Ještě jsem to kontroloval, ale nepříjde mi, že bych tam měl špatně údaje
Jedná se o propojení MK1 a MK3
MK1
# aug/20/2017 11:43:48 by RouterOS 6.40.1
# software id = 58CZ-EMKL
#
# model = 951G-2HnD
# serial number = 4699027A0482
/interface bridge
add admin-mac=D4:CA:6D:F4:90:CD arp=proxy-arp auto-mac=no fast-forward=no mtu=\
1500 name=bridge-local
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce \
country="czech republic" disabled=no distance=indoors frequency=auto mode=\
ap-bridge ssid=Tirus wireless-protocol=802.11
/interface ethernet
set [ find default-name=ether1 ] name="1_WAN - A1M"
set [ find default-name=ether2 ] arp=proxy-arp name=2_Pokojik speed=1Gbps
set [ find default-name=ether3 ] arp=proxy-arp disabled=yes name=3_none
set [ find default-name=ether4 ] arp=proxy-arp disabled=yes name=4_NAS
set [ find default-name=ether5 ] arp=proxy-arp master-port=2_Pokojik name=\
5_Obyvak
/interface l2tp-server
add disabled=yes name="0. L2TP_SERVER_PROPOJ_VOSTOCNYJ" user=\
PROPOJ_BAJKONUR_VOSTOCNYJ
/ip neighbor discovery
set wlan1 discover=no
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
dynamic-keys wpa-pre-shared-key=hesloWifi wpa2-pre-shared-key=hesloWifi
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/ip pool
add name=dhcp ranges=192.168.40.100-192.168.40.199
add name=PPTP-TIRUS ranges=192.168.40.230-192.168.40.240
add name=L2TP ranges=192.168.50.1-192.168.50.10
add name=POOL_DOMACI_VPN ranges=172.31.0.2-172.31.0.254
/ip dhcp-server
add address-pool=dhcp authoritative=after-2sec-delay disabled=no interface=\
bridge-local lease-time=3d name=default
/ppp profile
add comment="0. L2TP_SERVER_PROPOJ_BAJKONUR_VOSTOCNYJ" local-address=\
POOL_DOMACI_VPN name="0. L2TP_SERVER_PROPOJ_BAJKONUR_VOSTOCNYJ" \
remote-address=POOL_DOMACI_VPN
add comment="0. CLIENT_PROPOJ_VOSTOCNYJ" name="0. CLIENT_PROPOJ_VOSTOCNYJ"
/system logging action
set 0 memory-lines=100
set 1 disk-lines-per-file=100
/interface bridge port
add bridge=bridge-local interface=2_Pokojik
add bridge=bridge-local interface=wlan1
/interface l2tp-server server
set authentication=mschap1,mschap2 default-profile=default enabled=yes \
ipsec-secret=jineTajneHeslo use-ipsec=yes
/interface pptp-server server
set authentication=chap,mschap1,mschap2 enabled=yes max-mru=1460 max-mtu=1460
/ip address
add address=192.168.40.1/24 comment="default configuration" interface=2_Pokojik \
network=192.168.40.0
/ip dhcp-client
add comment="default configuration" dhcp-options=hostname,clientid disabled=no \
interface="1_WAN - A1M" use-peer-dns=no
/ip dhcp-server network
add address=172.31.0.0/24 comment=NETWORK_DOMACI_VPN gateway=172.31.0.1 \
netmask=24
add address=192.168.40.0/24 comment="default configuration" dns-server=\
192.168.40.1 gateway=192.168.40.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=\
217.30.64.53,217.30.64.54,8.8.8.8,8.8.4.4,192.168.1.200
/ip dns static
add address=192.168.88.1 name=router
/ip firewall address-list
add address=192.168.40.0/24 list=LAN
add address=verejnaIpMK2 list=support
add address=83.240.1.50 list=IPTV-1
add address=83.240.1.57 list=IPTV-2
/ip firewall filter
add action=add-src-to-address-list address-list=Syn_Flooder \
address-list-timeout=30m chain=input comment="Add Syn Flood IP to the list" \
connection-limit=30,32 protocol=tcp tcp-flags=syn
add action=drop chain=input comment="Drop to syn flood list" src-address-list=\
Syn_Flooder
add action=add-src-to-address-list address-list=Port_Scanner \
address-list-timeout=1w chain=input comment="Port Scanner Detect" protocol=\
tcp psd=21,3s,3,1
add action=jump chain=forward comment="Jump for icmp forward flow" jump-target=\
ICMP protocol=icmp
add action=drop chain=input comment="Drop to port scan list" src-address-list=\
Port_Scanner
add action=jump chain=input comment="Jump for icmp input flow" jump-target=ICMP \
protocol=icmp
add action=drop chain=input comment=\
"Block all access to the winbox - except to support list" dst-port=8291 \
protocol=tcp src-address-list=!support
add action=drop chain=forward comment="Drop to bogon list" dst-address-list=\
bogons
add action=add-src-to-address-list address-list=spammers address-list-timeout=\
3h chain=forward comment="Add Spammers to the list for 3 hours" \
connection-limit=30,32 dst-port=25,587 limit=30/1m,0:packet protocol=tcp
add action=drop chain=forward comment="Avoid spammers action" dst-port=25,587 \
protocol=tcp src-address-list=spammers
add action=accept chain=input comment="Accept DNS - UDP" port=53 protocol=udp
add action=accept chain=input comment="Accept DNS - TCP" port=53 protocol=tcp
add action=accept chain=input comment="Accept to established connections" \
connection-state=established
add action=accept chain=input comment="Accept to related connections" \
connection-state=related
add action=accept chain=input comment="Full access to SUPPORT address list" \
src-address-list=support
add action=accept chain=input comment="Full access to IPTV-1 address list" \
src-address-list=IPTV-1
add action=accept chain=input comment="Full access to IPTV-2 address list" \
src-address-list=IPTV-2
add action=accept chain=input comment="Accept IGMP for IPTV" protocol=igmp
add action=accept chain=input comment="Accept VPN - TCP" port=1723 protocol=tcp
add action=accept chain=input comment="Accept VPN - L2TP UDP 1701" port=1701 \
protocol=udp
add action=accept chain=input comment="Accept VPN - L2TP protocol" protocol=\
ipsec-esp
add action=accept chain=input comment="Accept VPN - L2TP 500" port=500 \
protocol=udp
add action=accept chain=input comment="Accept VPN - L2TP 4500" port=4500 \
protocol=udp
add action=accept chain=input comment="Accept HTTP" port=8081 protocol=tcp
add action=accept chain=forward dst-port=41 in-interface="1_WAN - A1M" \
protocol=tcp
add action=accept chain=forward comment=POVOL_PORT__UDP_1701__L2TP dst-port=\
1701 in-interface="1_WAN - A1M" protocol=udp
add action=accept chain=forward comment=POVOL_PORT__1723__PPTP dst-port=1723 \
in-interface="1_WAN - A1M" protocol=tcp
add action=accept chain=forward comment=POVOL_NAVAZANE_SPOJENI \
connection-state=established in-interface="1_WAN - A1M"
add action=accept chain=forward comment=POVOL_NAVAZANE_SPOJENI_VEN \
connection-state=related in-interface="1_WAN - A1M"
add action=accept chain=forward comment=POVOL_SPOJENI_VEN out-interface=\
"1_WAN - A1M"
add action=drop chain=input comment="Drop anything else! "
add action=accept chain=ICMP comment="Echo request - Avoiding Ping Flood" \
icmp-options=8:0 limit=1,5:packet protocol=icmp
add action=accept chain=ICMP comment="Echo reply" icmp-options=0:0 protocol=\
icmp
add action=accept chain=ICMP comment="Time Exceeded" icmp-options=11:0 \
protocol=icmp
add action=accept chain=ICMP comment="Destination unreachable" icmp-options=\
3:0-1 protocol=icmp
add action=accept chain=ICMP comment=PMTUD icmp-options=3:4 protocol=icmp
add action=drop chain=ICMP comment="Drop to the other ICMPs" protocol=icmp
add action=jump chain=output comment="Jump for icmp output" jump-target=ICMP \
protocol=icmp
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" \
out-interface="1_WAN - A1M" to-addresses=0.0.0.0
/ip proxy
set cache-path=web-proxy1 parent-proxy=0.0.0.0
/ip route
add distance=1 dst-address=192.168.42.0/24 gateway=\
"0. L2TP_SERVER_PROPOJ_VOSTOCNYJ"
add distance=1 dst-address=192.168.44.0/24 gateway=*11
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www port=8081
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ppp secret
add name=PROPOJ_BAJKONUR_VOSTOCNYJ password=MojeTajneHeslo profile=\
"0. L2TP_SERVER_PROPOJ_BAJKONUR_VOSTOCNYJ"
/routing igmp-proxy interface
add alternative-subnets=\
239.1.2.0/24,239.1.1.0/24,83.240.1.50/32,83.240.1.57/32,192.168.40.0/24 \
interface="1_WAN - A1M" upstream=yes
add interface=bridge-local
add
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Prague
/system clock manual
set time-zone=+01:00
/system leds
set 0 interface=wlan1
/system ntp client
set enabled=yes primary-ntp=195.113.144.201 secondary-ntp=217.11.227.60
#error exporting /system routerboard mode-button
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=2_Pokojik
add interface=3_none
add interface=4_NAS
add interface=5_Obyvak
add interface=wlan1
add interface=bridge-local
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=2_Pokojik
add interface=3_none
add interface=4_NAS
add interface=5_Obyvak
add interface=wlan1
add interface=bridge-local
MK3
# aug/20/2017 11:39:38 by RouterOS 6.40.1
# software id = KXFU-SJVV
#
# model = RouterBOARD 962UiGS-5HacT2HnT
# serial number = 6F1206D1582A
/interface bridge
add admin-mac=6C:3B:6B:BD:BA:7F auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether2 ] name=ether2-master
set [ find default-name=ether3 ] master-port=ether2-master
set [ find default-name=ether4 ] master-port=ether2-master
set [ find default-name=ether5 ] master-port=ether2-master
/interface l2tp-client
add allow=mschap2 connect-to=verejnaIpMK1 disabled=no ipsec-secret=jineTajneHeslo name=\
"0. CLIENT_PROPOJ_BAJKONUR" password=MojeTajneHeslo use-ipsec=yes user=PROPOJ_BAJKONUR_VOSTOCNYJ
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce country="czech republic" disabled=no \
distance=indoors frequency=auto mode=ap-bridge ssid=Tirus.cz wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-Ceee country="czech republic" \
disabled=no distance=indoors frequency=auto mode=ap-bridge ssid=Tirus.cz wireless-protocol=802.11
/ip neighbor discovery
set ether1 discover=no
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=dynamic-keys wpa-pre-shared-key=hesloWifi \
wpa2-pre-shared-key=hesloWifi
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp ranges=192.168.44.10-192.168.44.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/ppp profile
add change-tcp-mss=yes dns-server=192.168.1.200 name=Software602 use-encryption=yes
/interface pptp-client
add connect-to=asdfghjk disabled=no name=asdasdasd password=asdasdasdasd profile=Software602 user=jnb
/interface bridge port
add bridge=bridge comment=defconf interface=ether2-master
add bridge=bridge comment=defconf interface=sfp1
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/interface l2tp-server server
set ipsec-secret=Lama2017* use-ipsec=yes
/interface sstp-server server
set default-profile=default-encryption
/ip address
add address=192.168.44.1/24 comment=defconf interface=ether2-master network=192.168.44.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=ether1
/ip dhcp-server lease
add address=192.168.44.242 client-id=1:flag_ac:2b:6e:53:5c:3c mac-address=AC:2B:6E:53:5C:3C server=defconf
/ip dhcp-server network
add address=192.168.44.0/24 comment=defconf dns-server=192.168.1.200,192.168.1.77,192.168.44.1 gateway=\
192.168.44.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=192.168.1.200,192.168.1.77,217.30.64.53,217.30.64.54
/ip dns static
add address=192.168.44.1 name=router
/ip firewall address-list
add list=Syn_Flooder
add list=spammers
add list=support
add list=Port_Scanner
add list=bogons
/ip firewall filter
add action=accept chain=forward connection-state=established,related
add action=add-src-to-address-list address-list=Syn_Flooder address-list-timeout=30m chain=input comment=\
"Add Syn Flood IP to the list" connection-limit=30,32 protocol=tcp tcp-flags=syn
add action=accept chain=input comment="allow IPsec NAT" dst-port=4500 protocol=udp
add action=accept chain=input comment="allow IKE" dst-port=500 protocol=udp
add action=accept chain=input comment="allow l2tp" dst-port=1701 protocol=udp
add action=accept chain=input comment="allow pptp" dst-port=1723 protocol=tcp
add action=accept chain=input comment="allow sstp" dst-port=443 protocol=tcp
add action=drop chain=input comment="Drop to syn flood list" src-address-list=Syn_Flooder
add action=add-src-to-address-list address-list=Port_Scanner address-list-timeout=1w chain=input comment=\
"Port Scanner Detect" protocol=tcp psd=21,3s,3,1
add action=jump chain=forward comment="Jump for icmp forward flow" jump-target=ICMP protocol=icmp
add action=drop chain=input comment="Drop to port scan list" src-address-list=Port_Scanner
add action=jump chain=input comment="Jump for icmp input flow" jump-target=ICMP protocol=icmp
add action=drop chain=forward comment="Drop to bogon list" dst-address-list=bogons
add action=add-src-to-address-list address-list=spammers address-list-timeout=3h chain=forward comment=\
"Add Spammers to the list for 3 hours" connection-limit=30,32 dst-port=25,587 limit=30/1m,0:packet \
protocol=tcp
add action=drop chain=forward comment="Avoid spammers action" dst-port=25,587 protocol=tcp src-address-list=\
spammers
add action=accept chain=input comment="Accept DNS - UDP" port=53 protocol=udp
add action=accept chain=input comment="Accept DNS - TCP" port=53 protocol=tcp
add action=accept chain=input comment="Accept to established connections" connection-state=established
add action=accept chain=input comment="Accept to related connections" connection-state=related
add action=accept chain=input comment="Full access to SUPPORT address list" src-address-list=support
add action=accept chain=input comment="Full access to IPTV-1 address list" src-address-list=IPTV-1
add action=accept chain=input comment="Full access to IPTV-2 address list" src-address-list=IPTV-2
add action=accept chain=input comment="Accept IGMP for IPTV" protocol=igmp
add action=accept chain=input comment="Accept VPN - TCP" port=1723 protocol=tcp
add action=accept chain=input comment="Accept HTTP" port=80 protocol=tcp
add action=accept chain=input comment="Accept HTTPS" port=443 protocol=tcp
add action=accept chain=input comment="Accept HTTPS" port=8291 protocol=tcp
add action=drop chain=input comment="Drop anything else! "
add action=accept chain=ICMP comment="Echo request - Avoiding Ping Flood" icmp-options=8:0 limit=1,5:packet \
protocol=icmp
add action=accept chain=ICMP comment="Echo reply" icmp-options=0:0 protocol=icmp
add action=accept chain=ICMP comment="Time Exceeded" icmp-options=11:0 protocol=icmp
add action=accept chain=ICMP comment="Destination unreachable" icmp-options=3:0-1 protocol=icmp
add action=accept chain=ICMP comment=PMTUD icmp-options=3:4 protocol=icmp
add action=drop chain=ICMP comment="Drop to the other ICMPs" protocol=icmp
/ip firewall mangle
add action=mark-routing chain=prerouting dst-address=192.168.0.1-192.168.4.254 new-routing-mark=Software602 \
passthrough=yes src-address=192.168.44.0/24
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat comment="maskarada S602" out-interface=Software602
add action=dst-nat chain=dstnat dst-address=verejnaIpMK3 dst-port=80 protocol=tcp to-addresses=192.168.44.242
add action=masquerade chain=srcnat dst-address=192.168.44.242 dst-port=80 out-interface=bridge protocol=tcp \
src-address=192.168.44.0/24
/ip route
add distance=1 gateway=Software602 routing-mark=Software602
add distance=1 dst-address=192.168.40.0/24 gateway=*F
add distance=1 dst-address=192.168.40.0/24 gateway="0. CLIENT_PROPOJ_BAJKONUR"
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ppp profile
set *FFFFFFFE local-address=192.168.89.1 remote-address=*2
/system clock
set time-zone-name=Europe/Prague
/system package update
set channel=development
#error exporting /system routerboard mode-button
