MikroTik: Базовая настройка

MikroTik: Базовая настройка

  • •

После покупки #MikroTik советуют обнулить все его настройки и начать конфигурацию с чистого листа.

Я написал небольший скрип для автоматизации действий по базовой настройки маршрутизатора. В скрипте есть параметры, которые необходимо предварительно настроить под себя.

Настройка основного роутера

  • Загрузить скрипт в память #MikroTik, предварительно настроив параметры скрипта под себя.
  • Зайти в Terminal и выполнить следующую команду:
1

/system reset-configuration no-defaults=yes skip-backup=yes run-after-reset="ros.router.rsc"

Параметры конфигурации

  • Пароль администратора: PassWord.
  • Мост:
    • Имя: bridge1.
    • Порты: 2-5.
  • Шлюз:
    • Название: GW1.
    • IP: 10.1.0.1.
    • Домен: gw1.lan.
  • Подсеть:
    • Маска: 10.1.0.0/16.
    • Домен: home.lan.
    • Адресация DHCP: 10.1.200.1-10.1.200.254.
  • Порты:
    • SSH: 22022.
    • Winbox: 9090.

Скрипт конфигурации

mt.router.rsc
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177

# @package    MikroTik / RouterOS
# @author     Kai Kimera <mail@kai.kim>
# @copyright  2023 Library Online
# @license    MIT
# @version    0.1.0
# @link       https://lib.onl/ru/articles/2023/12/0f3478b3-9fde-59aa-a424-ff160431fa35/
# -------------------------------------------------------------------------------------------------------------------- #
# Set MAC:
# /interface ethernet set [find default-name="ether1"] mac-address="00:00:00:00:00:00"
# -------------------------------------------------------------------------------------------------------------------- #

# Administrator password.
:local rosAdminPassword "PassWord"

# Bridge.
:local rosBridgeName "bridge1"
:local rosBridgeMinPort 2
:local rosBridgeMaxPort 5

# Router name.
:local rosRouterName "GW1"

# Static gateway name.
:local rosGwDomain "gw1.lan"

# Network domain name.
:local rosNwDomain "home.lan"

# Port knocking.
:local rosIcmpKnockSize 100

# -------------------------------------------------------------------------------------------------------------------- #
# -----------------------------------------------------< SCRIPT >----------------------------------------------------- #
# -------------------------------------------------------------------------------------------------------------------- #

/interface bridge
add name=$rosBridgeName

/interface list
add name=WAN
add name=LAN
add name=GRE

/interface bridge port
:for i from=$rosBridgeMinPort to=$rosBridgeMaxPort do={
  add bridge=$rosBridgeName interface=("ether" . $i)
}

/interface list member
add interface=ether1 list=WAN
add interface=$rosBridgeName list=LAN

/ipv6 settings
set disable-ipv6=yes

/ip ipsec profile
set [find default=yes] dh-group=ecp384 enc-algorithm=aes-256 hash-algorithm=sha256

/ip ipsec proposal
set [find default=yes] auth-algorithms=sha256 enc-algorithms=aes-256-cbc pfs-group=ecp384

/ip pool
add name=dhcp ranges=10.1.200.1-10.1.200.254

/ip dhcp-server
add address-pool=dhcp interface=$rosBridgeName name=dhcp1

/ip neighbor discovery-settings
set discover-interface-list=LAN

/ip address
add address=10.1.0.1/16 interface=$rosBridgeName network=10.1.0.0

/ip dhcp-client
add interface=ether1

/ip dhcp-server lease
# add address=10.1.0.40 mac-address=00:00:00:00:00:00 comment="SERVER01"

/ip dhcp-server network
add address=10.1.0.0/16 dns-server=10.1.0.1 domain=$rosNwDomain gateway=10.1.0.1 ntp-server=10.1.0.1

/ip dns
set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8,77.88.8.8

/ip dns static
add address=10.1.0.1 name=$rosGwDomain

/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked \
  comment="[ROS] Established, Related, Untracked"
add action=drop chain=input connection-state=invalid \
  comment="[ROS] Invalid"
add action=add-src-to-address-list address-list="AdminCP" address-list-timeout=30m chain=input in-interface-list=WAN \
  packet-size=($rosIcmpKnockSize + 28) protocol=icmp \
  comment="[ROS] ICMP port knocking for AdminCP"
add action=accept chain=input protocol=icmp \
  comment="[ROS] ICMP"
add action=accept chain=input in-interface-list=GRE protocol=ospf disabled=yes \
  comment="[ROS] OSPF"
add action=accept chain=input dst-port=53 in-interface-list=GRE protocol=udp disabled=yes \
  comment="[ROS] DNS"
add action=accept chain=input dst-port=9090,22022 protocol=tcp src-address-list="AdminCP" \
  comment="[ROS] WinBox and SSH"
add action=accept chain=input dst-port=9090,22022 in-interface-list=GRE protocol=tcp disabled=yes \
  comment="[ROS] WinBox and SSH"
add action=drop chain=input in-interface-list=!LAN \
  comment="[ROS] All not coming from LAN"
add action=accept chain=forward ipsec-policy=in,ipsec disabled=yes \
  comment="[ROS] In IPsec policy"
add action=accept chain=forward ipsec-policy=out,ipsec disabled=yes \
  comment="[ROS] Out IPsec policy"
add action=fasttrack-connection chain=forward connection-state=established,related \
  comment="[ROS] FastTrack"
add action=accept chain=forward connection-state=established,related,untracked \
  comment="[ROS] FastTrack"
add action=drop chain=forward connection-state=invalid \
  comment="[ROS] Invalid"
add action=drop chain=forward connection-nat-state=!dstnat connection-state=new in-interface-list=WAN \
  comment="[ROS] All from WAN not DSTNATed"

/ip firewall nat
add action=masquerade chain=srcnat ipsec-policy=out,none out-interface-list=WAN \
  comment="[ROS] Masquerade"

/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh port=22022
set api disabled=yes
set winbox port=9090
set api-ssl disabled=yes

/system clock
set time-zone-name=Europe/Moscow

/system identity
set name=$rosRouterName

/system ntp client
set enabled=yes

/system ntp server
set enabled=yes manycast=yes multicast=yes

/system ntp client servers
add address="0.ru.pool.ntp.org"
add address="1.ru.pool.ntp.org"
add address="time.google.com"
add address="time.cloudflare.com"

/system routerboard settings
set silent-boot=yes

/system watchdog
set automatic-supout=no

/tool bandwidth-server
set enabled=no

/tool mac-server
set allowed-interface-list=none

/tool mac-server ping
set enabled=no

/user
set [find name="admin"] password="$rosAdminPassword"

# -------------------------------------------------------------------------------------------------------------------- #
# Router ID.
# -------------------------------------------------------------------------------------------------------------------- #

/routing id
add id=10.1.0.1 name=lo select-dynamic-id=only-loopback \
  comment="[ROS] Router ID (Loopback)"