Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
The Mikrotik RouterOS config, tips and tricks thread
Options
Comments
-
-
-
-
-
-
Advertisement
-
-
-
-
-
-
Advertisement
-
-
-
-
-
-
-
-
-
-
Thanks for that, have made those necessary changes. Below is my export compact output. Went a bit made on the firewall filters!!!
Still no luck with the WOL over the internet. Think I'm using the tool sniffer correctly, but see nothing coming in for udp port 9? I'm sure I've something wrong.
Also had to disable the hairpin rule, should that be expected?
Forgive all the queries, but is a bit of a learning curve
# nov/27/2013 00:13:47 by RouterOS 6.6 # software id = 4X3Q-QATT # /interface bridge add admin-mac=00:0C:42:B7:XX:XX auto-mac=no l2mtu=1598 name=bridge-local \ protocol-mode=rstp /interface wireless set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=\ 20/40mhz-ht-above disabled=no distance=indoors frequency=2437 \ ht-rxchains=0,1 ht-txchains=0,1 l2mtu=2290 mode=ap-bridge ssid=\ SSID wireless-protocol=802.11 /interface ethernet set [ find default-name=ether1 ] name=ether1-gateway set [ find default-name=ether2 ] name=ether2-master-local set [ find default-name=ether3 ] master-port=ether2-master-local name=\ ether3-slave-local set [ find default-name=ether4 ] master-port=ether2-master-local name=\ ether4-slave-local set [ find default-name=ether5 ] master-port=ether2-master-local name=\ ether5-slave-local /ip neighbor discovery set wlan1 discover=no /interface wireless security-profiles set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\ dynamic-keys wpa-pre-shared-key=XXX wpa2-pre-shared-key=\ XXX /ip hotspot user profile set [ find default=yes ] idle-timeout=none keepalive-timeout=2m \ mac-cookie-timeout=3d /ip pool add name=dhcp ranges=192.168.61.9-192.168.61.254 /ip dhcp-server add address-pool=dhcp disabled=no interface=bridge-local name=default /system logging action set 0 memory-lines=100 set 1 disk-lines-per-file=100 /interface bridge port add bridge=bridge-local interface=ether2-master-local add bridge=bridge-local interface=wlan1 /ip address add address=192.168.61.1/24 comment="default configuration" interface=\ bridge-local network=192.168.61.0 /ip dhcp-client add comment="default configuration" dhcp-options=hostname,clientid disabled=\ no interface=ether1-gateway /ip dhcp-server lease add address=192.168.61.9 client-id=1:0:25:90:c:53:1c mac-address=\ 00:25:90:0C:XX:XX server=default add address=192.168.61.10 client-id=1:0:f:b5:db:84:17 mac-address=\ 00:0F:B5:DB:XX:XX server=default /ip dhcp-server network add address=192.168.61.0/24 comment="default configuration" dns-server=\ 192.168.61.1 gateway=192.168.61.1 netmask=24 /ip dns set allow-remote-requests=yes cache-size=4096KiB max-udp-packet-size=512 \ servers=89.101.160.5,89.101.160.4 /ip dns static add address=192.168.61.1 name=router /ip firewall filter add chain=input comment="default configuration" protocol=icmp add chain=input comment="default configuration" connection-state=established add chain=input comment="default configuration" connection-state=related add action=drop chain=input comment="default configuration" disabled=yes \ in-interface=ether1-gateway add chain=forward comment="default configuration" connection-state=\ established add chain=forward comment="default configuration" connection-state=related add action=drop chain=forward comment="default configuration" \ connection-state=invalid add chain=input comment="allow ICMP" protocol=icmp add chain=input comment="allow winbox" dst-port=8291 protocol=tcp add chain=input comment="allow api" dst-port=8728 protocol=tcp add action=add-src-to-address-list address-list=trying_to_login \ address-list-timeout=1d chain=input comment=\ "list IP's who try remote login" dst-port=20-23 protocol=tcp add action=drop chain=input comment="drop ssh brute forcers" dst-port=22 \ protocol=tcp src-address-list=ssh_blacklist add action=add-src-to-address-list address-list=ssh_blacklist \ address-list-timeout=1w3d chain=input connection-state=new dst-port=22 \ protocol=tcp src-address-list=ssh_stage3 add action=add-src-to-address-list address-list=ssh_stage3 \ address-list-timeout=1h chain=input connection-state=new dst-port=22 \ protocol=tcp src-address-list=ssh_stage2 add action=add-src-to-address-list address-list=ssh_stage2 \ address-list-timeout=1h chain=input connection-state=new dst-port=22 \ protocol=tcp src-address-list=ssh_stage1 add action=add-src-to-address-list address-list=ssh_stage1 \ address-list-timeout=1h chain=input connection-state=new dst-port=22 \ protocol=tcp add chain=input comment="allow ssh" dst-port=22 protocol=tcp add chain=input comment="accept vpn" dst-port=1723 in-interface=\ ether1-gateway protocol=tcp add chain=input comment="accept vpn gre" in-interface=ether1-gateway \ protocol=gre add action=drop chain=input comment="drop ftp" dst-port=21 protocol=tcp add action=drop chain=forward comment="drop invalid connections" \ connection-state=invalid add chain=forward comment="allow already established connections" \ connection-state=established add chain=forward comment="allow related connections" connection-state=\ related add action=drop chain=input comment="drop Invalid connections" \ connection-state=invalid add chain=input comment="allow established connections" connection-state=\ established add chain=input comment="acccept lan" in-interface=!ether1-gateway \ src-address=192.168.61.0/24 add action=drop chain=input comment="drop everything else" /ip firewall nat add action=masquerade chain=srcnat comment="default configuration" \ out-interface=ether1-gateway add action=dst-nat chain=dstnat comment=\ "tcp from port 443 to 443 (lan ip 192.168.61.9)" dst-port=443 \ in-interface=ether1-gateway protocol=tcp to-addresses=192.168.61.9 \ to-ports=443 add action=dst-nat chain=dstnat comment="WOL WHS" \ dst-port=9 port="" protocol=udp to-addresses=\ 192.168.61.255 to-ports=9 add action=masquerade chain=srcnat comment="hairpin nat rule" disabled=yes \ dst-address=192.168.61.9 src-address=192.168.61.0/24 to-addresses=0.0.0.0 /ip service set www disabled=yes set api disabled=yes /ip upnp set allow-disable-external-interface=no enabled=yes show-dummy-rule=no /ip upnp interfaces add interface=bridge-local type=internal add interface=ether1-gateway type=external /system leds set 0 interface=wlan1 /system ntp client set enabled=yes mode=unicast primary-ntp=140.203.204.77 /system scheduler add interval=4w2d name="backup config" on-event=\ "/system script run backup\r\ \n" policy=\ ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive,api \ start-time=startup /system script add name=backup policy=\ ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive,api \ source="/export file=([/system identity get name] . \"-\" . \\\ \n[:pick [/system clock get date] 7 11] . [:pick [/system clock get date] \ 0 3] . [:pick [/system clock get date] 4 6]); \\\ \n/tool e-mail send to=\"address@email.com\" subject=([/system identity g\ et name] . \" Backup \" . \\\ \n[/system clock get date]) file=([/system identity get name] . \"-\" . [:\ pick [/system clock get date] 7 11] . \\\ \n[:pick [/system clock get date] 0 3] . [:pick [/system clock get date] 4\ \_6] . \".rsc\"); :delay 10; \\\ \n/file rem [/file find name=([/system identity get name] . \"-\" . [:pick\ \_[/system clock get date] 7 11] . \\\ \n[:pick [/system clock get date] 0 3] . [:pick [/system clock get date] 4\ \_6] . \".rsc\")]; \\\ \n:log info (\"System Backup emailed at \" . [/sys cl get time] . \" \" . \ [/sys cl get date])" /tool e-mail set address=173.194.66.108 from=<>MikroTik@gmail.com.com password=\ pwd port=465 start-tls=yes user=address@email.com /tool mac-server set [ find default=yes ] disabled=yes add interface=ether2-master-local add interface=ether3-slave-local add interface=ether4-slave-local add interface=ether5-slave-local add interface=wlan1 add interface=bridge-local /tool mac-server mac-winbox set [ find default=yes ] disabled=yes add interface=ether2-master-local add interface=ether3-slave-local add interface=ether4-slave-local add interface=ether5-slave-local add interface=wlan1 add interface=bridge-local0 -
Advertisement
-
-
-
-
-
-
-
-
-
-
Advertisement
-
Advertisement