]"
add name=smb regexp="\FFsmb[r%]"
add name=quake1 regexp="^\80\0C\01quake\03"
add name=ssh regexp="^ssh-[12]\\.[0-9]"
add name=tls regexp="^(.\?.\?\16\03.*\16\03|.\?.\?\01\03\01\?.*\0B)"
add name=tftp regexp="^(\01|\02)[ -~]*(netascii|octet|mail)"
add name=subspace regexp="^\01....\11\10........\01\$"
add name=tsp regexp="^[\01-\13\16-\$]\01.\?.\?.\?.\?.\?.\?.\?.\?.\?.\?[ -~]+"
add name=ssdp regexp="^notify[\t-\r ]\\*[\t-\r ]http/1\\.1[\t-\r -~]*ssdp:(ali\
    ve|byebye)|^m-search[\t-\r ]\\*[\t-\r ]http/1\\.1[\t-\r -~]*ssdp:discover"
add name=unknown regexp=.
add name=yahoo regexp="^(ymsg|ypns|yhoo).\?.\?.\?.\?.\?.\?.\?[lwt].*\C0\80"
add name=validcertssl regexp="^(.\?.\?\16\03.*\16\03|.\?.\?\01\03\01\?.*\0B).*\
    (thawte|equifax secure|rsa data security, inc|verisign, inc|gte cybertrust\
    \_root|entrust\\.net limited)"
add name=vnc regexp="^rfb 00[1-9]\\.00[0-9]\
    \n\$"
add name=tesla regexp="\03\9A\89\"111\\.00 Beta |\E2<i\1E\1C\E9"
add name=socks regexp="\05[\01-\08]*\05[\01-\08]\?.*\05[\01-\03][\01\03].*\05[\
    \01-\08]\?[\01\03]"
add name=smtp regexp="^220[\t-\r -~]* (e\?smtp|simple mail)"
add name=telnet regexp="^\FF[\FB-\FE].\FF[\FB-\FE].\FF[\FB-\FE]"
add name=snmp regexp="^\02\01\04.+([\A0-\A3]\02[\01-\04].\?.\?.\?.\?\02\01.\?\
    \02\01.\?0|\A4\06.+@\04.\?.\?.\?.\?\02\01.\?\02\01.\?C)"
add name=rtsp regexp="rtsp/1.0 200 ok"
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/ip pool
add name=dhcp ranges=192.168.88.235-192.168.88.255
/ip dhcp-server
add add-arp=yes address-pool=dhcp disabled=no interface=bridge-local \
    lease-time=3d name=default
/queue tree
add disabled=yes max-limit=1800k name=WAN_out priority=1 queue=default
add disabled=yes max-limit=1800k name=WAN_in priority=1 queue=default
add disabled=yes limit-at=9500k max-limit=10M name=WAN_total parent=global \
    priority=5 queue=default
add disabled=yes limit-at=3800k max-limit=4M name=Traffic packet-mark=\
    p_traffic parent=WAN_total priority=6 queue=default
add disabled=yes limit-at=450k max-limit=1M name=sip_in packet-mark=sip_in \
    parent=WAN_in priority=3 queue=default
add disabled=yes limit-at=450k max-limit=1M name=sip_out packet-mark=sip_out \
    parent=WAN_out priority=3 queue=default
add disabled=yes limit-at=3800k max-limit=4M name=Computers packet-mark=\
    p_computers parent=Traffic priority=7 queue=default
add disabled=yes limit-at=300k max-limit=4M name=DHCP_guests packet-mark=\
    p_dhcp_guests parent=Traffic queue=default
add disabled=yes limit-at=5k max-limit=50k name=sat_in packet-mark=sat_in \
    parent=WAN_in priority=3 queue=default
add disabled=yes limit-at=5k max-limit=50k name=sat_out packet-mark=sat_in \
    parent=WAN_out priority=3 queue=default
/system logging action
set 0 memory-lines=100
set 1 disk-lines-per-file=100
/interface bridge port
add bridge=bridge-local interface=ether2-master-local
add bridge=bridge-local interface=wlan1
/interface bridge settings
set use-ip-firewall=yes use-ip-firewall-for-pppoe=yes
/ip address
add address=192.168.88.1/24 comment="default configuration" interface=\
    ether2-master-local network=192.168.88.0
add address=88.88.88.888/24 interface=ether1-gateway network=88.88.88.0
add address=192.168.88.1/24 interface=bridge-local network=192.168.88.0
/ip arp
add address=192.168.88.253 interface=bridge-local
add address=192.168.88.246 interface=bridge-local
/ip dhcp-client
add comment="default configuration" dhcp-options=hostname,clientid interface=\
    ether1-gateway use-peer-ntp=no
/ip dhcp-server network
add address=192.168.88.0/24 comment="default configuration" dns-server=\
    192.168.88.1 gateway=192.168.88.1 netmask=24
/ip dns
set allow-remote-requests=yes cache-size=4096KiB servers=\
    8.8.8.8
/ip dns static
add address=192.168.88.1 name=router
/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=\
    established,related
add action=drop chain=input comment=invalid connection-state=invalid
add action=drop chain=input comment="input DNS" dst-port=53 in-interface=\
    ether1-gateway protocol=udp
add action=accept chain=input comment="estabilished relateted" \
    connection-state=established,related
add action=accept chain=input in-interface=!ether1-gateway src-address=\
    192.168.88.0/24
add action=drop chain=input comment="drop everything"
add action=accept chain=output comment="accept everything to internet" \
    out-interface=ether1-gateway
add action=accept chain=output comment="accept everything to non internet" \
    out-interface=!ether1-gateway
add action=accept chain=output comment="accept everything"
add action=drop chain=forward comment="drop invalid connections" \
    connection-state=invalid
add action=accept chain=forward comment="local network" dst-address=\
    192.168.88.0/24 src-address=192.168.88.0/24
add action=accept chain=forward comment=\
    "allow already established connections" connection-state=established
add action=accept chain=forward comment="allow related connections" \
    connection-state=related
add action=drop chain=forward comment="drop invalid connections" \
    connection-state=invalid
add action=drop chain=forward src-address=0.0.0.0/8
add action=drop chain=forward dst-address=0.0.0.0/8
add action=drop chain=forward src-address=127.0.0.0/8
add action=drop chain=forward dst-address=127.0.0.0/8
add action=drop chain=forward src-address=224.0.0.0/3
add action=drop chain=forward dst-address=224.0.0.0/3
add action=jump chain=forward jump-target=tcp protocol=tcp
add action=jump chain=forward jump-target=udp protocol=udp
add action=jump chain=forward jump-target=icmp protocol=icmp
add action=accept chain=forward comment="accept from local to internet" \
    in-interface=!ether1-gateway out-interface=ether1-gateway
add action=drop chain=forward comment="drop everything else"
/ip firewall nat
add action=masquerade chain=srcnat comment="Added by webbox" out-interface=\
    ether1-gateway src-address=192.168.88.0/24 to-addresses=0.0.0.0
add action=dst-nat chain=dstnat comment="uplay udp" disabled=yes dst-port=\
    3659 protocol=udp to-addresses=192.168.88.245 to-ports=3659
add action=netmap chain=dstnat disabled=yes dst-address-list=pc dst-port=\
    56000-56999 in-interface=ether1-gateway protocol=tcp to-addresses=\
    192.168.88.245 to-ports=56000-56999
add action=netmap chain=dstnat comment=reccam disabled=yes dst-port=34567 \
    in-interface=ether1-gateway protocol=tcp to-addresses=192.168.88.242 \
    to-ports=34567
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set pptp disabled=yes
/ip ipsec policy
set 0 disabled=yes
/ip route
add distance=1 gateway=88.88.88.1
/ip service
set telnet address=192.168.88.0/24
set ftp disabled=yes
set www address=192.168.88.0/24 disabled=yes port=8010
set ssh address=192.168.88.0/24 port=64133
set www-ssl address=192.168.88.0/24 disabled=no
set api address=192.168.88.0/24
set winbox address=192.168.88.0/24
set api-ssl address=192.168.88.0/24
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=bridge-local type=internal
add interface=ether1-gateway type=external
add interface=ether2-master-local type=internal
/system clock
set time-zone-autodetect=no
/system clock manual
set time-zone=+03:00
/system leds
set 0 interface=wlan1
/system logging
add action=disk disabled=yes topics=interface
/system scheduler
add disabled=yes interval=5m name="vpn check" on-event=pptp-watcher policy=\
    ftp,read,write,policy,sensitive start-date=jan/23/2013 start-time=\
    11:11:09
/system watchdog
set automatic-supout=no no-ping-delay=0ms
/tool graphing interface
add
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=ether2-master-local
add interface=wlan1
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=ether2-master-local
add interface=wlan1
/tool romon port
add
/tool traffic-monitor
add disabled=yes interface=ether1-gateway name=tmon1 threshold=0 traffic=\
    received

Код: Выделить всё

/interface bridge
add admin-mac=xxxxxxxxx auto-mac=no mtu=1492 name=bridge-local

Код: Выделить всё

name="bridge1" mtu=1500 actual-mtu=1500 l2mtu=1598 arp=enabled 
      arp-timeout=auto