API tools faq
paste
Advertisement
Mike057

RB5009UG+S+

Mike057
May 20th, 2024
106
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 7.33 KB | Source Code | 0 0
raw download clone embed print report
  1. # may/19/2024 22:13:23 by RouterOS 7.8
  2. # software id = 1LQN-EFTV
  3. #
  4. # model = RB5009UG+S+
  5. /interface bridge
  6. add ingress-filtering=no name=bridge1 vlan-filtering=yes
  7. /interface ethernet
  8. set [ find default-name=ether1 ] name="ether1[2.5G LAN]"
  9. set [ find default-name=ether2 ] name="ether2[MGM]"
  10. set [ find default-name=ether3 ] name="ether3[temp WAN]"
  11. set [ find default-name=ether4 ] name="ether4[IPCAM]"
  12. set [ find default-name=ether5 ] name="ether5[WIFI]"
  13. set [ find default-name=ether6 ] name="ether6[TV]"
  14. set [ find default-name=ether7 ] name="ether7[PRINTERS]"
  15. set [ find default-name=ether8 ] name="ether8[WAN]"
  16. /interface vlan
  17. add interface=bridge1 name=GUEST vlan-id=900
  18. add interface=bridge1 name=IPCAM vlan-id=40
  19. add interface=bridge1 name=LAN vlan-id=10
  20. add interface=bridge1 name=MANAGEMENT vlan-id=90
  21. add interface="ether8[WAN]" name=O2 vlan-id=848
  22. add interface=bridge1 name=PRINTERS vlan-id=30
  23. add interface=bridge1 name=SERVERS vlan-id=20
  24. add interface=bridge1 name=TV vlan-id=50
  25. /interface pppoe-client
  26. add add-default-route=yes disabled=no interface=O2 max-mru=1492 max-mtu=1492 \
  27. name=pppoe-out1 user=cetin
  28. /interface wireless security-profiles
  29. set [ find default=yes ] supplicant-identity=MikroTik
  30. /ip pool
  31. add name=dhcp_pool10 ranges=192.168.10.100-192.168.10.254
  32. add name=dhcp_pool11 ranges=192.168.20.100-192.168.20.254
  33. add name=dhcp_pool12 ranges=192.168.30.100-192.168.30.254
  34. add name=dhcp_pool13 ranges=192.168.90.100-192.168.90.254
  35. add name=dhcp_pool14 ranges=192.168.10.100-192.168.10.254
  36. add name=dhcp_pool15 ranges=192.168.40.100-192.168.40.254
  37. add name=dhcp_pool16 ranges=192.168.50.100-192.168.50.254
  38. add name=dhcp_pool17 ranges=192.168.20.100-192.168.20.254
  39. add name=dhcp_pool18 ranges=10.0.1.2-10.0.1.254
  40. /ip dhcp-server
  41. add address-pool=dhcp_pool12 interface=PRINTERS lease-time=2h name=dhcp3
  42. add address-pool=dhcp_pool13 interface=MANAGEMENT lease-time=2h name=dhcp4
  43. add address-pool=dhcp_pool14 interface=LAN lease-time=2h name=dhcp1
  44. add address-pool=dhcp_pool15 interface=IPCAM lease-time=2h name=dhcp2
  45. add address-pool=dhcp_pool16 interface=TV lease-time=2h name=dhcp5
  46. add address-pool=dhcp_pool17 interface=SERVERS lease-time=2h name=dhcp6
  47. add address-pool=dhcp_pool18 interface=GUEST lease-time=2h name=dhcp7
  48. /interface bridge port
  49. add bridge=bridge1 interface="ether2[MGM]" pvid=90
  50. add bridge=bridge1 interface="ether4[IPCAM]" pvid=40
  51. add bridge=bridge1 interface="ether5[WIFI]" pvid=10
  52. add bridge=bridge1 interface="ether6[TV]" pvid=20
  53. add bridge=bridge1 interface="ether7[PRINTERS]" pvid=30
  54. add bridge=bridge1 interface=sfp-sfpplus1 pvid=10
  55. add bridge=bridge1 interface="ether1[2.5G LAN]" pvid=10
  56. /ip neighbor discovery-settings
  57. set discover-interface-list=!dynamic
  58. /ipv6 settings
  59. set disable-ipv6=yes
  60. /interface bridge vlan
  61. add bridge=bridge1 tagged=sfp-sfpplus1,bridge1 vlan-ids=20
  62. add bridge=bridge1 tagged="sfp-sfpplus1,bridge1,ether5[WIFI]" untagged=\
  63. "ether1[2.5G LAN]" vlan-ids=10
  64. add bridge=bridge1 tagged=sfp-sfpplus1,bridge1 untagged="ether7[PRINTERS]" \
  65. vlan-ids=30
  66. add bridge=bridge1 tagged=sfp-sfpplus1,bridge1 untagged="ether4[IPCAM]" \
  67. vlan-ids=40
  68. add bridge=bridge1 tagged=sfp-sfpplus1,bridge1 untagged="ether6[TV]" vlan-ids=\
  69. 50
  70. add bridge=bridge1 tagged="sfp-sfpplus1,bridge1,ether5[WIFI]" untagged=\
  71. "ether2[MGM]" vlan-ids=90
  72. add bridge=bridge1 tagged="sfp-sfpplus1,ether5[WIFI],bridge1" vlan-ids=900
  73. /ip address
  74. add address=192.168.90.1/24 interface=MANAGEMENT network=192.168.90.0
  75. add address=192.168.10.1/24 interface=LAN network=192.168.10.0
  76. add address=192.168.20.1/24 interface=SERVERS network=192.168.20.0
  77. add address=192.168.30.1/24 interface=PRINTERS network=192.168.30.0
  78. add address=192.168.40.1/24 interface=IPCAM network=192.168.40.0
  79. add address=192.168.50.1/24 interface=TV network=192.168.50.0
  80. add address=10.0.1.1/24 interface=GUEST network=10.0.1.0
  81. /ip dhcp-client
  82. add interface="ether3[temp WAN]"
  83. /ip dhcp-server lease
  84. add address=192.168.10.10 mac-address=E8:9C:25:C3:52:0F server=dhcp1
  85. /ip dhcp-server network
  86. add address=10.0.1.0/24 dns-server=10.0.1.1 gateway=10.0.1.1
  87. add address=192.168.10.0/24 dns-server=192.168.10.1 gateway=192.168.10.1
  88. add address=192.168.20.0/24 dns-server=192.168.20.1 gateway=192.168.20.1
  89. add address=192.168.30.0/24 dns-server=192.168.30.1 gateway=192.168.30.1
  90. add address=192.168.40.0/24 dns-server=192.168.40.1 gateway=192.168.40.1
  91. add address=192.168.50.0/24 dns-server=192.168.50.1 gateway=192.168.50.1
  92. add address=192.168.90.0/24 dns-server=192.168.90.1 gateway=192.168.90.1
  93. /ip dns
  94. set allow-remote-requests=yes servers=8.8.8.8
  95. /ip firewall address-list
  96. add address=0.0.0.0/8 list=no_forward_ipv4
  97. add address=169.254.0.0/16 list=no_forward_ipv4
  98. add address=224.0.0.0/4 list=no_forward_ipv4
  99. add address=255.255.255.255 list=no_forward_ipv4
  100. add address=192.168.10.0/24 list=allowed_to_router
  101. add address=192.168.20.0/24 list=allowed_to_router
  102. add address=192.168.30.0/24 list=allowed_to_router
  103. add address=192.168.40.0/24 list=allowed_to_router
  104. add address=192.168.50.0/24 list=allowed_to_router
  105. add address=192.168.90.0/24 list=allowed_to_router
  106. add address=10.0.1.0/24 list=allowed_to_router
  107. /ip firewall filter
  108. add action=accept chain=input comment="default configuration" connection-state=\
  109. established,related
  110. add action=drop chain=input connection-state=invalid
  111. add action=accept chain=input protocol=icmp
  112. add action=accept chain=input dst-address=127.0.0.1
  113. add action=accept chain=input src-address-list=allowed_to_router
  114. add action=drop chain=input
  115. add action=fasttrack-connection chain=forward comment=fasttrack \
  116. connection-state=established,related hw-offload=yes
  117. add action=accept chain=forward comment="accept established,related, untracked" \
  118. connection-state=established,related,untracked
  119. add action=drop chain=forward comment="drop invalid" connection-state=invalid
  120. # pppoe-out1 not ready
  121. add action=drop chain=forward comment="drop all from WAN not DSTNATed" \
  122. connection-nat-state=!dstnat connection-state=new in-interface=pppoe-out1
  123. add action=drop chain=forward comment="drop bad forward IPs" src-address-list=\
  124. no_forward_ipv4
  125. add action=drop chain=forward comment="drop bad forward IPs" dst-address-list=\
  126. no_forward_ipv4
  127. add action=accept chain=forward dst-address=192.168.20.10 dst-port=80 protocol=\
  128. tcp src-address=192.168.10.0/24
  129. add action=accept chain=forward dst-address=192.168.20.10 dst-port=443 \
  130. protocol=tcp src-address=192.168.10.0/24
  131. add action=accept chain=forward dst-address=192.168.20.0/24 src-address=\
  132. 192.168.10.10
  133. add action=accept chain=forward dst-address=192.168.90.0/24 src-address=\
  134. 192.168.10.10
  135. add action=drop chain=forward out-interface="!ether3[temp WAN]"
  136. /ip firewall nat
  137. # pppoe-out1 not ready
  138. add action=masquerade chain=srcnat out-interface=pppoe-out1
  139. add action=masquerade chain=srcnat out-interface="ether3[temp WAN]"
  140. add action=dst-nat chain=dstnat comment=HTTP dst-port=80 in-interface=\
  141. "ether3[temp WAN]" protocol=tcp to-addresses=192.168.20.20 to-ports=80
  142. add action=dst-nat chain=dstnat comment=HTTPS dst-port=443 in-interface=\
  143. "ether3[temp WAN]" protocol=tcp to-addresses=192.168.20.20 to-ports=443
  144. /ip service
  145. set telnet disabled=yes
  146. set ftp disabled=yes
  147. set www disabled=yes
  148. set ssh address=192.168.90.0/24
  149. set api disabled=yes
  150. set api-ssl disabled=yes
  151. /system clock
  152. set time-zone-name=Europe/Prague
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!