Дано: MikroTik 951G-2HnD RouterOS 6.46.4
Пытаюсь разобраться почему не работает встроенный FTP-server внутри сети.
Минимально настроил по умолчанию. WAN воткнут в Lan_5. Поднял по инструкциям FTP-server на самом MikroTik. С ноутбука по основному Wi-Fi (не гостевой) не удается подключиться к FTP . (По lan та же проблема.) Странно! Как я понимаю внутри подсетки /24 все должно ходить без ограничений? Все режет:
Код: Выделить всё
/ip firewall filter add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LANЕсли перед ним поставить разрешающее правило на 21 порт с тем же листом 'LAN', то оно не срабатывает! Получается, что не работает Default Interface list 'LAN' ?
Для проверки сделал еще один Interface list 'Test' включил в него только один интерфейс wlan1-WiFi и скопировал правило файервола для него. Оно тоже не работает!
И только если создать Interface list на интерфейс bridge, то разрешающее правило срабатывает! Это видно по счетчику. Так же работает на прямое указание разрешенного внутреннего IP.
Код: Выделить всё
/ip firewall filter
add action=accept chain=input dst-port=21 in-interface-list=LAN log=yes \
log-prefix=ZZZ_Test1 protocol=tcp
add action=accept chain=input dst-port=21 in-interface-list=Test log=yes \
log-prefix=ZZZ_Test1 protocol=tcp
add action=accept chain=input dst-port=21 in-interface-list=Bridge_1 log=yes \
log-prefix=ZZZ_Test1 protocol=tcp
add action=accept chain=input dst-port=21 log=yes log-prefix=ZZZ_FTP \
protocol=tcp src-address=172.22.0.31
# apr/01/2020 00:39:23 by RouterOS 6.46.4
# software id = N8DE-YXID
#
# model = 951G-2HnD
# serial number = ***********
/interface bridge
add admin-mac=CC:2D:E0:B4:21:39 auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] antenna-gain=0 band=2ghz-b/g/n channel-width=\
20/40mhz-XX comment="Main: MikroTik-B4213D" country=no_country_set \
disabled=no distance=indoors frequency=auto frequency-mode=manual-txpower \
mode=ap-bridge name=wlan1-WiFi ssid=MikroTik-B4213D wireless-protocol=\
802.11
/interface ethernet
set [ find default-name=ether1 ] name=ether1-POE
set [ find default-name=ether5 ] name=ether5-AVK
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether5-AVK name=pppoe-out1 \
use-peer-dns=yes user=client-206.103
/interface wireless manual-tx-power-table
set wlan1-WiFi comment="Main: MikroTik-B4213D"
/interface wireless nstreme
set wlan1-WiFi comment="Main: MikroTik-B4213D"
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=Test
add name=Bridge_1
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
dynamic-keys supplicant-identity=MikroTik
add authentication-types=wpa-psk,wpa2-psk mode=dynamic-keys name=profile \
supplicant-identity=MikroTik
/interface wireless
add comment=MT6-Guest disabled=no mac-address=CE:2D:E0:B4:21:3D \
master-interface=wlan1-WiFi name=wlan2-WiFi_Guest security-profile=\
profile ssid=MT6-Guest
/interface wireless manual-tx-power-table
set wlan2-WiFi_Guest comment=MT6-Guest
/interface wireless nstreme
set wlan2-WiFi_Guest comment=MT6-Guest
/ip pool
add name="dhcp 172.22.0.100-200" ranges=172.22.0.100-172.22.0.200
add name=vpn ranges=192.168.89.2-192.168.89.255
/ip dhcp-server
add address-pool="dhcp 172.22.0.100-200" disabled=no interface=bridge \
lease-time=5m name=defconf
/ppp profile
set *FFFFFFFE local-address=192.168.89.1 remote-address=vpn
/interface bridge filter
add action=drop chain=forward in-interface=wlan2-WiFi_Guest
add action=drop chain=forward out-interface=wlan2-WiFi_Guest
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment="ZZZ (WAN=5, but not =1)" interface=ether1-POE
add bridge=bridge comment=defconf interface=wlan1-WiFi
add bridge=bridge interface=wlan2-WiFi_Guest
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface detect-internet
set detect-interface-list=WAN
/interface l2tp-server server
set enabled=yes use-ipsec=yes
/interface list member
add interface=pppoe-out1 list=WAN
add interface=ether1-POE list=LAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=wlan1-WiFi list=LAN
add interface=wlan1-WiFi list=Test
add interface=bridge list=Bridge_1
/interface pptp-server server
set enabled=yes
/interface sstp-server server
set default-profile=default-encryption enabled=yes
/interface wireless access-list
add ap-tx-limit=100000 client-tx-limit=100000 interface=wlan2-WiFi_Guest
/ip address
add address=172.22.0.1/24 comment=defconf interface=ether2 network=172.22.0.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf interface=ether5-AVK
/ip dhcp-server lease
add address=172.22.0.10 client-id=1:48:5b:39:7b:30:40 mac-address=\
48:5B:39:7B:30:40 server=defconf
add address=172.22.0.32 client-id=1:ac:c1:ee:3a:16:a1 mac-address=\
AC:C1:EE:3A:16:A1 server=defconf
add address=172.22.0.31 client-id=1:0:27:10:d2:d7:ec mac-address=\
00:27:10:D2:D7:EC server=defconf
add address=172.22.0.21 client-id=1:0:0:0:0:0:1 comment="SAP Server" \
mac-address=00:00:00:00:00:01 server=defconf
add address=172.22.0.11 client-id=1:f0:4d:a2:46:9e:7b mac-address=\
F0:4D:A2:46:9E:7B server=defconf
add address=172.22.0.52 client-id=1:60:a4:4c:a5:b7:28 mac-address=\
60:A4:4C:A5:B7:28 server=defconf
add address=172.22.0.14 client-id=1:0:18:f3:cf:9:30 comment=\
"Asus WL-500gP WAN" mac-address=00:18:F3:CF:09:30 server=defconf
add address=172.22.0.60 client-id=1:0:f:0:b8:d4:cf comment=\
"IP-cam (WiFi) Besder 6024PB-JW201 1080P " mac-address=00:0F:00:B8:D4:CF \
server=defconf
add address=172.22.0.61 client-id=1:4c:b0:8:e8:31:3a comment=\
"IP-cam (LAN) Besder 6024PB-JW201 1080P " mac-address=4C:B0:08:E8:31:3A \
server=defconf
/ip dhcp-server network
add address=172.22.0.0/24 comment=defconf gateway=172.22.0.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=172.22.0.1 name=router.lan
/ip firewall address-list
add address=bt.t-ru.org comment=bt list=RuTracker
add address=bt2.t-ru.org comment=bt2 list=RuTracker
add address=bt3.t-ru.org comment=bt3 list=RuTracker
add address=bt4.t-ru.org comment=bt4 list=RuTracker
/ip firewall filter
add action=accept chain=input comment=\
"ZZZ VLC \F2\F0\E0\ED\F1\EB\FF\F6\E8\FF" dst-port=18080 protocol=tcp
add action=accept chain=input comment="ZZZ Allow remote management of the rout\
er via the WEB (Default=80 and Close)" dst-port=49080 protocol=tcp
add action=accept chain=input comment="ZZZ Allow remote management of the rout\
er via the Winbox (programm, Default=8291 and Close)" dst-port=48291 \
protocol=tcp
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=accept chain=input comment="allow IPsec NAT" dst-port=4500 \
protocol=udp
add action=accept chain=input comment="allow IKE" dst-port=500 protocol=udp
add action=accept chain=input comment="allow l2tp" dst-port=1701 protocol=udp
add action=accept chain=input comment="allow pptp" dst-port=1723 protocol=tcp
add action=accept chain=input comment="allow sstp" dst-port=443 protocol=tcp
add action=drop chain=input comment="ZZZ \C1\EB\EE\EA\F0\EE\E2\E0\F2\FC \EE\E1\
\ED\E0\F0\F3\E6\E5\ED\E8\E5 MikroTikNeighbors \E8\E7 \E2\ED\E5. \C5\F1\EB\
\E8 \F7\E5\F2\F7\E8\EA=0, \F2\EE \F3\E4\E0\EB\E8\F2\FC https://www.techn\
otrade.com.ua/Articles/mikrotik_hide_2013-05-13.php" dst-port=5678 log=\
yes log-prefix=ZZZ_no_Neighbors_WAN protocol=tcp
add action=drop chain=input dst-port=5678 in-interface=ether5-AVK log=yes \
log-prefix="ZZZ " protocol=tcp
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input dst-port=21 in-interface-list=LAN log=yes \
log-prefix=ZZZ_Test1 protocol=tcp
add action=accept chain=input dst-port=21 in-interface-list=Test log=yes \
log-prefix=ZZZ_Test1 protocol=tcp
add action=accept chain=input dst-port=21 in-interface-list=Bridge_1 log=yes \
log-prefix=ZZZ_Test1 protocol=tcp
add action=accept chain=input dst-port=21 log=yes log-prefix=ZZZ_FTP \
protocol=tcp src-address=172.22.0.31
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward dst-port=20-21 log=yes protocol=tcp \
src-address=172.22.0.11
add action=accept chain=output dst-port=20-21 log=yes protocol=tcp \
src-address=172.22.0.11
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="masq. vpn traffic" src-address=\
192.168.89.0/24
add action=netmap chain=dstnat comment="VLC \F2\F0\E0\ED\F1\EB\FF\F6\E8\FF" \
dst-port=9990-9999 in-interface=pppoe-out1 protocol=tcp to-addresses=\
172.22.0.11 to-ports=9990-9999
add action=netmap chain=dstnat comment="ZZZ SAP on 172.22.0.21:3200" \
disabled=yes dst-port=3200 in-interface=pppoe-out1 protocol=tcp \
to-addresses=172.22.0.21 to-ports=3200
add action=netmap chain=dstnat dst-port=13299 in-interface=pppoe-out1 \
protocol=tcp to-addresses=172.22.0.21 to-ports=3299
add action=netmap chain=dstnat dst-port=13299 in-interface=bridge protocol=\
tcp to-addresses=172.22.0.21 to-ports=3299
add action=dst-nat chain=dstnat comment="Web-Camera #1" dst-port=554 \
in-interface=pppoe-out1 protocol=udp to-addresses=172.22.0.60 to-ports=\
554
add action=dst-nat chain=dstnat comment="Web-camera #1" dst-port=554 \
in-interface=pppoe-out1 protocol=tcp to-addresses=172.22.0.60 to-ports=\
554
add action=dst-nat chain=dstnat comment=\
"upnp 172.22.0.11: uTorrent (TCP+UDP) Dell m6500 LAN" dst-port=15049 \
in-interface=pppoe-out1 protocol=tcp to-addresses=172.22.0.11 to-ports=\
15049
add action=dst-nat chain=dstnat dst-port=15049 in-interface=pppoe-out1 \
protocol=udp to-addresses=172.22.0.11 to-ports=15049
add action=dst-nat chain=dstnat comment="\CE\E1\F5\EE\E4 \E1\EB\EE\EA\E8\F0\EE\
\E2\EA\E8 RuTracker https://alexell.ru/blog/windows-internet/mikrotik-obho\
d-blokirovki-bt-trekerov-rutracker-org.html" dst-address-list=RuTracker \
dst-port=80 protocol=tcp to-addresses=163.172.167.207 to-ports=3128
add action=dst-nat chain=dstnat comment=\
"upnp 172.22.0.10: uTorrent (TCP+UDP) AMD-640" dst-port=15101 \
in-interface=pppoe-out1 protocol=tcp to-addresses=172.22.0.10 to-ports=\
15101
add action=dst-nat chain=dstnat dst-port=15101 protocol=udp to-addresses=\
172.22.0.10 to-ports=15101
add action=dst-nat chain=dstnat comment=\
"upnp 172.22.0.31: uTorrent (TCP+UDP) Dell m6500 WiFi" dst-port=15102 \
in-interface=pppoe-out1 protocol=tcp to-addresses=172.22.0.31 to-ports=\
15102
add action=dst-nat chain=dstnat dst-port=15102 in-interface=pppoe-out1 \
protocol=udp to-addresses=172.22.0.31 to-ports=15102
/ip service
set www port=49080
set winbox port=48291
/ip smb
set domain=WORKGROUP enabled=yes
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/ip traffic-flow
set interfaces=pppoe-out1
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=bridge type=internal
add interface=pppoe-out1 type=external
/ppp secret
add name=vpn
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Moscow
/system clock manual
set time-zone=+03:00
/system ntp client
set enabled=yes primary-ntp=88.212.196.95 secondary-ntp=91.206.16.3
/system scheduler
add interval=5m name=DDNS-NoIp on-event="/system script run DDNS-NoIp" \
policy=read,write,test start-date=jan/01/1970 start-time=01:01:01
/system script
add dont-require-permissions=no name=DDNS-NoIp owner=admin policy=\
read,write,test source="# \CF\E0\F0\E0\EC\E5\F2\F0\FB \EF\EE\E4\EA\EB\FE\
\F7\E5\ED\E8\FF \EA NO-IP.com\r\
\n:local ddnsuser \"*********\"\r\
\n:local ddnspass \"*******\"\r\
\n:local ddnshostname \"*******.ddns.net\" \r\
\n:local ddnsinterface \"pppoe-out1\"\r\
\n\r\
\n# \CE\EF\E8\F1\E0\ED\E8\E5 \E3\EB\EE\E1\E0\EB\FC\ED\FB\F5 \EF\E5\F0\E5\
\EC\E5\ED\ED\FB\F5\r\
\n:global ddnslastip\r\
\n:local str\r\
\n:local ddnsip\r\
\n:local ip\r\
\n\r\
\n:if ([ :typeof \$ddnslastip ] = nil ) do={ :global ddnslastip \"0\" }\r\
\n\r\
\n:local ddnsip [ /ip address get [/ip address find interface=\$ddnsinterf\
ace ] address ]\r\
\n\r\
\n:if ([ :typeof \$ddnsip ] = nil ) do={\r\
\n :log info (\"ServiceDNS: No ip address on \$ddnsinterface .\")\r\
\n} else={\r\
\n\r\
\n# \C8\E7 \EF\EE\EB\F3\F7\E5\ED\ED\EE\E3\EE \ED\E0 \E8\ED\F2\E5\F0\F4\E5\
\E9\F1\E5 IP \E0\E4\F0\E5\F1\E0 \E8\F1\EA\EB\FE\F7\E0\E5\EC \EC\E0\F1\EA\
\F3\r\
\n :for i from=( [:len \$ddnsip] - 1) to=0 do={ \r\
\n :if ( [:pick \$ddnsip \$i] = \"/\") do={ \r\
\n :set ddnsip [:pick \$ddnsip 0 \$i];\r\
\n } \r\
\n }\r\
\n\r\
\n :if (\$ddnsip != \$ddnslastip) do={\r\
\n\r\
\n :log info (\"ServiceDNS: \$ddnshostname -> \$ddnsip\")\r\
\n\r\
\n# \CE\F2\EF\F0\E0\E2\EB\FF\E5\EC \ED\EE\E2\FB\E9 IP \E0\E4\F0\E5\F1 \ED\
\E0 \F1\E5\F0\E2\E8\F1 No-IP \F1 \EF\EE\EC\EE\F9\FC\FE HTTP \E7\E0\EF\F0\
\EE\F1\E0\r\
\n :local str \"/nic/update\?hostname=\$ddnshostname&myip=\$ddnsip\"\r\
\n /tool fetch url=\"http://dynupdate.no-ip.com/\$str\" mode=http user=\
\$ddnsuser password=\$ddnspass \\ dst-path=(\"/ServiceDNS.\".\$ddnshostnam\
e)\r\
\n :delay 1 \r\
\n\r\
\n# \D1\EE\F5\F0\E0\ED\FF\E5\EC \F0\E5\E7\F3\EB\FC\F2\E0\F2\FB \E2 \EB\EE\
\E3 \F4\E0\E9\EB\E0\F5\r\
\n :local str [/file find name=\"ServiceDNS.\$ddnshostname\"];\r\
\n :log info [/file get \$str contents];\r\
\n /file remove \$str\r\
\n :global ddnslastip \$ddnsip\r\
\n\r\
\n } \r\
\n\r\
\n}"
add dont-require-permissions=no name=script1 owner=admin policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=" \
\_ :log info (\"ZZ00 - - - - ZZZZ \D1\F2\E0\F0\F2 \F1\EA\F0\E8\EF\F2\E0 D\
ynDNS\")\r\
\n\r\
\n# \CF\E0\F0\E0\EC\E5\F2\F0\FB \EF\EE\E4\EA\EB\FE\F7\E5\ED\E8\FF \EA NO-I\
P.com\r\
\n:local ddnsuser \"*********\"\r\
\n:local ddnspass \"*******\"\r\
\n:local ddnshostname \"*******.ddns.net\" \r\
\n:local ddnsinterface \"pppoe-out1\"\r\
\n\r\
\n# \CE\EF\E8\F1\E0\ED\E8\E5 \E3\EB\EE\E1\E0\EB\FC\ED\FB\F5 \EF\E5\F0\E5\
\EC\E5\ED\ED\FB\F5\r\
\n:global ddnslastip\r\
\n:local str\r\
\n:local ddnsip\r\
\n:local ip\r\
\n\r\
\n :log info (\"ZZ01\")\r\
\n :log info (:typeof \$ddnslastip)\r\
\n\r\
\n:if ([ :typeof \$ddnslastip ] = nil ) do={ :global ddnslastip \"0\" }\r\
\n\r\
\n:local ddnsip [ /ip address get [/ip address find interface=\$ddnsinterf\
ace ] address ]\r\
\n\r\
\n:if ([ :typeof \$ddnsip ] = nil ) do={\r\
\n :log info (\"ServiceDNS: No ip address on \$ddnsinterface .\")\r\
\n} else={\r\
\n\r\
\n# \C8\E7 \EF\EE\EB\F3\F7\E5\ED\ED\EE\E3\EE \ED\E0 \E8\ED\F2\E5\F0\F4\E5\
\E9\F1\E5 IP \E0\E4\F0\E5\F1\E0 \E8\F1\EA\EB\FE\F7\E0\E5\EC \EC\E0\F1\EA\
\F3\r\
\n :for i from=( [:len \$ddnsip] - 1) to=0 do={ \r\
\n :if ( [:pick \$ddnsip \$i] = \"/\") do={ \r\
\n :set ddnsip [:pick \$ddnsip 0 \$i];\r\
\n } \r\
\n }\r\
\n\r\
\n :if (\$ddnsip != \$ddnslastip) do={\r\
\n\r\
\n :log info (\"ServiceDNS: \$ddnshostname -> \$ddnsip\")\r\
\n\r\
\n# \CE\F2\EF\F0\E0\E2\EB\FF\E5\EC \ED\EE\E2\FB\E9 IP \E0\E4\F0\E5\F1 \ED\
\E0 \F1\E5\F0\E2\E8\F1 No-IP \F1 \EF\EE\EC\EE\F9\FC\FE HTTP \E7\E0\EF\F0\
\EE\F1\E0\r\
\n :local str \"/nic/update\?hostname=\$ddnshostname&myip=\$ddnsip\"\r\
\n /tool fetch url=\"http://dynupdate.no-ip.com/\$str\" mode=http user=\
\$ddnsuser password=\$ddnspass \\ dst-path=(\"/ServiceDNS.\".\$ddnshostnam\
e)\r\
\n :delay 1 \r\
\n\r\
\n# \D1\EE\F5\F0\E0\ED\FF\E5\EC \F0\E5\E7\F3\EB\FC\F2\E0\F2\FB \E2 \EB\EE\
\E3 \F4\E0\E9\EB\E0\F5\r\
\n :local str [/file find name=\"ServiceDNS.\$ddnshostname\"];\r\
\n :log info [/file get \$str contents];\r\
\n /file remove \$str\r\
\n :global ddnslastip \$ddnsip\r\
\n\r\
\n } \r\
\n\r\
\n}"
/tool graphing interface
add
/tool graphing queue
add
/tool graphing resource
add
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool sniffer
set filter-ip-address=172.22.0.21/32 filter-ip-protocol=tcp
# software id = N8DE-YXID
#
# model = 951G-2HnD
# serial number = ***********
/interface bridge
add admin-mac=CC:2D:E0:B4:21:39 auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] antenna-gain=0 band=2ghz-b/g/n channel-width=\
20/40mhz-XX comment="Main: MikroTik-B4213D" country=no_country_set \
disabled=no distance=indoors frequency=auto frequency-mode=manual-txpower \
mode=ap-bridge name=wlan1-WiFi ssid=MikroTik-B4213D wireless-protocol=\
802.11
/interface ethernet
set [ find default-name=ether1 ] name=ether1-POE
set [ find default-name=ether5 ] name=ether5-AVK
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether5-AVK name=pppoe-out1 \
use-peer-dns=yes user=client-206.103
/interface wireless manual-tx-power-table
set wlan1-WiFi comment="Main: MikroTik-B4213D"
/interface wireless nstreme
set wlan1-WiFi comment="Main: MikroTik-B4213D"
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=Test
add name=Bridge_1
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
dynamic-keys supplicant-identity=MikroTik
add authentication-types=wpa-psk,wpa2-psk mode=dynamic-keys name=profile \
supplicant-identity=MikroTik
/interface wireless
add comment=MT6-Guest disabled=no mac-address=CE:2D:E0:B4:21:3D \
master-interface=wlan1-WiFi name=wlan2-WiFi_Guest security-profile=\
profile ssid=MT6-Guest
/interface wireless manual-tx-power-table
set wlan2-WiFi_Guest comment=MT6-Guest
/interface wireless nstreme
set wlan2-WiFi_Guest comment=MT6-Guest
/ip pool
add name="dhcp 172.22.0.100-200" ranges=172.22.0.100-172.22.0.200
add name=vpn ranges=192.168.89.2-192.168.89.255
/ip dhcp-server
add address-pool="dhcp 172.22.0.100-200" disabled=no interface=bridge \
lease-time=5m name=defconf
/ppp profile
set *FFFFFFFE local-address=192.168.89.1 remote-address=vpn
/interface bridge filter
add action=drop chain=forward in-interface=wlan2-WiFi_Guest
add action=drop chain=forward out-interface=wlan2-WiFi_Guest
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment="ZZZ (WAN=5, but not =1)" interface=ether1-POE
add bridge=bridge comment=defconf interface=wlan1-WiFi
add bridge=bridge interface=wlan2-WiFi_Guest
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface detect-internet
set detect-interface-list=WAN
/interface l2tp-server server
set enabled=yes use-ipsec=yes
/interface list member
add interface=pppoe-out1 list=WAN
add interface=ether1-POE list=LAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=wlan1-WiFi list=LAN
add interface=wlan1-WiFi list=Test
add interface=bridge list=Bridge_1
/interface pptp-server server
set enabled=yes
/interface sstp-server server
set default-profile=default-encryption enabled=yes
/interface wireless access-list
add ap-tx-limit=100000 client-tx-limit=100000 interface=wlan2-WiFi_Guest
/ip address
add address=172.22.0.1/24 comment=defconf interface=ether2 network=172.22.0.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf interface=ether5-AVK
/ip dhcp-server lease
add address=172.22.0.10 client-id=1:48:5b:39:7b:30:40 mac-address=\
48:5B:39:7B:30:40 server=defconf
add address=172.22.0.32 client-id=1:ac:c1:ee:3a:16:a1 mac-address=\
AC:C1:EE:3A:16:A1 server=defconf
add address=172.22.0.31 client-id=1:0:27:10:d2:d7:ec mac-address=\
00:27:10:D2:D7:EC server=defconf
add address=172.22.0.21 client-id=1:0:0:0:0:0:1 comment="SAP Server" \
mac-address=00:00:00:00:00:01 server=defconf
add address=172.22.0.11 client-id=1:f0:4d:a2:46:9e:7b mac-address=\
F0:4D:A2:46:9E:7B server=defconf
add address=172.22.0.52 client-id=1:60:a4:4c:a5:b7:28 mac-address=\
60:A4:4C:A5:B7:28 server=defconf
add address=172.22.0.14 client-id=1:0:18:f3:cf:9:30 comment=\
"Asus WL-500gP WAN" mac-address=00:18:F3:CF:09:30 server=defconf
add address=172.22.0.60 client-id=1:0:f:0:b8:d4:cf comment=\
"IP-cam (WiFi) Besder 6024PB-JW201 1080P " mac-address=00:0F:00:B8:D4:CF \
server=defconf
add address=172.22.0.61 client-id=1:4c:b0:8:e8:31:3a comment=\
"IP-cam (LAN) Besder 6024PB-JW201 1080P " mac-address=4C:B0:08:E8:31:3A \
server=defconf
/ip dhcp-server network
add address=172.22.0.0/24 comment=defconf gateway=172.22.0.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=172.22.0.1 name=router.lan
/ip firewall address-list
add address=bt.t-ru.org comment=bt list=RuTracker
add address=bt2.t-ru.org comment=bt2 list=RuTracker
add address=bt3.t-ru.org comment=bt3 list=RuTracker
add address=bt4.t-ru.org comment=bt4 list=RuTracker
/ip firewall filter
add action=accept chain=input comment=\
"ZZZ VLC \F2\F0\E0\ED\F1\EB\FF\F6\E8\FF" dst-port=18080 protocol=tcp
add action=accept chain=input comment="ZZZ Allow remote management of the rout\
er via the WEB (Default=80 and Close)" dst-port=49080 protocol=tcp
add action=accept chain=input comment="ZZZ Allow remote management of the rout\
er via the Winbox (programm, Default=8291 and Close)" dst-port=48291 \
protocol=tcp
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=accept chain=input comment="allow IPsec NAT" dst-port=4500 \
protocol=udp
add action=accept chain=input comment="allow IKE" dst-port=500 protocol=udp
add action=accept chain=input comment="allow l2tp" dst-port=1701 protocol=udp
add action=accept chain=input comment="allow pptp" dst-port=1723 protocol=tcp
add action=accept chain=input comment="allow sstp" dst-port=443 protocol=tcp
add action=drop chain=input comment="ZZZ \C1\EB\EE\EA\F0\EE\E2\E0\F2\FC \EE\E1\
\ED\E0\F0\F3\E6\E5\ED\E8\E5 MikroTikNeighbors \E8\E7 \E2\ED\E5. \C5\F1\EB\
\E8 \F7\E5\F2\F7\E8\EA=0, \F2\EE \F3\E4\E0\EB\E8\F2\FC https://www.techn\
otrade.com.ua/Articles/mikrotik_hide_2013-05-13.php" dst-port=5678 log=\
yes log-prefix=ZZZ_no_Neighbors_WAN protocol=tcp
add action=drop chain=input dst-port=5678 in-interface=ether5-AVK log=yes \
log-prefix="ZZZ " protocol=tcp
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input dst-port=21 in-interface-list=LAN log=yes \
log-prefix=ZZZ_Test1 protocol=tcp
add action=accept chain=input dst-port=21 in-interface-list=Test log=yes \
log-prefix=ZZZ_Test1 protocol=tcp
add action=accept chain=input dst-port=21 in-interface-list=Bridge_1 log=yes \
log-prefix=ZZZ_Test1 protocol=tcp
add action=accept chain=input dst-port=21 log=yes log-prefix=ZZZ_FTP \
protocol=tcp src-address=172.22.0.31
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward dst-port=20-21 log=yes protocol=tcp \
src-address=172.22.0.11
add action=accept chain=output dst-port=20-21 log=yes protocol=tcp \
src-address=172.22.0.11
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="masq. vpn traffic" src-address=\
192.168.89.0/24
add action=netmap chain=dstnat comment="VLC \F2\F0\E0\ED\F1\EB\FF\F6\E8\FF" \
dst-port=9990-9999 in-interface=pppoe-out1 protocol=tcp to-addresses=\
172.22.0.11 to-ports=9990-9999
add action=netmap chain=dstnat comment="ZZZ SAP on 172.22.0.21:3200" \
disabled=yes dst-port=3200 in-interface=pppoe-out1 protocol=tcp \
to-addresses=172.22.0.21 to-ports=3200
add action=netmap chain=dstnat dst-port=13299 in-interface=pppoe-out1 \
protocol=tcp to-addresses=172.22.0.21 to-ports=3299
add action=netmap chain=dstnat dst-port=13299 in-interface=bridge protocol=\
tcp to-addresses=172.22.0.21 to-ports=3299
add action=dst-nat chain=dstnat comment="Web-Camera #1" dst-port=554 \
in-interface=pppoe-out1 protocol=udp to-addresses=172.22.0.60 to-ports=\
554
add action=dst-nat chain=dstnat comment="Web-camera #1" dst-port=554 \
in-interface=pppoe-out1 protocol=tcp to-addresses=172.22.0.60 to-ports=\
554
add action=dst-nat chain=dstnat comment=\
"upnp 172.22.0.11: uTorrent (TCP+UDP) Dell m6500 LAN" dst-port=15049 \
in-interface=pppoe-out1 protocol=tcp to-addresses=172.22.0.11 to-ports=\
15049
add action=dst-nat chain=dstnat dst-port=15049 in-interface=pppoe-out1 \
protocol=udp to-addresses=172.22.0.11 to-ports=15049
add action=dst-nat chain=dstnat comment="\CE\E1\F5\EE\E4 \E1\EB\EE\EA\E8\F0\EE\
\E2\EA\E8 RuTracker https://alexell.ru/blog/windows-internet/mikrotik-obho\
d-blokirovki-bt-trekerov-rutracker-org.html" dst-address-list=RuTracker \
dst-port=80 protocol=tcp to-addresses=163.172.167.207 to-ports=3128
add action=dst-nat chain=dstnat comment=\
"upnp 172.22.0.10: uTorrent (TCP+UDP) AMD-640" dst-port=15101 \
in-interface=pppoe-out1 protocol=tcp to-addresses=172.22.0.10 to-ports=\
15101
add action=dst-nat chain=dstnat dst-port=15101 protocol=udp to-addresses=\
172.22.0.10 to-ports=15101
add action=dst-nat chain=dstnat comment=\
"upnp 172.22.0.31: uTorrent (TCP+UDP) Dell m6500 WiFi" dst-port=15102 \
in-interface=pppoe-out1 protocol=tcp to-addresses=172.22.0.31 to-ports=\
15102
add action=dst-nat chain=dstnat dst-port=15102 in-interface=pppoe-out1 \
protocol=udp to-addresses=172.22.0.31 to-ports=15102
/ip service
set www port=49080
set winbox port=48291
/ip smb
set domain=WORKGROUP enabled=yes
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/ip traffic-flow
set interfaces=pppoe-out1
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=bridge type=internal
add interface=pppoe-out1 type=external
/ppp secret
add name=vpn
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Moscow
/system clock manual
set time-zone=+03:00
/system ntp client
set enabled=yes primary-ntp=88.212.196.95 secondary-ntp=91.206.16.3
/system scheduler
add interval=5m name=DDNS-NoIp on-event="/system script run DDNS-NoIp" \
policy=read,write,test start-date=jan/01/1970 start-time=01:01:01
/system script
add dont-require-permissions=no name=DDNS-NoIp owner=admin policy=\
read,write,test source="# \CF\E0\F0\E0\EC\E5\F2\F0\FB \EF\EE\E4\EA\EB\FE\
\F7\E5\ED\E8\FF \EA NO-IP.com\r\
\n:local ddnsuser \"*********\"\r\
\n:local ddnspass \"*******\"\r\
\n:local ddnshostname \"*******.ddns.net\" \r\
\n:local ddnsinterface \"pppoe-out1\"\r\
\n\r\
\n# \CE\EF\E8\F1\E0\ED\E8\E5 \E3\EB\EE\E1\E0\EB\FC\ED\FB\F5 \EF\E5\F0\E5\
\EC\E5\ED\ED\FB\F5\r\
\n:global ddnslastip\r\
\n:local str\r\
\n:local ddnsip\r\
\n:local ip\r\
\n\r\
\n:if ([ :typeof \$ddnslastip ] = nil ) do={ :global ddnslastip \"0\" }\r\
\n\r\
\n:local ddnsip [ /ip address get [/ip address find interface=\$ddnsinterf\
ace ] address ]\r\
\n\r\
\n:if ([ :typeof \$ddnsip ] = nil ) do={\r\
\n :log info (\"ServiceDNS: No ip address on \$ddnsinterface .\")\r\
\n} else={\r\
\n\r\
\n# \C8\E7 \EF\EE\EB\F3\F7\E5\ED\ED\EE\E3\EE \ED\E0 \E8\ED\F2\E5\F0\F4\E5\
\E9\F1\E5 IP \E0\E4\F0\E5\F1\E0 \E8\F1\EA\EB\FE\F7\E0\E5\EC \EC\E0\F1\EA\
\F3\r\
\n :for i from=( [:len \$ddnsip] - 1) to=0 do={ \r\
\n :if ( [:pick \$ddnsip \$i] = \"/\") do={ \r\
\n :set ddnsip [:pick \$ddnsip 0 \$i];\r\
\n } \r\
\n }\r\
\n\r\
\n :if (\$ddnsip != \$ddnslastip) do={\r\
\n\r\
\n :log info (\"ServiceDNS: \$ddnshostname -> \$ddnsip\")\r\
\n\r\
\n# \CE\F2\EF\F0\E0\E2\EB\FF\E5\EC \ED\EE\E2\FB\E9 IP \E0\E4\F0\E5\F1 \ED\
\E0 \F1\E5\F0\E2\E8\F1 No-IP \F1 \EF\EE\EC\EE\F9\FC\FE HTTP \E7\E0\EF\F0\
\EE\F1\E0\r\
\n :local str \"/nic/update\?hostname=\$ddnshostname&myip=\$ddnsip\"\r\
\n /tool fetch url=\"http://dynupdate.no-ip.com/\$str\" mode=http user=\
\$ddnsuser password=\$ddnspass \\ dst-path=(\"/ServiceDNS.\".\$ddnshostnam\
e)\r\
\n :delay 1 \r\
\n\r\
\n# \D1\EE\F5\F0\E0\ED\FF\E5\EC \F0\E5\E7\F3\EB\FC\F2\E0\F2\FB \E2 \EB\EE\
\E3 \F4\E0\E9\EB\E0\F5\r\
\n :local str [/file find name=\"ServiceDNS.\$ddnshostname\"];\r\
\n :log info [/file get \$str contents];\r\
\n /file remove \$str\r\
\n :global ddnslastip \$ddnsip\r\
\n\r\
\n } \r\
\n\r\
\n}"
add dont-require-permissions=no name=script1 owner=admin policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=" \
\_ :log info (\"ZZ00 - - - - ZZZZ \D1\F2\E0\F0\F2 \F1\EA\F0\E8\EF\F2\E0 D\
ynDNS\")\r\
\n\r\
\n# \CF\E0\F0\E0\EC\E5\F2\F0\FB \EF\EE\E4\EA\EB\FE\F7\E5\ED\E8\FF \EA NO-I\
P.com\r\
\n:local ddnsuser \"*********\"\r\
\n:local ddnspass \"*******\"\r\
\n:local ddnshostname \"*******.ddns.net\" \r\
\n:local ddnsinterface \"pppoe-out1\"\r\
\n\r\
\n# \CE\EF\E8\F1\E0\ED\E8\E5 \E3\EB\EE\E1\E0\EB\FC\ED\FB\F5 \EF\E5\F0\E5\
\EC\E5\ED\ED\FB\F5\r\
\n:global ddnslastip\r\
\n:local str\r\
\n:local ddnsip\r\
\n:local ip\r\
\n\r\
\n :log info (\"ZZ01\")\r\
\n :log info (:typeof \$ddnslastip)\r\
\n\r\
\n:if ([ :typeof \$ddnslastip ] = nil ) do={ :global ddnslastip \"0\" }\r\
\n\r\
\n:local ddnsip [ /ip address get [/ip address find interface=\$ddnsinterf\
ace ] address ]\r\
\n\r\
\n:if ([ :typeof \$ddnsip ] = nil ) do={\r\
\n :log info (\"ServiceDNS: No ip address on \$ddnsinterface .\")\r\
\n} else={\r\
\n\r\
\n# \C8\E7 \EF\EE\EB\F3\F7\E5\ED\ED\EE\E3\EE \ED\E0 \E8\ED\F2\E5\F0\F4\E5\
\E9\F1\E5 IP \E0\E4\F0\E5\F1\E0 \E8\F1\EA\EB\FE\F7\E0\E5\EC \EC\E0\F1\EA\
\F3\r\
\n :for i from=( [:len \$ddnsip] - 1) to=0 do={ \r\
\n :if ( [:pick \$ddnsip \$i] = \"/\") do={ \r\
\n :set ddnsip [:pick \$ddnsip 0 \$i];\r\
\n } \r\
\n }\r\
\n\r\
\n :if (\$ddnsip != \$ddnslastip) do={\r\
\n\r\
\n :log info (\"ServiceDNS: \$ddnshostname -> \$ddnsip\")\r\
\n\r\
\n# \CE\F2\EF\F0\E0\E2\EB\FF\E5\EC \ED\EE\E2\FB\E9 IP \E0\E4\F0\E5\F1 \ED\
\E0 \F1\E5\F0\E2\E8\F1 No-IP \F1 \EF\EE\EC\EE\F9\FC\FE HTTP \E7\E0\EF\F0\
\EE\F1\E0\r\
\n :local str \"/nic/update\?hostname=\$ddnshostname&myip=\$ddnsip\"\r\
\n /tool fetch url=\"http://dynupdate.no-ip.com/\$str\" mode=http user=\
\$ddnsuser password=\$ddnspass \\ dst-path=(\"/ServiceDNS.\".\$ddnshostnam\
e)\r\
\n :delay 1 \r\
\n\r\
\n# \D1\EE\F5\F0\E0\ED\FF\E5\EC \F0\E5\E7\F3\EB\FC\F2\E0\F2\FB \E2 \EB\EE\
\E3 \F4\E0\E9\EB\E0\F5\r\
\n :local str [/file find name=\"ServiceDNS.\$ddnshostname\"];\r\
\n :log info [/file get \$str contents];\r\
\n /file remove \$str\r\
\n :global ddnslastip \$ddnsip\r\
\n\r\
\n } \r\
\n\r\
\n}"
/tool graphing interface
add
/tool graphing queue
add
/tool graphing resource
add
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool sniffer
set filter-ip-address=172.22.0.21/32 filter-ip-protocol=tcp
