Russian Users MikroTik | Форум пользователей MikroTik

# Created by MikroTik configuration wizard v.2.8 (www.mikrotikwizard.com)
#
# Configuration Name: 2wan-bal-v1
# Modified: 2018-10-24 10:36
# Downloaded: 2018-10-24 10:37
#
# wait for interfaces
:local count 0;
:while ([/interface ethernet find] = "") do={
:if ($count = 30) do={
:log warning "mikrotikwizard: Unable to find ethernet interfaces";
/quit;
}
:delay 1s;
:set count ($count +1);
};

# Ports
:global wan1name "";
:global wan2name "";
:global tmp1name "";
:global tmp2name "";
:foreach k in=[/interface ethernet find] do={
if ($tmp1name = "") do={
:set tmp1name [/interface ethernet get $k name];
} else {
:if ($tmp2name = "") do={
:set tmp2name [/interface ethernet get $k name];
}
}
}
/interface list add name=WAN comment="WAN ports"
/ip firewall nat add chain=srcnat out-interface-list=WAN ipsec-policy=out,none action=masquerade comment="masquerade"
:set wan1name ($tmp1name."-wan");
/interface ethernet set [find name="$tmp1name"] name="$wan1name" comment="isp1"
:set wan2name ($tmp2name."-wan2");
/interface ethernet set [find name="$tmp2name"] name="$wan2name" comment="isp2"

/interface bridge add name=bridge-local disabled=no auto-mac=yes protocol-mode=rstp;
:delay 1s;
/interface list add name=LAN comment="LAN ports"
:local bMACIsSet 0;
:foreach p in=[/interface ethernet find where !(name~"wan" || name~"bridge")] do={
:local tmpPortName [/interface ethernet get $p name];
:if ($bMACIsSet = 0) do={
:if ([/interface get $p type] = "ether") do={
/interface bridge set "bridge-local" auto-mac=no admin-mac=[/interface ethernet get $tmpPortName mac-address];
:set bMACIsSet 1;
}
}
/interface bridge port add bridge="bridge-local" interface="$tmpPortName";
/interface list member add list=LAN interface=$tmpPortName
}

# WiFi setup
/interface wireless security-profiles set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk eap-methods="" mode=dynamic-keys supplicant-identity="testWifiName" wpa-pre-shared-key="testWifiPass" wpa2-pre-shared-key="testWifiPass"
:foreach p in=[/interface wireless find] do={
:local tmpWName [/interface wireless get $p name];
:local tmpBand [:pick [/interface wireless get $p band] 0 1];
:if ($tmpBand = "5") do={
/interface wireless set $p band=5ghz-a/n/ac channel-width=20/40mhz-Ce wireless-protocol=802.11 frequency=auto mode=ap-bridge ssid="testWifiName" distance=indoors disabled=no

} else {
/interface wireless set $p band=2ghz-b/g/n channel-width=20/40mhz-Ce wireless-protocol=802.11 frequency=auto mode=ap-bridge ssid="testWifiName" distance=indoors disabled=no

}
/interface bridge port add bridge=bridge-local interface=$tmpWName
/interface list member add list=LAN interface=$tmpWName
}
# LAN
/ip address add address=192.168.88.1/24 disabled=no interface=bridge-local
/ip pool add name=pool-lan ranges=192.168.88.2-192.168.88.254
/ip dhcp-server add address-pool=pool-lan interface=bridge-local name=dhcp-lan disable=no
/ip dhcp-server network add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1

# ISP1
/ip dhcp-client add dhcp-options=hostname,clientid interface=$wan1name add-default-route=no use-peer-dns=yes disabled=no
/interface list member add list=WAN interface=$wan1name

# ISP2
/ip dhcp-client add dhcp-options=hostname,clientid interface=$wan2name add-default-route=no use-peer-dns=yes disabled=no
/interface list member add list=WAN interface=$wan2name

# Recursive
/ip route add dst-address=8.8.8.8 gateway=127.0.0.1 distance=1 scope=30 comment=isp1
/ip route add dst-address=8.8.4.4 gateway=127.0.0.1 distance=1 scope=30 comment=isp2
/ip route add dst-address=0.0.0.0/0 gateway=8.8.8.8 distance=1 check-gateway=ping target-scope=30
/ip route add dst-address=0.0.0.0/0 gateway=8.8.4.4 distance=2 check-gateway=ping target-scope=30

/ip firewall mangle add action=mark-connection chain=input in-interface=$wan1name new-connection-mark=isp1in_c passthrough=yes
/ip firewall mangle add action=mark-connection chain=input in-interface=$wan2name new-connection-mark=isp2in_c passthrough=yes
/ip firewall mangle add action=mark-routing chain=output connection-mark=isp1in_c new-routing-mark=isp1 passthrough=no
/ip firewall mangle add action=mark-routing chain=output connection-mark=isp2in_c new-routing-mark=isp2 passthrough=no
/ip route add dst-address=0.0.0.0/0 gateway=127.0.0.1 distance=1 routing-mark=isp1 comment=isp1
/ip route add dst-address=0.0.0.0/0 gateway=127.0.0.1 distance=1 routing-mark=isp2 comment=isp2

# Load balancing
/ip firewall mangle add in-interface=bridge-local dst-address-type=!local action=mark-routing chain=prerouting new-routing-mark=isp1lb per-connection-classifier=both-addresses:4/0 comment=isp1-40
/ip firewall mangle add in-interface=bridge-local dst-address-type=!local action=mark-routing chain=prerouting new-routing-mark=isp1lb per-connection-classifier=both-addresses:4/1 comment=isp1-41
/ip firewall mangle add in-interface=bridge-local dst-address-type=!local action=mark-routing chain=prerouting new-routing-mark=isp1lb per-connection-classifier=both-addresses:4/2 comment=isp1-42
/ip firewall mangle add in-interface=bridge-local dst-address-type=!local action=mark-routing chain=prerouting new-routing-mark=isp2lb per-connection-classifier=both-addresses:4/3 comment=isp2-43
/ip route add dst-address=0.0.0.0/0 gateway=8.8.8.8 distance=1 check-gateway=ping target-scope=30 routing-mark=isp1lb
/ip route add dst-address=0.0.0.0/0 gateway=8.8.4.4 distance=2 check-gateway=ping target-scope=30 routing-mark=isp1lb
/ip route add dst-address=0.0.0.0/0 gateway=8.8.4.4 distance=1 check-gateway=ping target-scope=30 routing-mark=isp2lb
/ip route add dst-address=0.0.0.0/0 gateway=8.8.8.8 distance=2 check-gateway=ping target-scope=30 routing-mark=isp2lb
/system scheduler add disabled=no interval=30s name=CheckGateway on-event=CheckGateway
/system script add name=CheckGateway owner=admin policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive source="#Name: CheckGateway v.1\r\
\n#Created by MikroTik configuration wizard (www.mikrotikwizard.com)\r\
\n:local debug false;\r\
\n# isp1 \r\
\n:if ([/interface find comment=isp1] != \"\") do={\r\
\n:local wan1 [/interface get [find comment=isp1] name];\r\
\n:if ( [/ip dhcp-client get [find interface=\$wan1] status] = \"bound\") do={\r\
\n:local NewGW [/ip dhcp-client get [find interface=\$wan1] gateway];\r\
\n:foreach g in=[/ip route find where comment=isp1] do={\r\
\n:local OldGW [/ip route get \$g gateway];\r\
\n:if (\$OldGW!=\$NewGW) do={\r\
\n/ip route set \$g gateway=\$NewGW;\r\
\n:log info \"CheckGateway: isp1 change gateway from \$OldGW to \$NewGW\";\r\
\n} else {\r\
\nif (\$debug) do={:log info \"CheckGateway: isp1 route is not change \$OldGW / \$NewGW\";}\r\
\n}\r\
\n} \r\
\n} else {\r\
\nif (\$debug) do={:log info \"CheckGateway: interface \$wan1 is not ready\";}\r\
\n}\r\
\n} else {\r\
\n:log warning \"CheckGateway: ERROR isp1 interface NOT found\";\r\
\n}\r\
\n \r\
\n# isp2 \r\
\n:if ([/interface find comment=isp2] != \"\") do={\r\
\n:local wan2 [/interface get [find comment=isp2] name];\r\
\n:if ( [/ip dhcp-client get [find interface=\$wan2] status] = \"bound\") do={\r\
\n:local NewGW [/ip dhcp-client get [find interface=\$wan2] gateway];\r\
\n:foreach g in=[/ip route find where comment=isp2] do={\r\
\n:local OldGW [/ip route get \$g gateway];\r\
\n:if (\$OldGW!=\$NewGW) do={\r\
\n/ip route set \$g gateway=\$NewGW;\r\
\n:log info \"CheckGateway: isp2 change gateway from \$OldGW to \$NewGW\";\r\
\n} else {\r\
\nif (\$debug) do={:log info \"CheckGateway: isp2 route is not change \$OldGW / \$NewGW\";}\r\
\n}\r\
\n} \r\
\n} else {\r\
\nif (\$debug) do={:log info \"CheckGateway: interface \$wan2 is not ready\";}\r\
\n}\r\
\n} else {\r\
\n:log warning \"CheckGateway: ERROR isp2 interface NOT found\";\r\
\n}\r\
\n \r\
"
# DNS
/ip dns set allow-remote-requests=yes
/ip dns static add address=192.168.88.1 name=router

# Firewall Input
/ip firewall filter add chain=input action=accept connection-state=established,related,untracked comment="Accept established,related,untracked"
/ip firewall filter add chain=input action=drop connection-state=invalid comment="Drop invalid"
/ip firewall filter add chain=input action=accept protocol=icmp comment="Accept ICMP"
/ip firewall filter add chain=input action=accept in-interface=bridge-local comment="Accept all from bridge-local"
/ip firewall filter add chain=input action=accept src-address-list=ManageIP comment="Accept access for ManageIP group"
/ip firewall filter add chain=input action=drop comment="Drop all other"

# Firewall Forward
/ip firewall filter add chain=forward action=fasttrack-connection connection-state=established,related disabled=yes comment="fasttrack"
/ip firewall filter add chain=forward action=accept connection-state=established,related,untracked comment="accept established,related,untracked"
/ip firewall filter add action=drop chain=forward connection-state=invalid comment="Drop invalid"
/ip firewall address-list add address=192.168.88.0/24 list=Internet
/ip firewall filter add chain=forward action=accept in-interface=bridge-local out-interface=$wan1name src-address-list=Internet connection-state=new comment="Accept Internet via ISP1 for Internet group"
/ip firewall address-list add address=192.168.88.0/24 list=Internet2
/ip firewall filter add chain=forward action=accept in-interface=bridge-local out-interface=$wan2name src-address-list=Internet2 connection-state=new comment="Accept Internet via ISP2 for Internet2 group"
/ip firewall filter add chain=forward action=drop comment="Drop all other"

# Other
/system clock set time-zone-autodetect=yes
/ip cloud set ddns-enabled=yes update-time=yes

/ip neighbor discovery-settings set discover-interface-list=LAN
/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN
/system identity set name="MyRouter"
# End