Не устанавливается соседство OSPF

Обсуждение ПО и его настройки
Ответить
sergey.pahomov
Сообщения: 2
Зарегистрирован: 07 апр 2020, 06:25

Здравствуйте, уважаемые форумчане!
При настройке GRE-туннелей столкнулся с такой проблемой, суть которой такова:

Есть роутер CCR1036-12G-4S в центральном офисе, с него поднимается 2 GRE-туннеля (каждый через своего провайдера, Алмател и Мегафон ) до CHR в облаке. На этих туннелях включен OSPF. И если с одним туннелем (через Алмател) всё хорошо , то со вторым (через Мегафон) - беда. OSPF не может установить отношения соседства. Причем роутер в офисе "видит" соседа CHR (он появляется на вкладке Neighbors), а вот CHR его не видит.

Дамп трафика на интерфейсе проблемного провайдера Wireshak'ом показал следующие:
видно, что приходят hello-пакеты с CHR и уходят ответные hello от CCR.
А вот в дампе с CHR входящих hello-пакетов от CCR не видно. (Дампы во вложении)

Через этого же провайдера не проходят hello-пакеты и в сторону других Микротиков на удаленных площадках. Причем если просто поменять адрес источника на первого провайдера, то всё начинает работать.

Что делали:
- пробовали отключать фаервол с обеих концов туннеля.
- выставлять дефолтные натсройки OSPF
- брали другой роутер с пустым конфигом и настраивали по-минимуму.
- пинги на мультикаст адрес 224.0.0.5 проходят через туннель.
- также проходят и обычные пинги
- пробовали включать/выключать IPSEC (даже в зашифрованном туннеле hello-пакет всё равно не доходит)
Провайдер утверждает, что у них нигде ничего не блочится.
 Конфиг CHR

Код: Выделить всё

# apr/07/2020 06:45:00 by RouterOS 6.46.4
# software id = 
#
#
#
/interface bridge
add fast-forward=no name=Loopback protocol-mode=none
/interface ethernet
set [ find default-name=ether2 ] advertise=\
    10M-half,10M-full,100M-half,100M-full,1000M-full name=WAN speed=1Gbps
set [ find default-name=ether1 ] advertise=\
    10M-half,10M-full,100M-half,100M-full,1000M-full speed=1Gbps
/interface l2tp-server
add name=l2tp-dm user=dm
add name=l2tp-expo user=expo
add name=l2tp-izobilny user=izobilny
add name=l2tp-kasimov user=kasimov
add name=l2tp-lankey user=lankey
add name=l2tp-nl user=nl
add name=l2tp-phk user=phk
add name=l2tp-rh user=rh
add name=l2tp-rhleb user=rhleb
add name=l2tp-rzp user=rzp
add disabled=yes name=l2tp-softline user=softline
/interface gre
add allow-fast-path=no clamp-tcp-mss=no ipsec-secret="\?\?\?\?\?\? \?\?\?\?!" \
    keepalive=5s,5 local-address=109.73.14.29 name=Expo-ISP1 remote-address=\
    91.188.182.82
add allow-fast-path=no ipsec-secret="\?\?\?\?\?\? \?\?\?\?!" keepalive=5s,5 \
    local-address=109.73.14.29 name=Expo-ISP2 remote-address=188.170.16.69
add allow-fast-path=no ipsec-secret= keepalive=5s,5 \
    local-address=109.73.14.29 name=KST-ISP1 remote-address=109.236.209.165
add allow-fast-path=no ipsec-secret= keepalive=5s,5 \
    local-address=109.73.14.29 name=KST-ISP2 remote-address=88.86.81.64
add allow-fast-path=no ipsec-secret= keepalive=10s,5 \
    local-address=109.73.14.29 name=PHK-ISP1 remote-address=212.152.35.60
add allow-fast-path=no keepalive=5s,5 local-address=109.73.14.29 name=\
    PHK-ISP2 remote-address=212.69.114.85
add allow-fast-path=no ipsec-secret= keepalive=5s,5 \
    local-address=109.73.14.29 name=RHLEB-ISP1 remote-address=78.31.73.148
add allow-fast-path=no ipsec-secret= keepalive=5s,5 \
    local-address=109.73.14.29 name=RHLEB-ISP2 remote-address=83.169.208.85
add allow-fast-path=no ipsec-secret= keepalive=5s,5 \
    local-address=109.73.14.29 name=RZP-ISP1 remote-address=78.31.77.23
/interface list
add exclude=dynamic name=discover
add name=LAN
add name="Tunnel interfaces"
add include="LAN,Tunnel interfaces" name="Trusted interfaces"
add name=DMZ
add name=wan-int
add name="Guest WiFi"
/ip firewall layer7-protocol
add name=social regexp="^([a-zA-Z0-9]*\\.)\?(vk\\.com|ok\\.ru|odnoklassniki|fa\
    cebook|twitter\\.com|my\\.mail\\.ru|youtube\\.com|fonbet|baltbet|baltplay|\
    ukr\\.net|ligastavok|marathon|bkfon|leonbets|bookmakers|radio|radio).*\$"
/ip ipsec policy group
set [ find default=yes ] name=group1
/ip ipsec profile
add dh-group=modp1024 name=profile_1 nat-traversal=no
add dh-group=modp1024 name=profile_2 nat-traversal=no
add dh-group=modp1024 enc-algorithm=aes-256,3des hash-algorithm=md5 name=\
    profile_3 nat-traversal=no
/ip pool
add name=vpn_pool ranges=172.19.0.2-172.19.0.200
add name=l2tp-pool ranges=192.168.20.200-192.168.20.230
/ppp profile
add change-tcp-mss=yes local-address=172.19.0.1 name=profile-l2tp \
    remote-address=vpn_pool
set *FFFFFFFE dns-server=192.168.20.10 local-address=172.20.1.1 \
    remote-address=vpn_pool
/routing ospf instance
set [ find default=yes ] redistribute-connected=as-type-1 router-id=\
    10.255.255.10
/snmp community
set [ find default=yes ] addresses=0.0.0.0/0 encryption-protocol=AES
/user group
add name=ftp policy="ftp,read,write,!local,!telnet,!ssh,!reboot,!policy,!test,\
    !winbox,!password,!web,!sniff,!sensitive,!api,!romon,!dude,!tikapp"
/ip neighbor discovery-settings
set discover-interface-list=none
/interface l2tp-server server
set default-profile=profile-l2tp enabled=yes ipsec-secret=dEt49uFT5r \
    keepalive-timeout=10 use-ipsec=yes
/interface list member
add disabled=yes interface=ether1 list=discover
add disabled=yes interface=l2tp-lankey list=discover
add disabled=yes interface=l2tp-dm list=discover
add disabled=yes interface=l2tp-phk list=discover
add disabled=yes interface=l2tp-expo list=discover
add disabled=yes interface=l2tp-kasimov list=discover
add interface=ether1 list=LAN
add interface=WAN list=wan-int
add interface=Expo-ISP1 list="Tunnel interfaces"
add interface=Expo-ISP2 list="Tunnel interfaces"
add interface=KST-ISP1 list="Tunnel interfaces"
add interface=KST-ISP2 list="Tunnel interfaces"
add interface=RHLEB-ISP1 list="Tunnel interfaces"
add interface=RHLEB-ISP2 list="Tunnel interfaces"
add interface=l2tp-dm list="Tunnel interfaces"
add interface=l2tp-expo list="Tunnel interfaces"
add interface=l2tp-izobilny list="Tunnel interfaces"
add interface=l2tp-kasimov list="Tunnel interfaces"
add interface=l2tp-lankey list="Tunnel interfaces"
add interface=l2tp-nl list="Tunnel interfaces"
add interface=l2tp-phk list="Tunnel interfaces"
add interface=l2tp-rh list="Tunnel interfaces"
add interface=l2tp-rhleb list="Tunnel interfaces"
add interface=l2tp-rzp list="Tunnel interfaces"
add interface=PHK-ISP2 list="Tunnel interfaces"
add interface=RZP-ISP1 list="Tunnel interfaces"
add interface=PHK-ISP1 list="Tunnel interfaces"
add list="Tunnel interfaces"
/interface pptp-server server
set authentication=pap,chap,mschap1,mschap2
/ip address
add address=192.168.20.6/24 comment="LAN IP" interface=ether1 network=\
    192.168.20.0
add address=109.73.14.29/24 comment="WAN IP" interface=WAN network=\
    109.73.14.0
add address=172.18.0.5/30 interface=PHK-ISP1 network=172.18.0.4
add address=10.255.255.10 interface=Loopback network=10.255.255.10
add address=172.18.0.25/30 interface=Expo-ISP1 network=172.18.0.24
add address=172.18.0.29/30 interface=Expo-ISP2 network=172.18.0.28
add address=172.18.0.65/30 interface=RHLEB-ISP1 network=172.18.0.64
add address=172.18.0.69/30 interface=RHLEB-ISP2 network=172.18.0.68
add address=172.18.0.49/30 interface=KST-ISP1 network=172.18.0.48
add address=172.18.0.53/30 interface=KST-ISP2 network=172.18.0.52
add address=172.18.0.73/30 interface=RZP-ISP1 network=172.18.0.72
add address=172.18.0.89/30 interface=PHK-ISP2 network=172.18.0.88
/ip dhcp-client
add !dhcp-options interface=ether1
/ip dns
set servers=192.168.20.10,192.168.20.9,8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.0.34 name=test-app.grain.local
/ip firewall filter
add action=accept chain=input comment=\
    "Forward and Input Established and Related connections" connection-state=\
    established,related src-address-list=""
add action=drop chain=input connection-state=invalid in-interface-list=\
    wan-int
add action=accept chain=forward connection-state=established,related
add action=drop chain=forward connection-state=invalid in-interface-list=\
    "!Tunnel interfaces" out-interface-list="!Tunnel interfaces"
add action=add-src-to-address-list address-list=ddos-blacklist \
    address-list-timeout=1d chain=input comment=\
    "DDoS Protect - Connection Limit" connection-limit=100,32 \
    in-interface-list=wan-int protocol=tcp
add action=tarpit chain=input connection-limit=3,32 protocol=tcp \
    src-address-list=ddos-blacklist
add action=jump chain=forward comment="DDoS Protect - SYN Flood" \
    connection-state=new jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add action=jump chain=input connection-state=new in-interface-list=wan-int \
    jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add action=return chain=SYN-Protect connection-state=new limit=200,5:packet \
    protocol=tcp tcp-flags=syn
add action=drop chain=SYN-Protect connection-state=new protocol=tcp \
    tcp-flags=syn
add action=drop chain=input comment="Protected - Port Scanners" \
    src-address-list="Port Scanners"
add action=add-src-to-address-list address-list="Port Scanners" \
    address-list-timeout=none-dynamic chain=input in-interface-list=wan-int \
    protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment="Protected - WinBox Access" \
    src-address-list="Black List Winbox"
add action=add-src-to-address-list address-list="Black List Winbox" \
    address-list-timeout=none-dynamic chain=input connection-state=new \
    dst-port=8291 in-interface-list=wan-int log=yes log-prefix="BLACK WINBOX" \
    protocol=tcp src-address-list="Winbox Stage 3"
add action=add-src-to-address-list address-list="Winbox Stage 3" \
    address-list-timeout=1m chain=input connection-state=new dst-port=8291 \
    in-interface-list=wan-int protocol=tcp src-address-list="Winbox Stage 2"
add action=add-src-to-address-list address-list="Winbox Stage 2" \
    address-list-timeout=1m chain=input connection-state=new dst-port=8291 \
    in-interface-list=wan-int protocol=tcp src-address-list="Winbox Stage 1"
add action=add-src-to-address-list address-list="Winbox Stage 1" \
    address-list-timeout=1m chain=input connection-state=new dst-port=8291 \
    in-interface-list=wan-int protocol=tcp
add action=accept chain=input dst-port=8291 in-interface-list=wan-int \
    protocol=tcp
add action=accept chain=input comment="Access Normal ping" in-interface-list=\
    wan-int limit=50/5s,2:packet protocol=icmp
add action=accept chain=input in-interface-list=wan-int protocol=gre
add action=accept chain=input comment="for VPN" dst-port=1701,4500 protocol=\
    udp
add action=accept chain=input dst-port=500 in-interface-list=wan-int \
    protocol=udp
add action=accept chain=input in-interface-list=wan-int protocol=ipsec-esp
add action=accept chain=forward comment="Allow DST-NAT traffic" \
    connection-nat-state=dstnat connection-state=new
add action=drop chain=forward comment=\
    "defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=wan-int
add action=reject chain=output comment="Drop custom links via PROXY" \
    dst-address-list=bad_links dst-port=80,443 log-prefix=WARNIN-SOCIAL \
    out-interface=WAN protocol=tcp reject-with=icmp-network-unreachable
add action=drop chain=forward comment="Drop custom links" dst-address-list=\
    bad_links dst-port=80,443 log-prefix=WARNIN-SOCIAL out-interface=WAN \
    protocol=tcp
add action=accept chain=forward comment="Allow access mail servers" \
    dst-address-list=lancloud
add action=accept chain=forward comment=\
    "Allow DNS request to external servers from DC" dst-port=53 \
    out-interface-list=wan-int protocol=udp src-address-list=DNS_Servers
add action=accept chain=forward dst-address-list="Reports Servers" dst-port=\
    80,443,110 protocol=tcp
add action=accept chain=forward dst-port=21,22,465,8080,38738,8443 protocol=\
    tcp
add action=accept chain=forward disabled=yes in-interface-list="Guest WiFi" \
    out-interface-list=wan-int
add action=accept chain=forward in-interface-list="Trusted interfaces" \
    out-interface-list="Trusted interfaces"
add action=accept chain=forward src-address-list=Allow_all
add action=drop chain=input comment="Drop all other packets" \
    in-interface-list=wan-int
add action=drop chain=forward
/ip firewall nat
add action=masquerade chain=srcnat out-interface=WAN src-address=\
    192.168.20.0/24
add action=dst-nat chain=dstnat disabled=yes dst-port=5000 in-interface=WAN \
    protocol=tcp to-addresses=192.168.20.20 to-ports=3389
add action=dst-nat chain=dstnat comment=Antor dst-port=5001 in-interface=WAN \
    protocol=tcp to-addresses=192.168.20.17 to-ports=3389
add action=dst-nat chain=dstnat disabled=yes dst-port=1723 in-interface=WAN \
    protocol=tcp to-addresses=192.168.20.5
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes
/ip ipsec identity
# Peer does not exist
add secret=123
# Peer does not exist
add secret=123
# Peer does not exist
add secret=123
/ip route
add comment="added by setup" distance=1 gateway=109.73.14.1
add distance=1 dst-address=5.8.180.28/32 gateway=192.168.20.1
add distance=1 dst-address=192.168.19.0/24 gateway=172.18.21.2
add comment=BAZA distance=1 dst-address=192.168.200.0/24 gateway=172.18.200.2
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/ip traffic-flow
set cache-entries=2M
/ip traffic-flow target
add dst-address=192.168.20.5 port=9996
/routing filter
add action=discard chain=ospf-in prefix=46.44.26.0/24
add action=discard chain=ospf-in prefix=212.152.35.0/24
add action=discard chain=ospf-in disabled=yes prefix=93.190.142.0/24
add action=discard chain=ospf-in prefix=80.244.233.0/24
add action=discard chain=ospf-in prefix-length=30
add action=discard chain=ospf-out prefix=109.73.14.0/24
add action=discard chain=ospf-out prefix-length=30
add action=discard chain=ospf-in prefix=176.106.144.0/24
add action=discard chain=ospf-in prefix=192.168.30.0/24
add action=discard chain=ospf-in prefix=78.31.73.144/28
add action=discard chain=ospf-in prefix=91.214.240.88/29
add action=discard chain=ospf-in prefix=78.31.77.16/28
add action=discard chain=ospf-in prefix=83.169.208.0/24
add action=discard chain=ospf-in prefix=10.1.3.45
add action=discard chain=ospf-out prefix-length=32
add action=discard chain=ospf-in prefix=10.1.2.0/24
add action=discard chain=ospf-in prefix=212.152.35.56/29
add action=discard chain=connected-in disabled=yes prefix=212.152.35.0/24
add action=discard chain=ospf-in prefix=89.108.124.0/22
add action=discard chain=ospf-in prefix=46.229.143.0/24
add action=discard chain=ospf-in prefix=10.1.3.55
add action=discard chain=ospf-in disabled=yes prefix=89.108.120.0/22
add action=discard chain=ospf-out prefix=10.1.5.0/24
add action=discard chain=ospf-out prefix=192.168.19.0/24
/routing ospf interface
add authentication=md5 authentication-key="" \
    authentication-key-id=2 cost=20 interface=Expo-ISP1 network-type=\
    point-to-point use-bfd=yes
add authentication=md5 authentication-key="" \
    authentication-key-id=2 cost=20 interface=Expo-ISP2 network-type=\
    point-to-point use-bfd=yes
add authentication=md5 authentication-key="" \
    authentication-key-id=2 cost=20 interface=RHLEB-ISP1 network-type=\
    point-to-point use-bfd=yes
add authentication=md5 authentication-key="" \
    authentication-key-id=2 cost=20 interface=RHLEB-ISP2 network-type=\
    point-to-point use-bfd=yes
add authentication=md5 authentication-key="" \
    authentication-key-id=2 cost=20 interface=KST-ISP1 network-type=\
    point-to-point use-bfd=yes
add authentication=md5 authentication-key="" \
    authentication-key-id=2 cost=20 interface=KST-ISP2 network-type=\
    point-to-point use-bfd=yes
add authentication=md5 authentication-key="" \
    authentication-key-id=2 cost=20 interface=PHK-ISP1 network-type=\
    point-to-point use-bfd=yes
add authentication=md5 authentication-key="" \
    authentication-key-id=2 cost=20 interface=RZP-ISP1 network-type=\
    point-to-point use-bfd=yes
add authentication=md5 authentication-key="" \
    authentication-key-id=2 cost=20 interface=PHK-ISP2 network-type=\
    point-to-point
/routing ospf network
add area=backbone comment=PHK1 disabled=yes network=172.16.9.0/30
add area=backbone comment="TMP L2TP EXPO" network=172.20.2.0/30
add area=backbone comment=PHK network=172.18.0.0/30
add area=backbone comment=RZP network=172.18.6.0/30
add area=backbone comment=VD network=172.18.11.0/30
add area=backbone comment=video network=172.18.10.0/30
add area=backbone comment=Lankey network=172.18.21.0/30
add area=backbone comment=DM network=172.18.7.0/30
add area=backbone comment=Kasimov network=172.18.13.0/30
add area=backbone comment=Lankey network=172.18.22.0/30
add area=backbone network=172.18.23.0/30
add area=backbone comment=Izobilny network=172.18.9.0/30
add area=backbone network=172.18.0.0/24
/snmp
set enabled=yes location=vpc trap-generators=temp-exception,temp-exception \
    trap-version=2
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=croc-gw-grain
/system logging
set 0 action=disk
set 1 action=disk
set 2 action=disk
set 3 action=disk
add action=echo disabled=yes topics=bfd
add action=disk disabled=yes topics=ospf
/system ntp client
set enabled=yes primary-ntp=192.168.20.10 secondary-ntp=192.168.20.15
 Конфиг CCR

Код: Выделить всё

# apr/07/2020 06:44:25 by RouterOS 6.46.4
# software id = RWG2-LHYN
#
# model = CCR1036-12G-4S
# serial number = 742307F9D3E2
/interface bridge
add fast-forward=no name=Loopback protocol-mode=none
add name=astue
/interface ethernet
set [ find default-name=ether1 ] name=CIFRA1-wan-ether1 speed=100Mbps
set [ find default-name=ether2 ] speed=100Mbps
set [ find default-name=ether3 ] speed=100Mbps
set [ find default-name=ether4 ] name=ether4-master-lan speed=100Mbps
set [ find default-name=ether5 ] name=ether5-bitpbx speed=100Mbps
set [ find default-name=ether6 ] speed=100Mbps
set [ find default-name=ether7 ] speed=100Mbps
set [ find default-name=ether8 ] speed=100Mbps
set [ find default-name=ether9 ] speed=100Mbps
set [ find default-name=ether10 ] speed=100Mbps
set [ find default-name=ether11 ] speed=100Mbps
set [ find default-name=ether12 ] speed=100Mbps
set [ find default-name=sfp1 ] advertise=10M-full,100M-full,1000M-full name=\
    sfp1-wan-megafon
set [ find default-name=sfp2 ] advertise=10M-full,100M-full,1000M-full
set [ find default-name=sfp3 ] advertise=10M-full,100M-full,1000M-full
set [ find default-name=sfp4 ] advertise=10M-full,100M-full,1000M-full
/interface l2tp-client
add allow-fast-path=yes connect-to=109.73.14.29 name=l2tp-croc password=\
     user=phk
add allow-fast-path=yes connect-to=vpn.grainholding.ru name=l2tp-croc-reserve \
    password= user=phk
/interface gre
add allow-fast-path=no ipsec-secret= keepalive=10s,5 \
    local-address=212.152.35.60 name=CROC-ISP1 remote-address=109.73.14.29
add allow-fast-path=no keepalive=5s,5 local-address=212.69.114.85 name=\
    CROC-ISP2 remote-address=109.73.14.29
add allow-fast-path=no comment="GRE to KST" ipsec-secret= \
    keepalive=5s,5 local-address=212.152.35.60 name=KST-ISP1 remote-address=\
    109.236.209.165
add allow-fast-path=no disabled=yes ipsec-secret= keepalive=\
    5s,5 local-address=212.69.114.85 name=KST-ISP2 remote-address=88.86.81.64
add allow-fast-path=no comment="GRE to RHLEB" ipsec-secret= \
    keepalive=5s,5 local-address=212.152.35.60 name=RHLEB-ISP1 \
    remote-address=78.31.73.148
add allow-fast-path=no keepalive=5s,5 local-address=212.69.114.85 name=\
    RHLEB-ISP2 remote-address=83.169.208.85
/interface vlan
add interface=ether4-master-lan name=vlan-callcentr-103 vlan-id=103
add interface=ether4-master-lan name=vlan-grain-guest-3 vlan-id=3
add interface=ether4-master-lan name=vlan-grain-wifi-4 vlan-id=4
add interface=ether4-master-lan name=vlan-phk-guest-102 vlan-id=102
add interface=ether4-master-lan name=vlan-rarus-wifi vlan-id=5
add interface=ether4-master-lan name=vlan-video vlan-id=101
add disabled=yes interface=sfp1-wan-megafon name=vlan1 vlan-id=1
add interface=ether4-master-lan name=vlan_astue vlan-id=105
/interface list
add name=wan-list
add name=wan-int
add name=corp-tun
add name=lan-int
add name=LAN
add name="Tunnel interfaces"
add include="LAN,Tunnel interfaces" name="Trusted interfaces"
add name="Guest WiFi"
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/port
set 2 baud-rate=9600 data-bits=8 flow-control=none name=usb3 parity=none \
    stop-bits=1
set 3 name=usb4
/ppp profile
add change-tcp-mss=yes name=profile1
/queue tree
add max-limit=150M name=In parent=global
add max-limit=150M name=Out parent=global
add max-limit=100M name=GRE_out packet-mark=gre_out parent=Out priority=3
/queue type
add kind=pcq name=SIP pcq-classifier=\
    src-address,dst-address,src-port,dst-port pcq-dst-address6-mask=64 \
    pcq-rate=128k pcq-src-address6-mask=64
/queue tree
add max-limit=100M name=GRE_in packet-mark=gre_in parent=In priority=3 queue=\
    pcq-download-default
add limit-at=250k max-limit=40M name=VPN_RDP_in packet-mark=vpn_rdp_in \
    parent=GRE_in priority=3 queue=pcq-download-default
add limit-at=128k max-limit=40M name=VPN_RDP_out packet-mark=vpn_rdp_out \
    parent=GRE_out priority=3 queue=pcq-upload-default
add max-limit=75M name=Web_in packet-mark=web_in parent=In priority=5 queue=\
    pcq-download-default
add max-limit=75M name=Web_out packet-mark=web_out parent=Out priority=5 \
    queue=pcq-upload-default
add max-limit=20M name=SIP_in packet-mark=sip_in parent=In priority=1 queue=\
    SIP
add max-limit=20M name=SIP_out packet-mark=sip_out parent=Out priority=1 \
    queue=SIP
add max-limit=30M name=Mail_in packet-mark=mail_in parent=In priority=5 \
    queue=pcq-download-default
add max-limit=30M name=Mail_out packet-mark=mail_out parent=Out priority=5 \
    queue=pcq-upload-default
add max-limit=2M name=DNS_in packet-mark=dns_in parent=In priority=2 queue=\
    pcq-download-default
add max-limit=2M name=DNS_out packet-mark=dns_out parent=Out priority=2 \
    queue=pcq-upload-default
add max-limit=25M name=ALL_in packet-mark=all_in parent=In queue=\
    pcq-download-default
add max-limit=30M name=ALL_out packet-mark=all_out parent=Out queue=\
    pcq-upload-default
add max-limit=20M name=VPN_Web_in packet-mark=vpn_web_in parent=GRE_in \
    priority=5 queue=pcq-download-default
add max-limit=20M name=VPN_Web_out packet-mark=vpn_web_out parent=GRE_out \
    priority=5 queue=pcq-upload-default
add max-limit=10M name=VPN_SIP_in packet-mark=vpn_sip_in parent=GRE_in \
    priority=1 queue=SIP
add max-limit=10M name=VPN_SIP_out packet-mark=vpn_sip_out parent=GRE_out \
    priority=1 queue=SIP
add max-limit=2M name=VPN_DNS_in packet-mark=vpn_dns_in parent=GRE_in \
    priority=4 queue=pcq-download-default
add max-limit=2M name=VPN_DNS_out packet-mark=vpn_dns_out parent=GRE_out \
    priority=4 queue=pcq-upload-default
add max-limit=5M name=VPN_ALL_in packet-mark=vpn_all_in parent=GRE_in queue=\
    pcq-download-default
add max-limit=25M name=VPN_ALL_out packet-mark=vpn_all_out parent=GRE_out \
    queue=pcq-upload-default
add max-limit=2M name=VPN_Winbox_in packet-mark=vpn_winbox_in parent=GRE_in \
    priority=5 queue=pcq-download-default
add max-limit=2M name=VPN_Winbox_out packet-mark=vpn_winbox_out parent=\
    GRE_out priority=5 queue=pcq-upload-default
add max-limit=5M name=VPN_LM_in packet-mark=vpn_lm_in parent=GRE_in priority=\
    4 queue=pcq-download-default
add max-limit=5M name=VPN_LM_out packet-mark=vpn_lm_out parent=GRE_out \
    priority=4 queue=pcq-upload-default
add max-limit=40M name=VPN_SMB_in packet-mark=vpn_smb_in parent=GRE_in \
    priority=6 queue=pcq-download-default
add max-limit=40M name=VPN_SMB_out packet-mark=vpn_smb_out parent=GRE_out \
    priority=6 queue=pcq-upload-default
add max-limit=35M name=VPN_Video_in packet-mark=vpn_video_in parent=GRE_in \
    priority=2 queue=pcq-download-default
add max-limit=30M name=VPN_Video_out packet-mark=vpn_video_out parent=GRE_out \
    priority=2 queue=pcq-upload-default
add max-limit=20M name=VPN_1C_in packet-mark=vpn_1c_in parent=GRE_in \
    priority=3 queue=pcq-download-default
add max-limit=20M name=VPN_1C_out packet-mark=vpn_1c_out parent=GRE_out \
    priority=3 queue=pcq-upload-default
add max-limit=10M name=VPN_ZBX_in packet-mark=vpn_zbx_in parent=GRE_in \
    priority=4 queue=pcq-download-default
add max-limit=10M name=VPN_ZBX_out packet-mark=vpn_zbx_out parent=GRE_out \
    priority=4 queue=pcq-upload-default
/routing ospf instance
set [ find default=yes ] redistribute-connected=as-type-1 router-id=\
    10.255.255.3
/interface bridge port
add bridge=astue interface=vlan_astue
add bridge=astue hw=no interface=ether6
/ip firewall connection tracking
set enabled=yes
/ip neighbor discovery-settings
set discover-interface-list=lan-int
/interface list member
add interface=sfp1-wan-megafon list=wan-int
add interface=CIFRA1-wan-ether1 list=wan-int
add interface=ether4-master-lan list=lan-int
add interface=l2tp-croc list=corp-tun
add interface=vlan-grain-guest-3 list="Guest WiFi"
add interface=vlan-phk-guest-102 list="Guest WiFi"
add interface=vlan-rarus-wifi list="Guest WiFi"
add interface=vlan-grain-wifi-4 list="Guest WiFi"
add interface=ether4-master-lan list=LAN
add interface=l2tp-croc list="Tunnel interfaces"
add interface=CROC-ISP2 list="Tunnel interfaces"
add interface=CROC-ISP1 list="Tunnel interfaces"
add interface=vlan-video list=LAN
add interface=vlan_astue list=LAN
add interface=vlan-callcentr-103 list=LAN
add interface=KST-ISP1 list="Tunnel interfaces"
add interface=KST-ISP2 list="Tunnel interfaces"
add interface=RHLEB-ISP1 list="Tunnel interfaces"
add interface=RHLEB-ISP2 list="Tunnel interfaces"
/ip address
add address=212.152.35.60/29 comment=wan-cifra1 interface=CIFRA1-wan-ether1 \
    network=212.152.35.56
add address=192.168.0.1/24 interface=ether4-master-lan network=192.168.0.0
add address=10.1.4.1/24 interface=vlan-grain-wifi-4 network=10.1.4.0
add address=192.168.30.1/24 comment="swith admin" disabled=yes interface=\
    ether4-master-lan network=192.168.30.0
add address=10.1.1.1/24 interface=vlan-grain-guest-3 network=10.1.1.0
add address=212.69.114.85/30 comment=wan-megafon interface=sfp1-wan-megafon \
    network=212.69.114.84
add address=192.168.3.1/24 interface=vlan-callcentr-103 network=192.168.3.0
add address=192.168.0.87/24 interface=ether4-master-lan network=192.168.0.0
add address=192.168.100.1/24 interface=vlan-video network=192.168.100.0
add address=192.168.105.1/24 interface=vlan_astue network=192.168.105.0
add address=192.168.5.250/24 interface=ether4-master-lan network=192.168.5.0
add address=10.1.2.1/24 interface=vlan-phk-guest-102 network=10.1.2.0
add address=192.168.10.19/24 disabled=yes interface=vlan-video network=\
    192.168.10.0
add address=192.168.30.1 interface=ether4-master-lan network=192.168.30.1
add address=10.1.5.1/24 interface=vlan-rarus-wifi network=10.1.5.0
add address=10.255.255.3 interface=Loopback network=10.255.255.3
add address=172.18.0.6/30 interface=CROC-ISP1 network=172.18.0.4
add address=172.18.0.9/30 interface=KST-ISP1 network=172.18.0.8
add address=172.18.0.13/30 interface=KST-ISP2 network=172.18.0.12
add address=172.18.0.17/30 interface=RHLEB-ISP1 network=172.18.0.16
add address=172.18.0.21/30 interface=RHLEB-ISP2 network=172.18.0.20
add address=212.152.35.58/29 interface=CIFRA1-wan-ether1 network=\
    212.152.35.56
add address=172.18.0.90/30 interface=CROC-ISP2 network=172.18.0.88
/ip cloud
set ddns-enabled=yes
/ip dhcp-relay
add dhcp-server=192.168.0.12,192.168.20.97 disabled=no interface=\
    vlan-grain-guest-3 local-address=10.1.1.1 name=grain_wifi_guest_relay
add dhcp-server=192.168.0.12,192.168.20.97 disabled=no interface=\
    vlan-grain-wifi-4 local-address=10.1.4.1 name=Grain2_WiFi_relay
add dhcp-server=192.168.0.12,192.168.20.97 disabled=no interface=\
    vlan-phk-guest-102 local-address=10.1.2.1 name=PHK_guest_WiFi_relay
add delay-threshold=10s dhcp-server=192.168.20.97 disabled=no interface=\
    ether4-master-lan local-address=192.168.0.1 name=LAN_relay_standby
add dhcp-server=192.168.0.12,192.168.20.97 disabled=no interface=\
    vlan-rarus-wifi name=rarus_wifi_relay
/ip dhcp-server network
add address=10.1.1.0/24 dns-server=10.1.1.1 gateway=10.1.1.1
add address=10.1.2.0/24 dns-server=10.1.2.1 gateway=10.1.2.1
add address=10.1.4.0/24 dns-server=10.1.4.1 gateway=10.1.4.1
/ip dns
set allow-remote-requests=yes servers=\
    8.8.8.8,8.8.4.4,192.168.20.10,192.168.0.65
/ip firewall filter
add action=accept chain=input comment=\
    "Forward and Input Established and Related connections" connection-state=\
    established,related src-address-list=""
add action=drop chain=input connection-state=invalid in-interface-list=\
    wan-int
add action=accept chain=forward connection-state=established,related
add action=drop chain=forward connection-state=invalid in-interface-list=\
    "!Tunnel interfaces" out-interface-list="!Tunnel interfaces"
add action=add-src-to-address-list address-list=ddos-blacklist \
    address-list-timeout=1d chain=input comment=\
    "DDoS Protect - Connection Limit" connection-limit=100,32 \
    in-interface-list=wan-int protocol=tcp
add action=tarpit chain=input connection-limit=3,32 protocol=tcp \
    src-address-list=ddos-blacklist
add action=jump chain=forward comment="DDoS Protect - SYN Flood" \
    connection-state=new jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add action=jump chain=input connection-state=new in-interface-list=wan-int \
    jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add action=return chain=SYN-Protect connection-state=new limit=200,5:packet \
    protocol=tcp tcp-flags=syn
add action=drop chain=SYN-Protect connection-state=new protocol=tcp \
    tcp-flags=syn
add action=drop chain=input comment="Protected - Port Scanners" \
    src-address-list="Port Scanners"
add action=add-src-to-address-list address-list="Port Scanners" \
    address-list-timeout=none-dynamic chain=input in-interface-list=wan-int \
    protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment="Protected - WinBox Access" \
    src-address-list="Black List Winbox"
add action=add-src-to-address-list address-list="Black List Winbox" \
    address-list-timeout=none-dynamic chain=input connection-state=new \
    dst-port=8291 in-interface-list=wan-int log=yes log-prefix="BLACK WINBOX" \
    protocol=tcp src-address-list="Winbox Stage 3"
add action=add-src-to-address-list address-list="Winbox Stage 3" \
    address-list-timeout=1m chain=input connection-state=new dst-port=8291 \
    in-interface-list=wan-int protocol=tcp src-address-list="Winbox Stage 2"
add action=add-src-to-address-list address-list="Winbox Stage 2" \
    address-list-timeout=1m chain=input connection-state=new dst-port=8291 \
    in-interface-list=wan-int protocol=tcp src-address-list="Winbox Stage 1"
add action=add-src-to-address-list address-list="Winbox Stage 1" \
    address-list-timeout=1m chain=input connection-state=new dst-port=8291 \
    in-interface-list=wan-int protocol=tcp
add action=accept chain=input dst-port=8291 in-interface-list=wan-int \
    protocol=tcp
add action=accept chain=input comment="Access Normal ping" in-interface-list=\
    wan-int limit=50/5s,2:packet protocol=icmp
add action=accept chain=input in-interface-list=wan-int protocol=gre
add action=accept chain=input dst-port=500 in-interface-list=wan-int \
    protocol=udp
add action=accept chain=input in-interface-list=wan-int protocol=ipsec-esp
add action=accept chain=forward comment="Allow DST-NAT traffic" \
    connection-nat-state=dstnat connection-state=new
add action=drop chain=forward comment=\
    "defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=wan-int
add action=accept chain=forward comment="Allow access mail servers" \
    dst-address-list=lancloud
add action=accept chain=forward in-interface-list="Guest WiFi" \
    out-interface-list=wan-int
add action=accept chain=forward in-interface-list="Trusted interfaces" \
    out-interface-list="Trusted interfaces"
add action=accept chain=forward src-address-list=Admin
add action=accept chain=forward comment=\
    "Allow only good_links for AllowINET group" dst-address-list=good_links \
    dst-port=80,443 log-prefix=229_ACCEPT out-interface-list=wan-int \
    protocol=tcp src-address-list=AllowINET
add action=accept chain=forward comment="AllowAll Inet" dst-port=80,443 \
    layer7-protocol=!social log-prefix=229_ACCEPT out-interface-list=wan-int \
    protocol=tcp src-address-list=AllowALL
add action=drop chain=input comment="Drop all other packets" \
    in-interface-list=wan-int
add action=drop chain=forward
/ip firewall mangle
add action=accept chain=prerouting dst-address=212.152.35.56/29 \
    in-interface-list=LAN
add action=accept chain=prerouting dst-address=212.69.114.84/30 \
    in-interface-list=LAN
add action=mark-connection chain=prerouting comment=\
    "Mark incoming connection for each ISP" connection-mark=no-mark \
    in-interface=CIFRA1-wan-ether1 log-prefix=cinISP1_ new-connection-mark=\
    cin_ISP1 passthrough=no
add action=mark-connection chain=prerouting connection-mark=no-mark \
    in-interface=sfp1-wan-megafon new-connection-mark=cin_ISP2 passthrough=no
add action=mark-connection chain=prerouting comment=\
    "Mark outgoing connections for load balancing" connection-mark=no-mark \
    connection-state="" disabled=yes dst-address-list=!Local \
    dst-address-type=!local in-interface-list=LAN log-prefix=load_ \
    new-connection-mark=cin_ISP1 passthrough=yes per-connection-classifier=\
    src-address:2/0
add action=mark-connection chain=prerouting connection-mark=no-mark \
    connection-state="" disabled=yes dst-address-list=!Local \
    dst-address-type=!local in-interface-list=LAN new-connection-mark=\
    cin_ISP2 passthrough=yes per-connection-classifier=src-address:2/1
add action=mark-routing chain=prerouting comment=\
    "Mark connections for routing" connection-mark=cin_ISP1 \
    in-interface-list=LAN log-prefix=rout_ new-routing-mark=rout_ISP1 \
    passthrough=yes
add action=mark-routing chain=prerouting connection-mark=cin_ISP2 \
    in-interface-list=LAN new-routing-mark=rout_ISP2 passthrough=yes
add action=mark-routing chain=output connection-mark=cin_ISP1 log-prefix=\
    output_ new-routing-mark=rout_ISP1 passthrough=yes
add action=mark-routing chain=output connection-mark=cin_ISP2 log-prefix=\
    outputISP2_ new-routing-mark=rout_ISP2 passthrough=yes
add action=mark-connection chain=prerouting comment=MAIL dst-address-list=\
    lancloud new-connection-mark=mail passthrough=no protocol=tcp
add action=mark-packet chain=forward connection-mark=mail in-interface-list=\
    wan-int new-packet-mark=mail_in passthrough=no
add action=mark-packet chain=forward connection-mark=mail new-packet-mark=\
    mail_out out-interface-list=wan-int passthrough=no
add action=mark-connection chain=input comment=GRE new-connection-mark=gre_in \
    passthrough=no protocol=gre
add action=mark-packet chain=prerouting connection-mark=gre_in \
    new-packet-mark=gre_in passthrough=no
add action=mark-connection chain=output new-connection-mark=gre_out \
    passthrough=no protocol=gre
add action=mark-packet chain=postrouting connection-mark=gre_out \
    new-packet-mark=gre_out passthrough=no
add action=mark-connection chain=prerouting comment=WEB dst-port=80,443,8080 \
    new-connection-mark=web passthrough=no protocol=tcp
add action=mark-connection chain=prerouting dst-port=80,443,8080 \
    new-connection-mark=web passthrough=no protocol=udp
add action=mark-packet chain=forward connection-mark=web in-interface-list=\
    wan-int log-prefix=web_in_ new-packet-mark=web_in passthrough=no
add action=mark-packet chain=forward connection-mark=web log-prefix=web_out_ \
    new-packet-mark=web_out out-interface-list=wan-int passthrough=no
add action=mark-packet chain=forward connection-mark=web in-interface-list=\
    "Tunnel interfaces" new-packet-mark=vpn_web_in passthrough=no
add action=mark-packet chain=forward connection-mark=web new-packet-mark=\
    vpn_web_out out-interface-list="Tunnel interfaces" passthrough=no
add action=mark-connection chain=prerouting comment=SIP dst-port=\
    4569,5060,5061,9060,10000-20000 new-connection-mark=sip passthrough=no \
    protocol=udp
add action=mark-packet chain=forward connection-mark=sip in-interface-list=\
    wan-int new-packet-mark=sip_in passthrough=no
add action=mark-packet chain=forward connection-mark=sip new-packet-mark=\
    sip_out out-interface-list=wan-int passthrough=no
add action=mark-packet chain=forward connection-mark=sip in-interface-list=\
    "Tunnel interfaces" new-packet-mark=vpn_sip_in passthrough=no
add action=mark-packet chain=forward connection-mark=sip new-packet-mark=\
    vpn_sip_out out-interface-list="Tunnel interfaces" passthrough=no
add action=mark-connection chain=prerouting comment=RDP dst-port=3389 \
    new-connection-mark=rdp passthrough=no protocol=tcp
add action=mark-connection chain=prerouting dst-port=3389 \
    new-connection-mark=rdp passthrough=no protocol=udp
add action=mark-packet chain=forward connection-mark=rdp in-interface-list=\
    wan-int new-packet-mark=rdp_in passthrough=no
add action=mark-packet chain=forward connection-mark=rdp new-packet-mark=\
    rdp_out out-interface-list=wan-int passthrough=no
add action=mark-packet chain=forward connection-mark=rdp new-packet-mark=\
    vpn_rdp_out out-interface-list="Tunnel interfaces" passthrough=no
add action=mark-packet chain=forward connection-mark=rdp in-interface-list=\
    "Tunnel interfaces" new-packet-mark=vpn_rdp_in passthrough=no
add action=mark-connection chain=prerouting comment=DNS dst-port=53 \
    new-connection-mark=dns passthrough=no protocol=udp
add action=mark-connection chain=output dst-port=53 new-connection-mark=dns \
    passthrough=no protocol=udp
add action=mark-packet chain=forward connection-mark=dns in-interface-list=\
    wan-int new-packet-mark=dns_in passthrough=no
add action=mark-packet chain=forward connection-mark=dns new-packet-mark=\
    dns_out out-interface-list=wan-int passthrough=no
add action=mark-packet chain=forward connection-mark=dns in-interface-list=\
    "Tunnel interfaces" new-packet-mark=vpn_dns_in passthrough=no
add action=mark-packet chain=forward connection-mark=dns new-packet-mark=\
    vpn_dns_out out-interface-list="Tunnel interfaces" passthrough=no
add action=mark-connection chain=prerouting comment=ZABBIX dst-port=\
    10050,10051 new-connection-mark=zbx passthrough=no protocol=tcp
add action=mark-packet chain=forward connection-mark=zbx in-interface-list=\
    "Tunnel interfaces" new-packet-mark=vpn_zbx_in passthrough=no
add action=mark-packet chain=forward connection-mark=zbx new-packet-mark=\
    vpn_zbx_out out-interface-list="Tunnel interfaces" passthrough=no
add action=mark-connection chain=prerouting comment=1C dst-port=\
    1433,1540,1541,1560-1591 new-connection-mark=1c passthrough=no protocol=\
    tcp
add action=mark-packet chain=forward connection-mark=1c in-interface-list=\
    "Tunnel interfaces" new-packet-mark=vpn_1c_in passthrough=no
add action=mark-packet chain=forward connection-mark=1c new-packet-mark=\
    vpn_1c_out out-interface-list="Tunnel interfaces" passthrough=no
add action=mark-connection chain=prerouting comment=VIDEO dst-port=3080,3081 \
    new-connection-mark=video passthrough=no protocol=tcp
add action=mark-packet chain=forward connection-mark=video in-interface-list=\
    "Tunnel interfaces" new-packet-mark=vpn_video_in passthrough=no
add action=mark-packet chain=forward connection-mark=video new-packet-mark=\
    vpn_video_out out-interface-list="Tunnel interfaces" passthrough=no
add action=mark-connection chain=prerouting comment=SMB dst-port=445 \
    new-connection-mark=smb passthrough=no protocol=tcp
add action=mark-packet chain=forward connection-mark=smb in-interface-list=\
    "Tunnel interfaces" new-packet-mark=vpn_smb_in passthrough=no
add action=mark-packet chain=forward connection-mark=smb new-packet-mark=\
    vpn_smb_out out-interface-list="Tunnel interfaces" passthrough=no
add action=mark-connection chain=prerouting comment=LiteManager dst-port=\
    5650,5651 new-connection-mark=lm passthrough=no protocol=tcp
add action=mark-packet chain=forward connection-mark=lm new-packet-mark=\
    vpn_lm_in out-interface-list="Tunnel interfaces" passthrough=no
add action=mark-packet chain=forward connection-mark=lm in-interface-list=\
    "Tunnel interfaces" new-packet-mark=vpn_lm_out passthrough=no
add action=mark-connection chain=prerouting comment=Winbox dst-port=8291 \
    new-connection-mark=winbox passthrough=no protocol=tcp
add action=mark-packet chain=forward connection-mark=winbox log-prefix=\
    vpn_winbox_in_ new-packet-mark=vpn_winbox_in out-interface-list=\
    "Tunnel interfaces" passthrough=no
add action=mark-packet chain=forward connection-mark=winbox \
    in-interface-list="Tunnel interfaces" new-packet-mark=vpn_winbox_out \
    passthrough=no
add action=mark-packet chain=forward comment=ALL in-interface-list=\
    "Tunnel interfaces" log-prefix=vpn_all_in_ new-packet-mark=vpn_all_in \
    passthrough=no
add action=mark-packet chain=forward log-prefix=vpn_all_out_ new-packet-mark=\
    vpn_all_out out-interface-list="Tunnel interfaces" passthrough=no
add action=mark-packet chain=forward in-interface-list=wan-int \
    new-packet-mark=all_in passthrough=yes
add action=mark-packet chain=forward new-packet-mark=all_out \
    out-interface-list=wan-int passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat out-interface=CIFRA1-wan-ether1
add action=masquerade chain=srcnat out-interface=sfp1-wan-megafon
add action=dst-nat chain=dstnat comment="RDP Toolbox" disabled=yes dst-port=\
    5002 in-interface-list=wan-int protocol=tcp to-addresses=192.168.5.2 \
    to-ports=3389
add action=dst-nat chain=dstnat comment=GES-PC disabled=yes dst-port=5002 \
    in-interface-list=wan-int protocol=tcp to-addresses=192.168.0.229 \
    to-ports=3389
add action=dst-nat chain=dstnat comment=ENTELS dst-port=5051 \
    in-interface-list=wan-int protocol=tcp src-address=89.17.40.219 \
    to-addresses=192.168.105.2 to-ports=3389
add action=dst-nat chain=dstnat comment=VOIP dst-port=5060 in-interface-list=\
    wan-int protocol=udp src-address-list="DST-NAT SIP" to-addresses=\
    192.168.3.3 to-ports=5060
add action=dst-nat chain=dstnat dst-port=10000-20000 in-interface-list=\
    wan-int log-prefix=voip_ protocol=udp to-addresses=192.168.3.3 to-ports=\
    10000-20000
add action=dst-nat chain=dstnat dst-port=10050 in-interface-list=wan-int \
    protocol=tcp to-addresses=192.168.3.3 to-ports=10050
add action=dst-nat chain=dstnat comment="SSH Bitpbx" disabled=yes dst-port=\
    2223 in-interface-list=wan-int protocol=tcp to-addresses=192.168.3.3 \
    to-ports=22
add action=dst-nat chain=dstnat comment="Astue RDP" disabled=yes dst-port=\
    5000 in-interface-list=wan-int protocol=tcp to-addresses=192.168.105.2 \
    to-ports=3389
add action=dst-nat chain=dstnat comment="Lexema RDP" disabled=yes dst-port=\
    5003 in-interface-list=wan-int log-prefix=rdp_ protocol=tcp to-addresses=\
    192.168.0.72 to-ports=3389
add action=dst-nat chain=dstnat comment="Lexema RDP" disabled=yes dst-port=\
    5004 in-interface-list=wan-int log-prefix=rdp_ protocol=tcp to-addresses=\
    192.168.0.89 to-ports=3389
add action=dst-nat chain=dstnat disabled=yes dst-port=5005 in-interface=\
    CIFRA1-wan-ether1 protocol=tcp to-addresses=192.168.0.70 to-ports=80
add action=dst-nat chain=dstnat disabled=yes dst-port=5006 in-interface=\
    CIFRA1-wan-ether1 protocol=udp to-addresses=192.168.0.70 to-ports=5006
add action=dst-nat chain=dstnat disabled=yes dst-port=554 in-interface=\
    CIFRA1-wan-ether1 protocol=tcp to-addresses=192.168.0.70 to-ports=554
add action=dst-nat chain=dstnat disabled=yes dst-port=80 in-interface-list=\
    wan-int protocol=tcp to-addresses=192.168.0.140 to-ports=8090
add action=netmap chain=dstnat comment="SecurOS mobile" dst-port=7777 \
    in-interface-list=wan-int protocol=tcp to-addresses=192.168.100.2 \
    to-ports=7777
add action=netmap chain=dstnat comment="SecurOS mobile" dst-port=8888 \
    in-interface-list=wan-int protocol=tcp to-addresses=192.168.100.2 \
    to-ports=8888
add action=dst-nat chain=dstnat comment="Videoserver RDP" disabled=yes \
    dst-port=3389 in-interface-list=wan-int protocol=tcp to-addresses=\
    192.168.100.2 to-ports=3389
add action=netmap chain=dstnat comment="Beward Domofon" dst-port=5001 \
    in-interface-list=wan-int protocol=tcp to-addresses=192.168.100.118 \
    to-ports=80
add action=netmap chain=dstnat dst-port=5000 in-interface-list=wan-int \
    protocol=udp to-addresses=192.168.100.118 to-ports=5000
add action=netmap chain=dstnat dst-port=554 in-interface-list=wan-int \
    log-prefix=dom_ protocol=tcp to-addresses=192.168.100.118 to-ports=554
add action=netmap chain=dstnat comment=SecurOS_Webview dst-port=8080 \
    in-interface-list=wan-int protocol=tcp to-addresses=192.168.100.2 \
    to-ports=8080
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes
/ip ipsec settings
set accounting=no
/ip route
add check-gateway=ping distance=1 gateway=212.152.35.57 pref-src=\
    212.152.35.60 routing-mark=rout_ISP1
add check-gateway=ping distance=1 gateway=212.69.114.86 pref-src=\
    212.69.114.85 routing-mark=rout_ISP2
add check-gateway=ping distance=1 gateway=8.8.8.8
add check-gateway=ping distance=2 gateway=8.8.4.4
add check-gateway=ping distance=1 dst-address=8.8.4.4/32 gateway=\
    212.69.114.86 scope=10
add check-gateway=ping distance=1 dst-address=8.8.8.8/32 gateway=\
    212.152.35.57 scope=10
add distance=1 dst-address=172.27.0.0/21 gateway=192.168.0.13
add distance=1 dst-address=192.168.19.0/24 gateway=172.18.0.5
add distance=1 dst-address=192.168.23.0/24 gateway=192.168.0.13
add distance=1 dst-address=192.168.233.0/24 gateway=192.168.0.13
/ip route rule
add dst-address=192.168.0.0/24 table=main
add src-address=212.152.35.60/32 table=rout_ISP1
add src-address=212.69.114.85/32 table=rout_ISP2
/ip service
set telnet address=192.168.0.0/24,192.168.20.0/24 disabled=yes
set ftp address=192.168.0.0/24 disabled=yes
set www address=192.168.0.0/24,192.168.20.0/24 disabled=yes port=8081
set ssh address=192.168.0.0/24,192.168.20.0/24
set api disabled=yes
set winbox address=192.168.0.0/24,192.168.20.0/24,109.73.14.29/32
set api-ssl disabled=yes
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/ip tftp
add read-only=no real-filename=/pxe req-filename=.*
/ip traffic-flow target
add dst-address=192.168.0.158 port=9996
/ip upnp interfaces
add interface=ether4-master-lan type=internal
add interface=CIFRA1-wan-ether1 type=external
/routing filter
add action=discard chain=ospf-in prefix-length=28-32
add action=discard chain=ospf-out prefix-length=30-32
add action=discard chain=ospf-in prefix=83.169.208.0/24
add action=discard chain=ospf-out prefix=212.152.35.0/24
add action=discard chain=ospf-out prefix=212.152.35.56/29
add action=discard chain=ospf-out prefix=10.1.2.0/24
add action=discard chain=ospf-out prefix=10.1.1.0/24
add action=discard chain=ospf-out prefix=10.1.4.0/24
add action=discard chain=ospf-out prefix=192.168.25.0/24
add action=discard chain=ospf-out prefix=192.168.5.0/24
add action=discard chain=ospf-in prefix=172.16.2.0/24
add action=discard chain=ospf-out prefix=192.168.23.0/24
add action=discard chain=ospf-out prefix=10.1.5.0/24
/routing ospf interface
add authentication=md5 authentication-key="" \
    authentication-key-id=2 interface=CROC-ISP1 network-type=point-to-point \
    use-bfd=yes
add authentication=md5 authentication-key="" \
    authentication-key-id=2 interface=KST-ISP1 network-type=point-to-point \
    use-bfd=yes
add authentication=md5 authentication-key="" \
    authentication-key-id=2 interface=KST-ISP2 network-type=point-to-point \
    use-bfd=yes
add authentication=md5 authentication-key="" \
    authentication-key-id=2 interface=RHLEB-ISP1 network-type=point-to-point \
    use-bfd=yes
add authentication=md5 authentication-key="" \
    authentication-key-id=2 interface=RHLEB-ISP2 network-type=point-to-point
add interface=vlan-video network-type=broadcast passive=yes
add interface=ether4-master-lan network-type=broadcast use-bfd=yes
add authentication=md5 authentication-key="" \
    authentication-key-id=2 interface=CROC-ISP2 network-type=point-to-point
/routing ospf network
add area=backbone network=172.18.0.0/24
add area=backbone disabled=yes network=172.18.23.0/30
add area=backbone network=192.168.0.0/24
add area=backbone network=192.168.100.0/24
/snmp
set enabled=yes
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=gate.grain.ccr
/system logging
add action=echo disabled=yes topics=ospf
/system ntp client
set enabled=yes primary-ntp=192.168.0.65 secondary-ntp=192.168.20.10
/system scheduler
add name="remove udp conn" on-event=\
    "/ip firewall connection {remove [find connection mark=sip]}" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-time=startup
/tool bandwidth-server
set authenticate=no enabled=no
/tool e-mail
set address=smtp.lancloud.ru from=notify@grainholding.ru password=harddrvb \
    user=notify@grainholding.ru
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool romon
set enabled=yes
/tool sniffer
set filter-interface=CROC-ISP2 filter-stream=yes streaming-enabled=yes \
    streaming-server=192.168.0.250
Вложения
Дампы.zip
Megafon - дамп со стороны офиса
Cloud - дамп со стороны CHR
(2.7 КБ) 207 скачиваний


easyman
Сообщения: 108
Зарегистрирован: 19 окт 2018, 13:44

В torch видны hello?


sergey.pahomov
Сообщения: 2
Зарегистрирован: 07 апр 2020, 06:25

Да, видно. Видно даже что hello уходит в сторону провайдера


Chai
Сообщения: 63
Зарегистрирован: 25 авг 2017, 08:13

А если использовать юникаст, интерфейсы сделать не бродкастовые, а nbma и указать соседей в nbma neighbors ?


Ответить