https://pastein.ru/t/v5f
Загрузка данных
/interface l2tp-server
add name=l2tp-tunnel2.1 user=l2tp-user2.1
add name=l2tp-tunnel2.2 user=l2tp-user2.2
add name=l2tp-tunnel3.1 user=l2tp-user3.1
add name=l2tp-tunnel3.2 user=l2tp-user3.2
add name=l2tp-tunnel4.1 user=l2tp-user4.1
add name=l2tp-tunnel5.1 user=l2tp-user5.1
add name=l2tp-tunnel6.1 user=l2tp-user6.1
add name=l2tp-tunnel7.1 user=l2tp-user7.1
add name=l2tp-tunnel8.1 user=l2tp-user8.1
add name=l2tp-tunnel8.2 user=l2tp-user8.2
add name=l2tp-tunnel14.1 user=l2tp-user14.1
/interface bridge
add name="AC 18-266" protocol-mode=none
add name="AC 18-272" protocol-mode=none
add name="AC 18-274" protocol-mode=none
add name="AC 18-281" protocol-mode=none
add name="AC 18-322" protocol-mode=none
add name="AC 18-331" protocol-mode=none
add comment="zamena na inline 03_04_2026 Kurilyak M.M." disabled=yes name="AC 18-341" protocol-mode=none
add name="AC 18-342" protocol-mode=none
add name="AC 18-369" protocol-mode=none
add comment="zamena na inline 03_03_2026 Kurilyak M.M." disabled=yes name="AC 18-370" protocol-mode=none
add name="AC 18-446" protocol-mode=none
add name="AC 18-447" protocol-mode=none
add name="AC 18-448" protocol-mode=none
add name="AC 18-469" protocol-mode=none
add name=Loopback-Management-GRE-IPSec-1
add name=Loopback-Mikrotik-Remote-L2TP5
add fast-forward=no name=Loopback0_Mgmt-intf
add fast-forward=no name=Loopback1_GRT
add fast-forward=no name=Loopback2-Mikrotik-Remote-intf
add name=Management protocol-mode=none
add name=Management-UPS
add name=Management-ubiquiti-CPE
add name=QinQ_Izhevsk
add fast-forward=no name=null0
/interface ethernet
set [ find default-name=ether1 ] comment=::IZH_MikroTik_2:ether1 mac-address=64:D1:54:82:0A:A2
set [ find default-name=ether2 ] comment=::IZH_MikroTik_2:ether2 mac-address=64:D1:54:82:0A:A3
set [ find default-name=ether3 ] advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full comment=::IZH_HUAWEI1:Gi0/0/18 full-duplex=no l2mtu=9000 mac-address=64:D1:54:82:0A:A4 mtu=9000
set [ find default-name=ether4 ] comment=::IZH_HUAWEI1:Gi1/0/18 l2mtu=9000 mac-address=64:D1:54:82:0A:A5 mtu=9000
set [ find default-name=ether5 ] comment=IZH_HUAWEI1:Gi0/0/20 mac-address=64:D1:54:82:0A:A6
set [ find default-name=ether6 ] mac-address=64:D1:54:82:0A:A7 speed=100Mbps
set [ find default-name=ether7 ] mac-address=64:D1:54:82:0A:A8 speed=100Mbps
set [ find default-name=ether8 ] mac-address=64:D1:54:82:0A:A9 speed=100Mbps
set [ find default-name=sfp-sfpplus1 ] advertise=10M-full,100M-full,1000M-full mac-address=64:D1:54:82:0A:A0
set [ find default-name=sfp-sfpplus2 ] advertise=10M-full,100M-full,1000M-full mac-address=64:D1:54:82:0A:A1
/interface eoip
add local-address=10.18.128.0 mac-address=FE:FE:34:E0:3F:C7 mtu=1512 name=EoIP-10.18.128.3 remote-address=10.18.128.3 tunnel-id=10003
add local-address=10.18.128.0 mac-address=FE:4B:D7:E4:97:11 mtu=1512 name=EoIP-10.18.128.4 remote-address=10.18.128.4 tunnel-id=10004
add local-address=10.18.128.0 mac-address=FE:95:3D:F3:05:5C mtu=1512 name=EoIP-10.18.128.6 remote-address=10.18.128.6 tunnel-id=10006
add local-address=10.18.128.0 mac-address=FE:2C:E2:EF:B4:00 mtu=1512 name=EoIP-10.18.128.11 remote-address=10.18.128.11 tunnel-id=10011
add local-address=10.18.128.0 mac-address=FE:96:E7:0C:A3:41 mtu=1512 name=EoIP-10.18.128.13 remote-address=10.18.128.13 tunnel-id=10013
add local-address=10.18.128.0 mac-address=FE:96:38:7F:8A:3E mtu=1512 name=EoIP-10.18.128.14 remote-address=10.18.128.14 tunnel-id=10014
add local-address=10.18.128.0 mac-address=FE:76:29:97:83:CC mtu=1512 name=EoIP-10.18.128.19 remote-address=10.18.128.19 tunnel-id=10019
add local-address=10.18.128.0 mac-address=FE:D2:06:E1:6F:8C mtu=1512 name=EoIP-10.18.128.27 remote-address=10.18.128.27 tunnel-id=10027
add local-address=10.18.128.0 mac-address=FE:D2:06:E1:6F:8C mtu=1512 name=EoIP-10.18.128.33 remote-address=10.18.128.33 tunnel-id=10033
add local-address=10.18.128.0 mac-address=FE:FD:C8:2C:BE:38 mtu=1512 name=EoIP-10.18.128.67 remote-address=10.18.128.67 tunnel-id=10067
add local-address=10.18.128.0 mac-address=FE:88:1C:4E:CC:35 mtu=1512 name=EoIP-10.18.128.68 remote-address=10.18.128.68 tunnel-id=10068
add local-address=10.18.128.0 mac-address=FE:06:6C:E0:B7:6C mtu=1512 name=EoIP-10.18.128.85 remote-address=10.18.128.85 tunnel-id=10085
add local-address=10.18.128.0 mac-address=FE:E1:59:7E:0E:C5 mtu=1512 name=EoIP-10.18.128.90 remote-address=10.18.128.90 tunnel-id=10090
add allow-fast-path=no comment=::EoIP-EKB_REG_MIKR-IZH_CITY_MIKR local-address=92.50.221.222 mac-address=FE:B1:7A:EC:47:9C mtu=1600 name=EoIP-EKB_REG_MIKR-IZH_CITY_MIKR remote-address=ekb-reg1.aggregation.freshtel.rt-comm.ru tunnel-id=20018
/interface gre
add comment=SRX_M9 local-address=92.50.221.222 mtu=1500 name=gre-tun100-M9 remote-address=188.112.220.34
add comment=MSK-Comcity-SRX345:gr-0/0/0.100 keepalive=5s,2 local-address=10.0.10.2 mtu=1376 name=gre-tunnel1 remote-address=10.0.10.1
/interface vpls
add disabled=no l2mtu=1500 mac-address=02:3D:4B:4F:99:E0 mtu=1400 name=vpls1069 remote-peer=10.18.73.69 vpls-id=1:1069
/interface vrrp
add interface=Management-UPS name=vrrp-Management-UPS priority=200 vrid=3
add interface=Management-ubiquiti-CPE name=vrrp-Management-ubiquity-CPE priority=200
/interface bonding
add comment=::IZH_MikroTik_2:MikroTikInterConnect link-monitoring=none mode=802.3ad name=MikroTikInterConnect slaves=ether1,ether2 transmit-hash-policy=layer-2-and-3
add comment="::bonding IZH_HUAWEI1:Eth-trunk3" link-monitoring=none mode=802.3ad mtu=9000 name=bonding1 slaves=ether3,ether4 transmit-hash-policy=layer-2-and-3
/interface vlan
add interface=MikroTikInterConnect name=HeardBit vlan-id=3
add interface=bonding1 name=Management-LAN vlan-id=2
add interface=bonding1 name=ether8.11 vlan-id=11
add comment=::internet-ISP interface=bonding1 name=internet-ISP vlan-id=103
add interface=bonding1 name=v1045 vlan-id=1045
add interface=bonding1 name=v1046 vlan-id=1046
add interface=bonding1 name=v1047 vlan-id=1047
add interface=bonding1 name=v1068 vlan-id=1068
add interface=bonding1 name=v2010 vlan-id=2010
add interface=bonding1 name=v2016 vlan-id=2016
add interface=bonding1 name=v2024 vlan-id=2024
add interface=bonding1 name=v2043 vlan-id=2043
add interface=bonding1 name=v2048 vlan-id=2048
add comment="zamena na inline 03_04_2026 Kurilyak M.M." disabled=yes interface=bonding1 name=v2058 vlan-id=2058
add interface=bonding1 name=v2059 vlan-id=2059
add comment="zamena na inline 03_03_2026 Kurilyak M.M." disabled=yes interface=bonding1 name=v2085 vlan-id=2085
add interface=bonding1 name=v2094 vlan-id=2094
add interface=MikroTikInterConnect name=vlan-Management vlan-id=2
add interface=bonding1 name=vlan-Management-UPS vlan-id=3
/interface vrrp
add interface=Management-LAN name=VRRP-Management-LAN priority=200 vrid=4
add interface=internet-ISP name=vrrp-internet-ISP on-backup="{/system script run TuneVRRPPriorityOnSlaveInterface;}" on-master="{/system script run TuneVRRPPriorityOnSlaveInterface}" priority=200 vrid=2
/interface list
add name=discover
add name=Remote
add name=Local
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec profile
add dh-group=modp2048 enc-algorithm=3des hash-algorithm=md5 name=profile_1
add dh-group=modp1536 dpd-interval=10s enc-algorithm=aes-256 lifetime=8h name=MSK-Comcity-SRX345-profile
/ip ipsec peer
add address=188.112.192.250/32 exchange-mode=ike2 local-address=92.50.221.222 name=MSK-Comcity-SRX345 profile=MSK-Comcity-SRX345-profile
/ip ipsec proposal
add auth-algorithms=sha256 enc-algorithms=aes-256-cbc lifetime=4h name=MSK-Comcity-SRX345-proposal pfs-group=modp1536
/ip pool
add name=L2TP-pool-izhevsk1 ranges=10.18.64.2-10.18.67.253
add name=L2TP-pool-izhevsk2 ranges=10.18.68.2-10.18.71.253
/lora servers
add address=eu.mikrotik.thethings.industries down-port=1700 name=TTN-EU up-port=1700
add address=us.mikrotik.thethings.industries down-port=1700 name=TTN-US up-port=1700
add address=eu1.cloud.thethings.industries down-port=1700 name="TTS Cloud (eu1)" up-port=1700
add address=nam1.cloud.thethings.industries down-port=1700 name="TTS Cloud (nam1)" up-port=1700
add address=au1.cloud.thethings.industries down-port=1700 name="TTS Cloud (au1)" up-port=1700
add address=eu1.cloud.thethings.network down-port=1700 name="TTN V3 (eu1)" up-port=1700
add address=nam1.cloud.thethings.network down-port=1700 name="TTN V3 (nam1)" up-port=1700
add address=au1.cloud.thethings.network down-port=1700 name="TTN V3 (au1)" up-port=1700
/ppp profile
add local-address=10.18.67.254 name=L2TP-server-izhevsk1 only-one=no remote-address=L2TP-pool-izhevsk1 use-compression=no use-encryption=yes use-mpls=yes
add local-address=10.18.71.254 name=L2TP-server-izhevsk2 only-one=yes remote-address=L2TP-pool-izhevsk2 use-compression=no use-encryption=yes use-mpls=yes
add name=l2tp-MSK-M9-client use-compression=no use-encryption=yes use-mpls=yes
/interface l2tp-client
add allow=mschap2 connect-to=188.112.220.252 ipsec-secret=zaq12wsX name=l2tp-Izhevsk-MSK-M9 password=hxjwsucystxga3 profile=l2tp-MSK-M9-client user=l2tp-Izhevsk-MSK-M9
/queue simple
add disabled=yes max-limit=52428800/52428800 name=bw_test_dst packet-marks=bw_test_dst
add disabled=yes max-limit=52428800/52428800 name=bw_test_src packet-marks=bw_test_src
/routing bgp instance
add as=65100 name=mng_bgp out-filter=none redistribute-connected=yes router-id=10.0.10.2
/routing ospf area
set [ find default=yes ] disabled=yes
/routing ospf instance
set [ find default=yes ] disabled=yes in-filter=ospf-backbone-in out-filter=ospf-backbone-out redistribute-connected=as-type-2 router-id=10.18.1.33 use-dn=no
/snmp community
set [ find default=yes ] addresses=10.77.1.0/24,10.199.1.0/24,10.77.10.128/27
add addresses=10.77.1.0/24,10.199.1.0/24,10.77.10.128/27 authentication-password=dhdycgets7hw encryption-password=Hydgeytfky1 name=saymon-snmpv3
/system logging action
set 1 disk-file-count=5
set 3 bsd-syslog=yes remote=10.199.1.16 src-address=10.18.1.33 syslog-facility=syslog
/tool user-manager customer
set admin access=own-routers,own-users,own-profiles,own-limits,config-payment-gw
/tool user-manager profile
add name=test_profile name-for-users="" override-shared-users=off owner=admin price=0 starts-at=now validity=0s
add name=10mbps name-for-users="" override-shared-users=off owner=admin price=0 starts-at=now validity=0s
add name=8mbps name-for-users="" override-shared-users=off owner=admin price=0 starts-at=now validity=0s
add name=256kbps name-for-users="" override-shared-users=off owner=admin price=0 starts-at=now validity=0s
/tool user-manager profile limitation
add address-list="" download-limit=0B group-name="" ip-pool="" ip-pool6="" name=10Mb owner=admin rate-limit-min-rx=10485760B rate-limit-min-tx=8388608B rate-limit-rx=10485760B rate-limit-tx=8388608B transfer-limit=0B upload-limit=0B uptime-limit=0s
add address-list="" download-limit=0B group-name="" ip-pool="" ip-pool6="" name=8Mb owner=admin rate-limit-min-rx=8388608B rate-limit-min-tx=8388608B rate-limit-rx=8388608B rate-limit-tx=8388608B transfer-limit=0B upload-limit=0B uptime-limit=0s
add address-list="" download-limit=0B group-name="" ip-pool="" ip-pool6="" name=256k owner=admin rate-limit-min-rx=262144B rate-limit-min-tx=262144B rate-limit-rx=262144B rate-limit-tx=262144B transfer-limit=0B upload-limit=0B uptime-limit=0s
/user group
set full policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,romon,dude,tikapp
/interface bridge filter
add action=drop chain=forward mac-protocol=0x8809
/interface bridge port
add bridge="AC 18-281" interface=v2024
add bridge="AC 18-266" interface=v2010
add bridge="AC 18-272" interface=v2016
add bridge="AC 18-322" interface=v2043
add bridge="AC 18-331" interface=v2048
add bridge="AC 18-341" disabled=yes interface=v2058
add bridge="AC 18-342" interface=v2059
add bridge="AC 18-446" interface=v1045
add bridge="AC 18-447" interface=v1046
add bridge="AC 18-469" interface=v1068
add bridge=QinQ_Izhevsk interface=bonding1
add bridge=Management-ubiquiti-CPE interface=ether8.11
add bridge=QinQ_Izhevsk interface=EoIP-EKB_REG_MIKR-IZH_CITY_MIKR
add bridge="AC 18-281" interface=EoIP-10.18.128.3
add bridge="AC 18-266" interface=EoIP-10.18.128.4
add bridge="AC 18-272" interface=EoIP-10.18.128.6
add bridge="AC 18-322" interface=EoIP-10.18.128.11
add bridge="AC 18-331" interface=EoIP-10.18.128.13
add bridge="AC 18-342" interface=EoIP-10.18.128.14
add bridge="AC 18-341" comment="zamena na inline 03_04_2026 Kurilyak M.M." disabled=yes interface=EoIP-10.18.128.19
add bridge="AC 18-447" interface=EoIP-10.18.128.68
add bridge="AC 18-446" interface=EoIP-10.18.128.67
add bridge="AC 18-469" interface=EoIP-10.18.128.85
add bridge="AC 18-448" interface=v1047
add bridge="AC 18-448" interface=vpls1069
add bridge="AC 18-448" interface=EoIP-10.18.128.90
add bridge=Management interface=vlan-Management
add bridge=Management-UPS interface=vlan-Management-UPS
add bridge="AC 18-370" disabled=yes interface=v2085
add bridge="AC 18-370" comment="zamena na inline 03_03_2026 Kurilyak M.M." disabled=yes interface=EoIP-10.18.128.27
add bridge="AC 18-369" interface=EoIP-10.18.128.33
add bridge="AC 18-369" interface=v2094
/ip neighbor discovery-settings
set discover-interface-list=discover
/ip settings
set tcp-syncookies=yes
/interface l2tp-server server
set authentication=mschap2 default-profile=L2TP-server-izhevsk1 enabled=yes ipsec-secret=zaq12wsX max-mru=1400 max-mtu=1400 use-ipsec=yes
/interface list member
add interface=MikroTikInterConnect list=discover
add list=Remote
add interface=bonding1 list=Local
/interface sstp-server server
set authentication=mschap2 enabled=yes
/ip address
add address=10.18.1.33/30 interface=Management network=10.18.1.32
add address=10.18.1.36 interface=Loopback0_Mgmt-intf network=10.18.1.36
add address=127.0.0.1 interface=null0 network=127.0.0.1
add address=10.18.1.37 interface=Loopback1_GRT network=10.18.1.37
add address=92.50.221.220/29 interface=internet-ISP network=92.50.221.216
add address=10.18.75.254 interface=Loopback2-Mikrotik-Remote-intf network=10.18.75.254
add address=10.18.50.254 interface=vrrp-Management-UPS network=10.18.50.254
add address=10.18.11.1/24 interface=vrrp-Management-ubiquity-CPE network=10.18.11.0
add address=10.18.1.41/30 interface=HeardBit network=10.18.1.40
add address=10.18.2.1 interface=VRRP-Management-LAN network=10.18.2.1
add address=10.18.2.2/27 interface=Management-LAN network=10.18.2.0
add address=10.18.128.0 interface=Loopback-Mikrotik-Remote-L2TP5 network=10.18.128.0
add address=10.18.50.252/24 interface=Management-UPS network=10.18.50.0
add address=92.50.221.222 interface=vrrp-internet-ISP network=92.50.221.222
add address=10.0.10.2 interface=Loopback-Management-GRE-IPSec-1 network=10.0.10.2
add address=10.0.8.2/30 interface=gre-tunnel1 network=10.0.8.0
add address=10.18.11.253/24 interface=Management-ubiquiti-CPE network=10.18.11.0
add address=10.0.6.2/30 interface=gre-tun100-M9 network=10.0.6.0
/ip dhcp-client
add interface=ether1
add disabled=no interface=ether4
/ip dns
set servers=10.77.1.3,77.88.8.8
/ip firewall address-list
add address=192.168.0.0/16 list=Bogon
add address=10.0.0.0/8 list=Bogon
add address=172.16.0.0/12 list=Bogon
add address=127.0.0.0/8 list=Bogon
add address=0.0.0.0/8 list=Bogon
add address=169.254.0.0/16 list=Bogon
add address=10.18.1.33 list=Management_Access
add address=10.77.0.1 list=Management_Access
add address=10.77.1.0/24 list=Management_Access
add address=188.128.72.98 list=Management_Access
add address=92.50.221.217 list=BGP_peers
add address=10.77.10.128/27 list=Management_Access
add address=10.199.1.0/24 list=Management_Access
add address=10.18.1.40/30 list=Management_Access
add address=10.18.2.0/27 list=Management_Access
add address=37.79.222.38 list=Management_Access
add address=92.50.221.221 list=Management_Access
add address=10.18.2.6 list=Management_Access
add address=10.18.11.254 list=Management_Access
add address=10.18.50.253 list=Management_Access
add address=92.50.221.216/29 list=Management_Access
add address=10.18.2.3 list=Management_Access
add address=10.18.1.32/30 list=Management_Access
add address=10.18.72.0/22 list=Local_CPEs
add address=10.18.128.0/24 list=Local_CPEs
add address=10.199.1.16 list=ProvisioningServer
add address=188.112.192.255 list=Management_Access
add address=10.77.13.0/24 list=Management_Access
add address=188.112.192.250 list=Management_Access
add address=10.0.10.1 list=Management_Access
add address=10.0.8.1 list=Management_Access
add address=188.112.220.34 list=Management_Access
add address=10.0.6.1 list=BGP_peers
add address=10.0.6.1 list=Management_Access
add address=10.0.8.1 list=BGP_peers
add address=10.177.1.11 list=Management_Access
add address=10.177.1.5 list=Management_Access
add address=10.199.1.1 list=Management_Access
add list=ddos-attackers
add list=ddos-targets
/ip firewall filter
add action=accept chain=services comment=NTP disabled=yes dst-port=123 protocol=udp
add action=accept chain=input comment="Accept ALL" disabled=yes
add action=accept chain=input comment="accept established connection packets" connection-state=established
add action=accept chain=input comment="accept related connection packets" connection-state=related
add action=drop chain=input comment="drop invalid packets" connection-state=invalid
add action=accept chain=input comment="Allow access to router from Management_Access" src-address-list=Management_Access
add action=jump chain=input comment="jump to chain ICMP" jump-target=ICMP protocol=icmp
add action=jump chain=input comment="jump to chain services" jump-target=services
add action=jump chain=input comment="jump to chain service_BGP" disabled=yes jump-target=service_BGP
add action=accept chain=input comment="Allow Broadcast Traffic" dst-address-type=broadcast
add action=log chain=input log-prefix=Filter:
add action=add-src-to-address-list address-list=psd-list address-list-timeout=10m chain=input comment=Trap_src_ip_closed_ports connection-state=established,new dst-port=!443,22,8921,8443,179,646 protocol=tcp
add action=drop chain=input comment="Drop everything else"
add action=drop chain=input comment="drop everything else"
add action=jump chain=forward jump-target=CPE-Protect src-address-list=Local_CPEs
add action=accept chain=ICMP comment="0:0 and limit for 5pac/s" dst-limit=5,5,src-and-dst-addresses/1m40s icmp-options=0:0-255 protocol=icmp
add action=accept chain=ICMP comment="3:3 and limit for 5pac/s" dst-limit=5,5,src-and-dst-addresses/1m40s icmp-options=3:3 protocol=icmp
add action=accept chain=ICMP comment="3:4 and limit for 5pac/s" dst-limit=5,5,src-and-dst-addresses/1m40s icmp-options=3:4 protocol=icmp
add action=accept chain=ICMP comment="8:0 and limit for 5pac/s" dst-limit=5,5,src-and-dst-addresses/1m40s icmp-options=8:0-255 protocol=icmp
add action=accept chain=ICMP comment="11:0 and limit for 5pac/s" dst-limit=5,5,src-and-dst-addresses/1m40s icmp-options=11:0-255 protocol=icmp
add action=drop chain=ICMP comment="Drop everything else" protocol=icmp
add action=accept chain=services comment="MACwinbox " disabled=yes dst-port=20561 protocol=udp
add action=accept chain=services comment="Bandwidth server" disabled=yes dst-port=2000 protocol=tcp
add action=accept chain=services comment="MT Discovery Protocol" disabled=yes dst-port=5678 protocol=udp
add action=accept chain=services comment=SNMP disabled=yes dst-port=161 protocol=tcp
add action=accept chain=services comment="OpenVPN INCARNET" disabled=yes dst-port=4444 protocol=tcp src-address=89.208.152.78/31
add action=accept chain=services comment=PPTP disabled=yes dst-port=1723 protocol=tcp
add action=accept chain=services comment="PPTP and EoIP" disabled=yes protocol=gre src-address=188.254.18.78
add action=accept chain=services comment="DNS request" disabled=yes dst-port=53 protocol=tcp
add action=accept chain=services comment="DNS request" disabled=yes dst-port=53 protocol=udp
add action=accept chain=services comment=UPnP disabled=yes dst-port=1900 protocol=udp
add action=accept chain=services comment=UPnP disabled=yes dst-port=2828 protocol=tcp
add action=accept chain=services comment=DHCP disabled=yes dst-port=67-68 protocol=udp
add action=accept chain=services comment="Web Proxy" disabled=yes dst-port=8080 protocol=tcp
add action=accept chain=services comment=IPIP disabled=yes protocol=ipencap
add action=accept chain=services comment="https for Hotspot" disabled=yes dst-port=443 protocol=tcp
add action=accept chain=services comment="Socks for Hotspot" disabled=yes dst-port=1080 protocol=tcp
add action=accept chain=services comment=WinBox disabled=yes dst-address=188.112.192.250 dst-port=8291 protocol=tcp
add action=accept chain=services comment="IPSec connections" dst-port=500 protocol=udp src-address=188.112.192.250
add action=accept chain=services comment=IPSec dst-port=4500 protocol=udp src-address=188.112.192.250
add action=accept chain=services comment=IPSec protocol=ipsec-esp
add action=accept chain=services comment=IPSec protocol=ipsec-ah
add action=accept chain=services comment=RIP disabled=yes dst-port=520-521 protocol=udp
add action=accept chain=services comment=OSPF protocol=ospf
add action=accept chain=services comment=LDP dst-address-list=Bogon dst-port=646 protocol=udp src-address-list=Bogon
add action=accept chain=services comment=LDP dst-address-list=Bogon dst-port=646 protocol=tcp src-address-list=Bogon
add action=accept chain=services comment=LDP dst-address=224.0.0.2 dst-port=646 protocol=udp
add action=accept chain=services comment=LDP dst-address=224.0.0.2 dst-port=646 protocol=tcp
add action=jump chain=forward comment=Detect-DDoS connection-state=new jump-target=detect-ddos packet-mark=!zabbix
add action=accept chain=services comment="SSTP connection" dst-port=443 protocol=tcp
add action=accept chain=services comment="L2TP connection" dst-port=1701 protocol=udp
add action=accept chain=services comment="BW test" disabled=yes dst-port=2000-2010 protocol=tcp
add action=accept chain=services comment="BW test" disabled=yes dst-port=2000-2410 protocol=udp
add action=accept chain=services comment=GRE protocol=gre
add action=return chain=detect-ddos comment=Detect-DDoS dst-limit=64,64,src-and-dst-addresses/10s
add action=add-dst-to-address-list address-list=ddos-targets address-list-timeout=20m chain=detect-ddos comment=Detect-DDoS
add action=add-src-to-address-list address-list=ddos-attackers address-list-timeout=20m chain=detect-ddos comment=Detect-DDoS
add action=return chain=detect-ddos comment="Detect-DDoS SYN-ACK Flood" dst-limit=32,32,src-and-dst-addresses/10s protocol=tcp tcp-flags=syn,ack
add action=return chain=services
add action=accept chain=service_BGP comment=BGP dst-port=179 protocol=tcp src-address-list=BGP_peers
add action=accept chain=service_BGP comment=BGP dst-port=5000-5100 protocol=udp src-address-list=BGP_peers
add action=return chain=service_BGP
add action=accept chain=CPE-Protect dst-address-list=ProvisioningServer dst-port=8443 protocol=tcp
add action=accept chain=CPE-Protect dst-address-list=ProvisioningServer protocol=icmp
add action=drop chain=CPE-Protect comment="Disable new sessions from CPE" connection-state=new
add action=accept chain=CPE-Protect comment="allow all other"
add action=return chain=CPE-Protect
add action=accept chain=input comment=BFD dst-port=3784 log=yes protocol=udp src-port=""
/ip firewall mangle
add action=accept chain=prerouting packet-mark=bw_test_src
add action=mark-connection chain=prerouting dst-address=10.18.75.254 new-connection-mark=bw_test_conn_dst passthrough=yes
add action=mark-packet chain=prerouting connection-mark=bw_test_conn_dst new-packet-mark=bw_test_dst passthrough=no
add action=accept chain=postrouting packet-mark=bw_test_dst
add action=mark-connection chain=postrouting new-connection-mark=bw_test_conn_src passthrough=yes src-address=10.18.75.254
add action=mark-packet chain=postrouting connection-mark=bw_test_conn_src new-packet-mark=bw_test_src
add action=mark-packet chain=prerouting connection-state=new new-packet-mark=zabbix passthrough=yes src-address=10.199.1.8
/ip firewall raw
add action=drop chain=prerouting dst-address-list=ddos-targets src-address-list=ddos-attackers
add action=drop chain=prerouting comment=Trap_src_ip_closed_ports src-address-list=psd-list
/ip firewall service-port
set sip disabled=yes
/ip ipsec identity
add peer=MSK-Comcity-SRX345 secret=72bMtFJU7DCKDWfUoDDypyP2HK2xmS2L
/ip ipsec policy
add dst-address=10.0.10.1/32 peer=MSK-Comcity-SRX345 proposal=MSK-Comcity-SRX345-proposal src-address=10.0.10.2/32 tunnel=yes
/ip route
add check-gateway=ping distance=1 gateway=92.50.221.217
add distance=130 dst-address=10.18.1.32/30 type=blackhole
add distance=130 dst-address=10.18.72.0/22 type=blackhole
add distance=130 dst-address=10.18.128.0/24 type=blackhole
add comment="Wait to delete" disabled=yes distance=1 dst-address=10.66.2.37/32 gateway=10.66.2.129
add distance=240 dst-address=10.77.1.0/24 gateway=10.18.1.34
add distance=240 dst-address=10.77.2.0/24 gateway=10.18.1.34
add distance=240 dst-address=10.77.10.128/27 gateway=10.18.1.34
add distance=240 dst-address=10.77.13.0/24 gateway=10.18.1.34
add distance=240 dst-address=10.199.1.0/24 gateway=10.18.1.34
add distance=240 dst-address=192.168.222.0/24 gateway=10.18.1.34
/ip route vrf
add disabled=yes interfaces=*5E4 routing-mark=test
/ip service
set www disabled=yes
set api address=10.199.1.6/32
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/ipv6 nd
set [ find default=yes ] advertise-dns=no
/mpls interface
set [ find default=yes ] mpls-mtu=1400
/mpls ldp
set enabled=yes lsr-id=10.18.75.254 transport-address=10.18.75.254
/ppp secret
add local-address=10.18.128.0 name=L2tp-10.18.128.3 password=003128018010 profile=default-encryption remote-address=10.18.128.3
add local-address=10.18.128.0 name=L2tp-10.18.128.4 password=004128018010 profile=default-encryption remote-address=10.18.128.4
add local-address=10.18.128.0 name=L2tp-10.18.128.6 password=006128018010 profile=default-encryption remote-address=10.18.128.6
add local-address=10.18.128.0 name=L2tp-10.18.128.11 password=011128018010 profile=default-encryption remote-address=10.18.128.11
add local-address=10.18.128.0 name=L2tp-10.18.128.13 password=013128018010 profile=default-encryption remote-address=10.18.128.13
add local-address=10.18.128.0 name=L2tp-10.18.128.14 password=014128018010 profile=default-encryption remote-address=10.18.128.14
add local-address=10.18.128.0 name=L2tp-10.18.128.19 password=019128018010 profile=default-encryption remote-address=10.18.128.19
add local-address=10.18.128.0 name=L2tp-10.18.128.68 password=068128018010 profile=default-encryption remote-address=10.18.128.68
add local-address=10.18.128.0 name=L2tp-10.18.128.67 password=067128018010 profile=default-encryption remote-address=10.18.128.67
add local-address=10.18.128.0 name=L2tp-10.18.128.85 password=085128018010 profile=default-encryption remote-address=10.18.128.85
add disabled=yes local-address=10.18.67.254 name=l2tp-user1069.1 password=Udmurtiya1069 profile=L2TP-server-izhevsk1 remote-address=10.18.65.69 service=l2tp
add local-address=10.18.128.0 name=L2tp-10.18.128.90 password=090128018010 profile=default-encryption remote-address=10.18.128.90
add local-address=10.18.128.0 name=L2tp-10.18.128.27 password=027128018010 profile=default-encryption remote-address=10.18.128.27
add local-address=10.18.128.0 name=L2tp-10.18.128.33 password=033128018010 profile=default-encryption remote-address=10.18.128.33
/radius
add address=10.199.1.16 secret=Jucmv8shc6abckvid service=login src-address=10.18.1.33
add address=10.77.1.110 require-message-auth=no secret=Jucmv8shc6abckvid service=login src-address=10.18.1.33
/routing bgp aggregate
add advertise-filter=none attribute-filter=none include-igp=yes instance=mng_bgp prefix=10.18.128.0/24 suppress-filter=no
/routing bgp peer
add in-filter=none instance=mng_bgp name=M9_SRX out-filter=none remote-address=10.0.6.1 remote-as=65010 update-source=10.0.6.2 use-bfd=yes
add in-filter=none instance=mng_bgp name=Comcity_SRX out-filter=none remote-address=10.0.8.1 remote-as=65011 update-source=10.0.8.2 use-bfd=yes
/snmp
set enabled=yes location=Izhevsk src-address=10.18.1.33
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Moscow
/system identity
set name=Izhevsk_MikroTik_1
/system logging
add action=disk disabled=yes prefix=DEBUG topics=debug
add action=remote topics=error
add action=remote topics=warning
add action=remote topics=info,!firewall
add action=remote topics=critical
add action=disk topics=info,!firewall
add action=disk topics=warning
add action=disk topics=error
add action=disk topics=critical
/system note
set note="Freshtel Networks, LLC - Authorized administrators only. Access to this device is monitored."
/system ntp client
set enabled=yes primary-ntp=10.177.1.5 secondary-ntp=10.199.1.1
/system package update
set channel=long-term
/system routerboard settings
set auto-upgrade=yes
/system scheduler
add comment=CheckHealth disabled=yes interval=30s name=CheckHealth on-event=CheckHealth policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=nov/26/2018 start-time=11:58:38
add comment=CheckPrimary disabled=yes interval=30s name=CheckPrimary on-event=CheckPrimary policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=may/21/2019 start-time=13:36:26
add comment=DistortTheShutter disabled=yes interval=50s name=DistortTheShutter on-event=DistortTheShutter policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=sep/21/2020 start-time=16:08:36
add comment=UpAndDown name=UpAndDown on-event=UpAndDown policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-time=startup
add comment=WatchDog interval=5m name=WatchDog on-event=WatchDog policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=feb/09/2023 start-time=14:27:25
/system script
add dont-require-permissions=no name=OnBoot owner=freshroot policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="{\r \n :local ProductionInterface \"bonding1\";\r \n /interface bonding disable \$ProductionInterface;\r \n}"
add dont-require-permissions=no name=RestartNotWorkingVlanInterfaces owner=freshroot policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="{\r\n\t:local i;\r \n\t:foreach i in=[/interface vlan find where !running && !disabled] do={\r \n /interface vlan disable \$i;\r \n :delay 1;\r \n\t /interface vlan enable \$i;\r \n\t}\r \n}"
add dont-require-permissions=no name=CheckHealth owner=freshroot policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="{\n \n :local ScriptName \"CheckHealth\"; \n :local WarningPrefix \"\$ScriptName: \"; \n \n :local ProductionInterface \"bonding1\"; \n \n :local HeardBit \"HeardBit\"; \n \n :local EtalonOspfRoutesNumber -1; \n# :local EtalonOspfRoutesNumber 1; \n \n :local Delay 2; \n \n :local Delay2 60; \n \n :local BondingPhysicalInt1 \"ether3\"; \n \n :local BondingPhysicalInt2 \"ether4\"; \n \n :log warning message=(\"\$WarningPrefix Started\"); \n \n :if ( [/system script job find where script=\"DistortTheShutter\" || script=\"CheckPrimary\" || script=\"OnBoot\" || script=\"UpAndDown\"]!=\"\") do={ \n \n :put \"9--\"; \n \n :log warning message=(\"\$WarningPrefix Ended\"); \n \n :put \"9.1--\"; \n \n :return 0; \n }; \n \n :if ([/system script job print count-only where script=\$ScriptName]>1) do={ \n :log warning message=(\"\$WarningPrefix Ended\"); \n :return 0; \n } \n \n :local PPPActiveCount [/ppp active print count]; \n :local VPLSRunningCount [/interface vpls print count where running]; \n :local EoIPRunningCount [/interface eoip print count where running]; \n :local L2TPClientsRunningCount [/interface l2tp-client print count where running]; \n \n :local OSPFRoutesNumber [/ip route print count-only where ospf]; \n \n :local PPPActiveNumber [/ppp active print count-only]; \n \n :local InterfaceDisabled [/interface get [find name=\$HeardBit] disabled]; \n \n :if ((\$OSPFRoutesNumber<\$EtalonOspfRoutesNumber) || ((\$PPPActiveNumber=0) && (\$VPLSRunningCount=0) && (\$EoIPRunningCount=0) && (\$L2TPClientsRunningCount=0)) || (\$InterfaceDisab led=true)) do={ \n \n :log error message=(\"Netwatch: \$WarningPrefix number of OSPF routes is \$OSPFRoutesNumber, number of PPP active connections is \$PPPActiveNumber, number VPLS running connections is \$VPLSRunningCount, number EoIP running connections is \$EoIPRunningCount, status of \$HeardBit interface is \$InterfaceDisabled . Shutdown production interface \$ProductionInterface.\"); \n \n :delay \$Delay; \n \n /interface bonding disable [find name=\$ProductionInterface] \n \n /interface ethernet disable \$BondingPhysicalInt1; \n \n /interface ethernet disable \$BondingPhysicalInt2; \n \n /interface vlan disable [find where name=\$HeardBit]; \n \n /system scheduler disable [find name=CheckHealth]; \n \n :delay \$Delay2; \n \n /interface vlan enable [find name=\$HeardBit]; \n \n } \n \n :log warning message=(\"\$WarningPrefix Ended\"); \n \n}"
add dont-require-permissions=no name=PingRemoteSideISP owner=freshroot policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="{\r\n\r \n :local WarningPrefix \"PingRemoteSideISP: \";\r \n\r \n :log warning message=(\"\$WarningPrefix Started\");\r \n\r \n :local Count 2;\r \n :local InternetInterface \"internet-ISP\";\r \n# :local InternetInterface \"Loopback-Internet-intf\";\r \n\r \n :local ISPGatewayIP [/ip route get [find where static && dst-address=\"0.0.0.0/0\"] gateway];\r \n :local i;\r \n\r \n :foreach i in=[/ip address find where interface~\$InternetInterface] do={\r \n :local SRCIP [/ip address get \$i address];\r \n :set SRCIP [:pick [:tostr \$SRCIP] 0 (([:len [:tostr \$SRCIP]])-3)];\r \n :ping count=\$Count src-address=\$SRCIP \$ISPGatewayIP;\r \n }\r \n\r \n :log warning message=(\"\$WarningPrefix Ended\");\r \n}"
add dont-require-permissions=no name=DistortTheShutter owner=freshroot policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="{\n \n :local WarningPrefix \"DistortTheShutter: \"; \n \n :put \"1--\"; \n \n :log warning message=(\"\$WarningPrefix Started\"); \n \n :put \"1.1--\"; \n \n :local TimeFromLastRebooted [/system resource get uptime]; \n \n :put \"1.2--\"; \n \n :local DistortTheShutterPeriod [/system scheduler get [find where name=DistortTheShutter] interval]; \n \n :put \"1.3--\"; \n \n :local CheckPrimaryPeriod [/system scheduler get [find where name=CheckPrimary] interval]; \n \n :put \"2--\"; \n \n :local TimerFromLastRebootedConst (\$DistortTheShutterPeriod*3); \n \n :if (\$TimerFromLastRebootedConst<2m) do { :set TimerFromLastRebootedConst 2m;} \n \n :put \"2.1--\"; \n \n :local Delay1 3; \n \n :put \"3--\"; \n \n :local TimerMaxUptimeConst (3*\$TimerFromLastRebootedConst); \n \n :put \"3.1--\"; \n \n :local TimeWaitAfterRebootConst (1m+\$TimerFromLastRebootedConst); \n \n :put \"4--\"; \n :local EtalonOspfRoutesNumber 1; \n \n :put \"5--\"; \n \n :local PPPActiveCount [/ppp active print count]; \n :local VPLSRunningCount [/interface vpls print count where running]; \n :local EoIPRunningCount [/interface eoip print count where running]; \n :local L2TPClientsRunningCount [/interface l2tp-client print count where running]; \n :local OSPFRoutesNumber [/ip route print count-only where ospf]; \n :global TimePrimaryDown; \n \n :put \"6--\"; \n \n :local NegativeCheckHealthStatus [[/system scheduler get [find where name=CheckHealth] disabled]]; \n \n :put \"7-- NegativeCheckHealthStatus is \$NegativeCheckHealthStatus\"; \n \n :local NegativeCheckPrimaryStatus [[/system scheduler get [find where name=CheckPrimary] disabled]]; \n \n :put \"8-- NegativeCheckPrimaryStatus is \$NegativeCheckPrimaryStatus\"; \n \n :local DefaultGwAvalibility false; \n \n :put \"8.1\"; \n \n :if ([/ip route find where active && dst-address=\"0.0.0.0/0\"]!=\"\") do={ :set DefaultGwAvalibility true;} ; \n \n :put \"8.2-- DefaultGwAvalibility is \$DefaultGwAvalibility\"; \n \n :if ( [/system script job find where script=\"CheckHealth\" || script=\"CheckPrimary\" || script=\"OnBoot\" || script=\"UpAndDown\"]!=\"\") do={ \n \n :put \"9--\"; \n \n :log warning message=(\"\$WarningPrefix Ended\"); \n \n :put \"9.1--\"; \n \n :return 0; \n }; \n \n :put \"10--\"; \n \n :delay \$Delay1; \n \n :put \"10.1--\"; \n \n# Old primary \n \n :put \"10.2-- DefaultGwAvalibility is \$DefaultGwAvalibility\"; \n :put \"10.3-- NegativeCheckHealthStatus is \$NegativeCheckHealthStatus\"; \n :put \"10.4-- NegativeCheckPrimaryStatus is \$NegativeCheckPrimaryStatus\"; \n :put \"10.5-- PPPActiveCount is \$PPPActiveCount\"; \n :put \"10.6-- TimeFromLastRebooted is \$TimeFromLastRebooted\"; \n :put \"10.7-- VPLSRunningCount is \$VPLSRunningCount\"; \n :put \"10.8-- EoIPRunningCount is \$EoIPRunningCount\"; \n :put \"10.9-- L2TPClientsRunningCount is \$L2TPClientsRunningCount\"; \n :put \"10.10-- EtalonOspfRoutesNumber is \$EtalonOspfRoutesNumber\"; \n :put \"10.11-- OSPFRoutesNumber is \$OSPFRoutesNumber\"; \n \n :put \"10.13-- Old Primary\? \"; \n \n :if (\$NegativeCheckHealthStatus && \$NegativeCheckPrimaryStatus && (\$PPPActiveCount=0 && \$VPLSRunningCount=0 && \$EoIPRunningCount=0 && \$L2TPClientsRunningCount=0 && \$OSPFRoutesNumber< \$EtalonOspfRoutesNumber)) do={ \n \n :put \"11-- Yes, Old Primary!\"; \n \n :if (\$TimeFromLastRebooted>\$TimerMaxUptimeConst) do={ \n \n :put \"12--\"; \n \n :execute {:delay 1; /system reboot}; \n \n :put \"12.1--\"; \n \n :log warning message=(\"\$WarningPrefix Ended\"); \n \n :put \"12.2--\"; \n \n :return 0; \n }; \n \n :put \"13--\"; \n \n :if (\$TimeFromLastRebooted>\$TimeWaitAfterRebootConst) do={ \n \n :put \"13.1--\"; \n \n /system scheduler enable [find where name=\"CheckPrimary\"]; \n }; \n return 0; \n } \n \n# New primary \n \n :put \"14.1-- New Primary\?\" ; \n \n :if ((\$TimeFromLastRebooted-\$TimePrimaryDown)>=(\$TimeWaitAfterRebootConst+\$DistortTheShutterPeriod+(\$CheckPrimaryPeriod*2)) && \$NegativeCheckHealthStatus && !\$NegativeCheckPrimarySta tus && (\$PPPActiveCount>0 || \$VPLSRunningCount>0 || \$EoIPRunningCount>0 || \$L2TPClientsRunningCount>0 || \$OSPFRoutesNumber>=\$EtalonOspfRoutesNumber)) do={ \n \n :put \"14.2-- Yes, New Primary!\"; \n \n /system scheduler disable [find where name=\"CheckPrimary\"]; \n \n :put \"14.3--\"; \n \n :if (\$OSPFRoutesNumber>=\$EtalonOspfRoutesNumber ) do={ \n \n :put \"14.3.1--\"; \n /system scheduler enable [find where name=\"CheckHealth\"]; \n } \n } \n \n :put \"15.1-- Yes, New Primary, but with bad OSPF history\?\"; \n \n :if ((\$TimeFromLastRebooted-\$TimePrimaryDown)>=(\$TimeWaitAfterRebootConst+\$DistortTheShutterPeriod+(\$CheckPrimaryPeriod*2)) && \$NegativeCheckHealthStatus && \$NegativeCheckPrimaryStat us && (\$PPPActiveCount>0 || \$VPLSRunningCount>0 || \$EoIPRunningCount>0 || \$L2TPClientsRunningCount>0) && \$OSPFRoutesNumber>=\$EtalonOspfRoutesNumber) do={ \n \n :put \"15.2-- Yes, New Primary and OSPF history was not good, but now it is OK)\"; \n \n /system scheduler enable [find where name=\"CheckHealth\"]; \n \n } \n \n :put \"17--\"; \n :log warning message=(\"\$WarningPrefix Ended\");\r \n :put \"18--\"; \n}"
add dont-require-permissions=no name=UpAndDown owner=modest policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="{\n \n :local Interfaces {\"MikroTikInterConnect\";\"bonding1\"}; \n \n :local Delay 10; \n \n :local VRRPReservation false; \n \n :local i; \n \n :delay (\$Delay*2); \n \n :foreach i in=\$Interfaces do={ \n \n :if ([/interface find where name=\$i && (!disabled || \$VRRPReservation)]!=\"\") do={ \n \n /interface disable \$i; \n \n :delay \$Delay; \n \n /interface enable \$i; \n \n } \n \n } \n}"
add dont-require-permissions=no name=CheckPrimary owner=freshroot policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="{\n \n :local ScriptName \"CheckPrimary\"; \n :local WarningPrefix \"\$ScriptName: \"; \n \n :global TimePrimaryDown; \n \n :local ProductionInterface \"bonding1\"; \n \n :local Count 8; \n \n :local Interval 1; \n \n :local Timeout \"1s\"; \n \n :local IPAddress; \n \n :local Delay 2; \n \n :local Delay2 30; \n \n :local InterfaceDisabled; \n \n :local BondingPhysicalInt1 \"ether3\"; \n \n :local BondingPhysicalInt2 \"ether4\"; \n \n :local InternetInterface \"internet-ISP\"; \n \n :log warning message=(\"\$WarningPrefix Started\"); \n \n :if ( [/system script job find where script=\"DistortTheShutter\" || script=\"CheckHealth\" || script=\"OnBoot\" || script=\"UpAndDown\"]!=\"\") do={ \n \n :put \"9--\"; \n \n :log warning message=(\"\$WarningPrefix Ended\"); \n \n :put \"9.1--\"; \n \n :return 0; \n }; \n \n :if ([/system script job print count-only where script=\$ScriptName]>1) do={ \n :log warning message=(\"\$WarningPrefix Ended\"); \n :return 0; \n } \n \n :if ( [/interface vlan get [find where name=\$InternetInterface] loop-protect-status]=\"disabled\" ) do={ \n /interface disable \$ProductionInterface; \n /interface disable \$BondingPhysicalInt1; \n /interface disable \$BondingPhysicalInt2; \n \n } \n \n :log warning message=(\"\$WarningPrefix: 5----\"); \n \n :set InterfaceDisabled [/interface bonding get [find name=\$ProductionInterface] disabled]; \n \n :if ( \$InterfaceDisabled ) do={ \n \n :log warning message=(\"\$WarningPrefix: 5.1----\"); \n \n :if ([/interface ethernet find where name=\$BondingPhysicalInt1 && disabled]=\"\") do={/interface disable \$BondingPhysicalInt1}; \n :if ([/interface ethernet find where name=\$BondingPhysicalInt2 && disabled]=\"\") do={/interface disable \$BondingPhysicalInt2}; \n } else={ \n \n :log warning message=(\"\$WarningPrefix: 5.2----\"); \n \n :if ([/interface ethernet find where name=\$BondingPhysicalInt1 && disabled]!=\"\") do={/interface enable \$BondingPhysicalInt1}; \n :if ([/interface ethernet find where name=\$BondingPhysicalInt2 && disabled]!=\"\") do={/interface enable \$BondingPhysicalInt2}; \n } \n \n :local InterfaceHeardBit \"HeardBit\"; \n :local IPAddressHeardBitString [/ip address get [find where interface=\$InterfaceHeardBit] address]; \n \n :local IPAddressHeardBitIPStr [:tostr [:toip [:pick \$IPAddressHeardBitString 0 [:find \$IPAddressHeardBitString \"/\"]]]]; \n \n :local IPAddressHeardBitIPLastOctetStr [:tostr ([:toip [:pick \$IPAddressHeardBitString 0 [:find \$IPAddressHeardBitString \"/\"]]]<<24)]; \n :local IPAddressHeardBitIPLastOctetNum [:tonum ([:pick \$IPAddressHeardBitIPLastOctetStr 0 [:find \$IPAddressHeardBitIPLastOctetStr \".\"]])]; \n \n :local IPNetworIPLastOctetStr [:tostr ([:toip [/ip address get [find where interface=HeardBit] network]]<<24)]; \n :local IPNetworkIPLastOctetNum [:tonum ([:pick \$IPNetworIPLastOctetStr 0 [:find \$IPNetworIPLastOctetStr \".\"]])]; \n \n :local n -1; \n \n :for i from=1 to=3 step=1 do={ :local a ([:find \$IPAddressHeardBitIPStr \".\" \$n]); :set n \$a;} \n :local SubStr [:pick \$IPAddressHeardBitIPStr 0 \$n ]; \n \n :if (\$IPAddressHeardBitIPLastOctetNum-\$IPNetworkIPLastOctetNum=1) do={ \n :set IPAddress (\$SubStr.\".\".\$IPNetworkIPLastOctetNum+2); \n } else={ \n :set IPAddress (\$SubStr.\".\".\$IPNetworkIPLastOctetNum+1); \n } \n \n :log warning message=(\"\$WarningPrefix: 6----\"); \n \n :if ([/ping \$IPAddress interval=\$Interval count=\$Count]=0) do={ \n \n :log warning message=(\"\$WarningPrefix: 7----\"); \n \n :if (\$InterfaceDisabled=true) do={ \n \n :log warning message=(\"\$WarningPrefix: 8----\"); \n \n :local ThisRouter [/system identity get name]; \n :log error message=(\"Netwatch: switched to \$ThisRouter router \"); \n \n# /interface enable HeardBit; \n \n :delay \$Delay; \n \n# :delay \$Delay2; \n \n /interface ethernet disable \$BondingPhysicalInt1; \n /interface ethernet disable \$BondingPhysicalInt2; \n \n :delay \$Delay2; \n :log warning message=(\"\$WarningPrefix: 10----\"); \n /interface ethernet enable \$BondingPhysicalInt1; \n :log warning message=(\"\$WarningPrefix: 11----\"); \n /interface ethernet enable \$BondingPhysicalInt2; \n :log warning message=(\"\$WarningPrefix: 12----\"); \n# /interface bonding set [find where name=\$ProductionInterface] disabled=no; \n /interface bonding enable \$ProductionInterface; \n :set TimePrimaryDown [/system resource get uptime]; \n \n } \n :delay \$Delay2; \n /system script run RestartNotWorkingVlanInterfaces; \n /system script run PingRemoteSideISP; \n \n } \n \n :log warning message=(\"\$WarningPrefix Ended\"); \n \n}"
add dont-require-permissions=no name=Version owner=freshroot policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="{\r \n :local Version \"20210903-01\";\r \n :put \$Version;\r \n}"
add dont-require-permissions=no name=TuneVRRPPriorityOnSlaveInterface owner=freshroot policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="{\r\n :local Version \"20221212-01\";\r \n :local Delay 10;\r \n :local MasterInterface \"vrrp-internet-ISP\";\r \n :local SlaveInterfaces [:toarray \"\"];\r \n :local InterfaceUPDownConditionString \"_CtrlUpDown_\";\r \n :local i;\r \n :foreach i in=[/interface vrrp find] do={\r \n :local Interface [/interface vrrp get number=\$i value-name=name]\r \n :if (\$Interface != \$MasterInterface) do={\r \n :set SlaveInterfaces (\$SlaveInterfaces, \$Interface);\r \n }\r \n }\r \n :local NotDisabledGREInterfaces [:toarray \"\"];\r \n :foreach i in=[/interface gre find where !disabled] do={\r \n :local Interface [/interface gre get number=\$i value-name=name]\r \n :set NotDisabledGREInterfaces (\$NotDisabledGREInterfaces, \$Interface);\r \n }\r \n :local Priority [/interface vrrp get [find where name=\$MasterInterface] priority];\r \n :foreach i in=\$SlaveInterfaces do={\r \n /interface vrrp set priority=\$Priority [find where name=\$i];\r \n }\r \n :delay \$Delay;\r \n :foreach i in=\$NotDisabledGREInterfaces do={\r \n /interface disable \$i;\r \n }\r \n /ip ipsec installed-sa flush;\r \n /ip ipsec active-peers kill-connections;\r \n :delay \$Delay;\r \n :foreach i in=\$NotDisabledGREInterfaces do={\r \n /interface enable \$i;\r \n }\r \n :if ([/interface vrrp find where name=\$MasterInterface && backup]!=\"\") do={\r \n /interface disable [find where comment~\"\$InterfaceUPDownConditionString\"];\r \n }\r \n :if ([/interface vrrp find where name=\$MasterInterface && master]!=\"\") do={\r \n /interface enable [find where comment~\"\$InterfaceUPDownConditionString\"];\r \n }\r \n}"
