Ebben a cikkben bemutatok egy mikrotik router alapbeállítását.
LAN1 = WAN1 DHCP-client
Bridge-LAN = LAN2, LAN3, LAN4, LAN5
Bridge IP: 192.168.2.254
Neighbors = !WAN
VLAN10 192.168.10.1/23
VLAN30 192.168.30.1/23
DHCP: Bridge-LAN VALN10, VLAN30
NTP server, client
alap firewall :)
WIFI kikapcsolva : Jelszó WIFI2G, WIFI5G: Jelszo2018
Fasttrack bekaspcsolása:
/ip firewall filter
add chain=forward action=fasttrack-connection connection-state=established,related
add chain=forward action=accept connection-state=established,relatedFasttrack kikapcsolása:
példa ( backup letöltése itt.)
# may/24/2018 20:55:28 by RouterOS 6.42.2# model = RouterBOARD 952Ui-5ac2nD/interface bridgeadd admin-mac=64:D1:54:2A:9A:0B auto-mac=no comment=\ "created from master port" name=Bridge-LAN/interface ethernetset [ find default-name=ether1 ] name=ether1-WAN1set [ find default-name=ether2 ] arp=proxy-arp name=ether2-LAN-SLVset [ find default-name=ether3 ] arp=proxy-arp name=ether3-LAN-SLVset [ find default-name=ether4 ] arp=proxy-arp name=ether4-LAN-SLVset [ find default-name=ether5 ] name=ether5-LAN-SLV/interface wirelessset [ find default-name=wlan1 ] mode=ap-bridge ssid=MikroTik2G \ wireless-protocol=802.11set [ find default-name=wlan2 ] mode=ap-bridge ssid=MikroTik5G \ wireless-protocol=802.11/interface vlanadd interface=Bridge-LAN name=VLAN10 vlan-id=10add interface=Bridge-LAN name=VLAN30 vlan-id=30/interface listadd name=WANadd name=LANadd name=VLAN/interface wireless security-profilesset [ find default=yes ] authentication-types=wpa-psk,wpa2-psk eap-methods="" \ mode=dynamic-keys supplicant-identity=MikroTik wpa-pre-shared-key=\ Jelszo2018 wpa2-pre-shared-key=Jelszo2018/ip ipsec proposalset [ find default=yes ] auth-algorithms=sha256,sha1,md5 enc-algorithms=\ aes-256-cbc,aes-128-cbc pfs-group=modp8192/ip pooladd name=POOL-LAN ranges=192.168.2.40-192.168.2.200add name=POOL-VLAN10 ranges=192.168.10.40-192.168.11.200add name=POOL-VLAN30 ranges=192.168.30.40-192.168.31.200/ip dhcp-serveradd add-arp=yes address-pool=POOL-LAN disabled=no interface=Bridge-LAN \ lease-time=8h30m31s name=DHCP-LAN-220add address-pool=POOL-VLAN10 disabled=no interface=VLAN10 lease-time=8h name=\ DHCP-VLAN10add address-pool=POOL-VLAN30 disabled=no interface=VLAN30 lease-time=8h name=\ DHCP-VLAN30/queue treeadd max-limit=100M name=MASTER_UP parent=ether1-WAN1 queue=defaultadd burst-limit=120M burst-threshold=80M burst-time=1s limit-at=4M max-limit=\ 100M name=VOIP_U packet-mark=VOIP parent=MASTER_UP priority=1 queue=\ defaultadd bucket-size=0.2 burst-limit=120M burst-threshold=80M burst-time=1s \ limit-at=4M max-limit=100M name=ACK_U packet-mark=ACK parent=MASTER_UP \ priority=2 queue=defaultadd bucket-size=0.2 burst-limit=120M burst-threshold=80M burst-time=1s \ limit-at=4M max-limit=100M name=DNS_U packet-mark=DNS parent=MASTER_UP \ priority=3 queue=defaultadd bucket-size=0.2 burst-limit=120M burst-threshold=80M burst-time=1s \ limit-at=4M max-limit=100M name=UDP_U packet-mark=UDP parent=MASTER_UP \ priority=5 queue=defaultadd bucket-size=0.2 burst-limit=120M burst-threshold=80M burst-time=1s \ limit-at=4M max-limit=100M name=ICMP_U packet-mark=ICMP parent=MASTER_UP \ priority=4 queue=defaultadd bucket-size=0.2 burst-limit=120M burst-threshold=80M burst-time=1s \ limit-at=4M max-limit=100M name=HTTP_U packet-mark=HTTP,OTHER parent=\ MASTER_UP priority=6 queue=pcq-upload-defaultadd bucket-size=0.2 burst-limit=120M burst-threshold=80M burst-time=1s \ limit-at=4M max-limit=100M name=HEAVY_U packet-mark=\ HTTP_BIG,UDP_BIG,OTHER_TCP_BIG,OTHER_BIG parent=MASTER_UP queue=\ pcq-upload-defaultadd bucket-size=0.2 burst-limit=120M burst-threshold=80M burst-time=1s \ limit-at=4M max-limit=100M name=OTHER_TCP_U packet-mark=OTHER_TCP parent=\ MASTER_UP priority=7 queue=defaultadd bucket-size=0.2 burst-limit=120M burst-threshold=50M burst-time=1s \ limit-at=4M max-limit=100M name=OTHER_U packet-mark=no-mark parent=\ MASTER_UP priority=7 queue=default/snmp communityset [ find default=yes ] addresses=0.0.0.0/0/interface bridge portadd bridge=Bridge-LAN interface=ether3-LAN-SLVadd bridge=Bridge-LAN interface=ether4-LAN-SLVadd bridge=Bridge-LAN interface=ether2-LAN-SLVadd bridge=Bridge-LAN interface=ether5-LAN-SLVadd bridge=Bridge-LAN interface=wlan2add bridge=Bridge-LAN interface=wlan1/ip neighbor discovery-settingsset discover-interface-list=WAN/ip settingsset rp-filter=strict tcp-syncookies=yes/interface l2tp-server serverset authentication=mschap1,mschap2 caller-id-type=number max-sessions=2 \ use-ipsec=required/interface list memberadd interface=ether1-WAN1 list=WANadd interface=Bridge-LAN list=LANadd interface=VLAN10 list=VLANadd interface=VLAN30 list=VLAN/ip addressadd address=192.168.2.254/24 interface=ether3-LAN-SLV network=192.168.2.0add address=192.168.10.1/23 interface=VLAN10 network=192.168.10.0add address=192.168.30.1/23 interface=VLAN30 network=192.168.30.0/ip dhcp-clientadd dhcp-options=hostname,clientid disabled=no interface=ether1-WAN1/ip dhcp-server networkadd address=192.168.2.0/24 dns-server=192.168.2.254 gateway=192.168.2.254add address=192.168.10.0/23 dns-server=8.8.8.8 gateway=192.168.10.1add address=192.168.30.0/23 dns-server=8.8.8.8 gateway=192.168.30.1/ip dnsset allow-remote-requests=yes cache-max-ttl=1d servers=8.8.8.8/ip firewall address-listadd address=0.0.0.0/8 comment="Self-Identification [RFC 3330]" list=NemIPadd address=10.0.0.0/8 comment="Private[RFC 1918] - CLASS A # Check if you nee\ d this subnet before enable it" list=NemIPadd address=127.0.0.0/8 comment="Loopback [RFC 3330]" list=NemIPadd address=169.254.0.0/16 comment="Link Local [RFC 3330]" list=NemIPadd address=172.16.0.0/12 comment="Private[RFC 1918] - CLASS B # Check if you \ need this subnet before enable it" list=NemIPadd address=192.168.0.0/16 comment="Private[RFC 1918] - CLASS C # Check if you\ \_need this subnet before enable it" disabled=yes list=NemIPadd address=192.0.2.0/24 comment="Reserved - IANA - TestNet1" list=NemIPadd address=192.88.99.0/24 comment="6to4 Relay Anycast [RFC 3068]" list=NemIPadd address=198.18.0.0/15 comment="NIDB Testing" list=NemIPadd address=198.51.100.0/24 comment="Reserved - IANA - TestNet2" list=NemIPadd address=203.0.113.0/24 comment="Reserved - IANA - TestNet3" list=NemIPadd address=224.0.0.0/4 comment=\ "MC, Class D, IANA # Check if you need this subnet before enable it" \ list=NemIPadd address=255.255.255.255 list=NemIP/ip firewall filteradd action=drop chain=input comment="DNS tilt\E1sa kintr\F5l" dst-port=53 \ in-interface-list=WAN protocol=udpadd action=accept chain=input comment=\ "defconf: accept established,related,untracked" connection-state=\ established,related,untrackedadd action=drop chain=input comment="defconf: drop invalid" connection-state=\ invalidadd action=accept chain=input comment="defconf: accept ICMP" protocol=icmpadd action=drop chain=input comment="defconf: drop all not coming from LAN" \ in-interface-list=!LANadd action=accept chain=forward comment="defconf: accept in ipsec policy" \ ipsec-policy=in,ipsecadd action=accept chain=forward comment="defconf: accept out ipsec policy" \ ipsec-policy=out,ipsecadd action=fasttrack-connection chain=forward comment="defconf: fasttrack" \ connection-state=established,relatedadd action=accept chain=forward comment=\ "defconf: accept established,related, untracked" connection-state=\ established,related,untrackedadd action=drop chain=forward comment="defconf: drop invalid" \ connection-state=invalidadd action=drop chain=forward comment=\ "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \ connection-state=new in-interface-list=WANadd action=fasttrack-connection chain=forward connection-state=\ established,relatedadd action=accept chain=forward connection-state=established,relatedadd action=drop chain=input comment=\ "DROP minden olyan csoamg ami nem tartozik a routerhez" dst-address-type=\ !localadd action=drop chain=input comment="DROP invalid" connection-state=invalidadd action=drop chain=forward comment="DROP az internetr\F5l \E9rkez\F5 \FAj k\ apcsolatokat, amelyek nem a DNS-NAT-ok" connection-nat-state=!dstnat \ connection-state=new in-interface-list=WANadd action=drop chain=forward comment="VLAN tiltasa a belso halozat fel\E9" \ dst-address=192.168.2.0/24 in-interface-list=VLANadd action=add-src-to-address-list address-list=Port_Scanner \ address-list-timeout=9w2d23h22m21s chain=input comment=\ "Port Scanner Detect" protocol=tcp psd=21,3s,3,1add action=add-src-to-address-list address-list=Port_Scanner \ address-list-timeout=none-dynamic chain=input comment=\ "Port Scanner Detect UDP" protocol=udp psd=21,3s,3,1 src-port=!53add action=add-src-to-address-list address-list=Port_Scanner \ address-list-timeout=30m chain=input comment=\ "Add Syn Flood IP to the list" connection-limit=30,32 protocol=tcp \ tcp-flags=syn/ip firewall natadd action=masquerade chain=srcnat comment="defconf: masquerade" disabled=yes \ ipsec-policy=out,none out-interface-list=WANadd action=masquerade chain=srcnat comment="Fix ip engedelyezes p\E9lda" \ disabled=yes out-interface-list=WAN src-address=192.168.2.1add action=masquerade chain=srcnat out-interface-list=WAN src-address=\ 192.168.2.0/24add action=masquerade chain=srcnat out-interface-list=WAN src-address=\ 192.168.10.0/23add action=masquerade chain=srcnat out-interface-list=WAN src-address=\ 192.168.30.0/23/ip firewall rawadd action=drop chain=prerouting dst-port=53 in-interface-list=WAN protocol=\ udpadd action=drop chain=prerouting comment="Port Scan DROP" src-address-list=\ Port_Scanneradd action=drop chain=prerouting comment="Src NemIP DROP" src-address-list=\ NemIPadd action=drop chain=prerouting comment="Dsc NemIP DROP" dst-address-list=\ NemIP/ip firewall service-portset ftp disabled=yesset tftp disabled=yesset irc disabled=yesset h323 disabled=yesset sip disabled=yesset pptp disabled=yesset udplite disabled=yesset dccp disabled=yesset sctp disabled=yes/ip serviceset telnet disabled=yesset ftp disabled=yesset www disabled=yesset ssh disabled=yesset api disabled=yesset api-ssl disabled=yes/ipv6 firewall rawadd action=drop chain=preroutingadd action=drop chain=output/system clockset time-zone-name=Europe/Budapest/system identityset name=utvalaszto/system ntp clientset enabled=yes primary-ntp=193.225.190.4 secondary-ntp=193.225.190.6/system ntp serverset enabled=yes/system routerboard settingsset silent-boot=no/tool bandwidth-serverset authenticate=no enabled=no