Situation
* vdsl pppoe using isp modem
* rb5009 initiating its own pppoe sesssion "behind" isp modem
* ipv6 to ' segments behing the RB-5009 dhcp-pd and ra
On my macbook pro
Test-ipv6.com --> 10/10
At first i discoverd a massive slow down when using the gcloud command to access Google Cloud artifact repository.
After further research
* on a linux vm also behind rb-5009 with ipv4 only --> no issue
* linux vm added ipv6 address using RA -> no issue
* macbook pro connected on the vdsl modem via wifi ipv6 --> no issue
* macboo pro connected via wired ethernet on rb-5009 see lower
running this small script
You'll see in output that
* ipv4 is ok
* ipv6 is "sometimes" ok (either all 5 packets are lost, or all 5 packets are OK)
* eg when using gcloud, command sometimes hangs, sometimes is fast
Code: Select all
while true
do
echo "------------$(date)-----------"
ping6 -c 5 lesoir.be
ping -c 5 lesoir.be
sleep 7
done
Code: Select all
------------Jeu 13 jui 2024 18:08:47 CEST-----------
PING6(56=40+8+8 bytes) 2a02:a03f:ae85:5801:f99c:a552:e96c:d65c --> 2a02:a000:1:213::51f3:1b9
16 bytes from 2a02:a000:1:213::51f3:1b9, icmp_seq=0 hlim=59 time=15.896 ms
16 bytes from 2a02:a000:1:213::51f3:1b9, icmp_seq=1 hlim=59 time=47.269 ms
16 bytes from 2a02:a000:1:213::51f3:1b9, icmp_seq=2 hlim=59 time=18.061 ms
16 bytes from 2a02:a000:1:213::51f3:1b9, icmp_seq=3 hlim=59 time=68.550 ms
16 bytes from 2a02:a000:1:213::51f3:1b9, icmp_seq=4 hlim=59 time=114.608 ms
--- lesoir.be ping6 statistics ---
5 packets transmitted, 5 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 15.896/52.877/114.608/36.517 ms
PING lesoir.be (81.242.3.139): 56 data bytes
64 bytes from 81.242.3.139: icmp_seq=0 ttl=59 time=15.926 ms
64 bytes from 81.242.3.139: icmp_seq=1 ttl=59 time=18.839 ms
64 bytes from 81.242.3.139: icmp_seq=2 ttl=59 time=19.548 ms
64 bytes from 81.242.3.139: icmp_seq=3 ttl=59 time=18.237 ms
64 bytes from 81.242.3.139: icmp_seq=4 ttl=59 time=19.110 ms
--- lesoir.be ping statistics ---
5 packets transmitted, 5 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 15.926/18.332/19.548/1.276 ms
------------Jeu 13 jui 2024 18:09:03 CEST-----------
PING6(56=40+8+8 bytes) 2a02:a03f:ae85:5801:f99c:a552:e96c:d65c --> 2a02:a000:1:213::51f3:1b9
--- lesoir.be ping6 statistics ---
5 packets transmitted, 0 packets received, 100.0% packet loss
PING lesoir.be (81.242.3.139): 56 data bytes
64 bytes from 81.242.3.139: icmp_seq=0 ttl=59 time=18.849 ms
64 bytes from 81.242.3.139: icmp_seq=1 ttl=59 time=18.810 ms
64 bytes from 81.242.3.139: icmp_seq=2 ttl=59 time=16.745 ms
64 bytes from 81.242.3.139: icmp_seq=3 ttl=59 time=15.789 ms
64 bytes from 81.242.3.139: icmp_seq=4 ttl=59 time=18.711 ms
--- lesoir.be ping statistics ---
5 packets transmitted, 5 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 15.789/17.781/18.849/1.273 ms
^[[A------------Jeu 13 jui 2024 18:09:29 CEST-----------
PING6(56=40+8+8 bytes) 2a02:a03f:ae85:5801:f99c:a552:e96c:d65c --> 2a02:a000:1:213::51f3:190
16 bytes from 2a02:a000:1:213::51f3:190, icmp_seq=0 hlim=59 time=17.141 ms
16 bytes from 2a02:a000:1:213::51f3:190, icmp_seq=1 hlim=59 time=20.008 ms
16 bytes from 2a02:a000:1:213::51f3:190, icmp_seq=2 hlim=59 time=14.002 ms
16 bytes from 2a02:a000:1:213::51f3:190, icmp_seq=3 hlim=59 time=18.296 ms
16 bytes from 2a02:a000:1:213::51f3:190, icmp_seq=4 hlim=59 time=17.899 ms
--- lesoir.be ping6 statistics ---
5 packets transmitted, 5 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 14.002/17.469/20.008/1.972 ms
PING lesoir.be (81.242.3.194): 56 data bytes
64 bytes from 81.242.3.194: icmp_seq=0 ttl=59 time=14.971 ms
64 bytes from 81.242.3.194: icmp_seq=1 ttl=59 time=15.181 ms
64 bytes from 81.242.3.194: icmp_seq=2 ttl=59 time=15.066 ms
64 bytes from 81.242.3.194: icmp_seq=3 ttl=59 time=14.477 ms
^[64 bytes from 81.242.3.194: icmp_seq=4 ttl=59 time=17.173 ms
--- lesoir.be ping statistics ---
5 packets transmitted, 5 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 14.477/15.374/17.173/0.931 ms
here is my config
Code: Select all
MMM MMM KKK TTTTTTTTTTT KKK
MMMM MMMM KKK TTTTTTTTTTT KKK
MMM MMMM MMM III KKK KKK RRRRRR OOOOOO TTT III KKK KKK
MMM MM MMM III KKKKK RRR RRR OOO OOO TTT III KKKKK
MMM MMM III KKK KKK RRRRRR OOO OOO TTT III KKK KKK
MMM MMM III KKK KKK RRR RRR OOOOOO TTT III KKK KKK
MikroTik RouterOS 7.13 (c) 1999-2023 https://www.mikrotik.com/
Press F1 for help
[admin@rb-00] > /export
# 2024-06-13 18:31:38 by RouterOS 7.13
# software id = QAZ7-JG2P
#
# model = RB5009UG+S+
# serial number = EC190F362DB6
/disk
set usb1 type=hardware
add parent=usb1 partition-number=1 partition-offset=512 partition-size="63 283 658 240" type=partition
/interface bridge
add admin-mac=DC:2C:6E:2D:46:94 auto-mac=no comment=defconf name=bridge port-cost-mode=short vlan-filtering=yes
/interface ethernet
set [ find default-name=sfp-sfpplus1 ] auto-negotiation=no
/interface wireguard
add listen-port=51003 mtu=1420 name=oob-bcn
add listen-port=51002 mtu=1420 name=oracle
add listen-port=51001 mtu=1420 name=vpn
/interface vlan
add interface=bridge name=DMZ vlan-id=1902
add interface=bridge name=EXT vlan-id=2002
add interface=bridge name=GUEST vlan-id=1903
add interface=bridge name=INT vlan-id=2001
add interface=bridge name=IOT vlan-id=2003
add interface=bridge name=LAN vlan-id=2000
add interface=bridge name=MGT vlan-id=1
add interface=ether2 name=PROX vlan-id=20
add interface=bridge name=VDSL vlan-id=4000
/interface pppoe-client
add add-default-route=yes disabled=no interface=VDSL max-mtu=1480 name=PROXIMUS user=pv937239@PROXIMUS
/interface list
add comment=defconf name=WAN
add comment=defconf name=ALL-LAN
/iot lora servers
add address=eu.mikrotik.thethings.industries name=TTN-EU protocol=UDP
add address=us.mikrotik.thethings.industries name=TTN-US protocol=UDP
add address=eu1.cloud.thethings.industries name="TTS Cloud (eu1)" protocol=UDP
add address=nam1.cloud.thethings.industries name="TTS Cloud (nam1)" protocol=UDP
add address=au1.cloud.thethings.industries name="TTS Cloud (au1)" protocol=UDP
add address=eu1.cloud.thethings.network name="TTN V3 (eu1)" protocol=UDP
add address=nam1.cloud.thethings.network name="TTN V3 (nam1)" protocol=UDP
add address=au1.cloud.thethings.network name="TTN V3 (au1)" protocol=UDP
/ip pool
add name=DHCP_POOL_LAN ranges=172.20.100.2-172.20.109.254
add name=DHCP_POOL_INT ranges=172.21.100.2-172.21.109.254
add name=DHCP_POOL_EXT ranges=172.22.100.2-172.22.109.254
add name=DHCP_POOL_IOT ranges=172.23.100.2-172.23.109.254
add name=DHCP_POOL_DMZ ranges=172.19.2.100-172.19.2.149
add name=DHCP_POOL_GUEST ranges=172.19.3.100-172.19.3.149
add name=DHCP_POOL_MGT ranges=172.19.1.160-172.19.1.190
/ip dhcp-server
add address-pool=DHCP_POOL_LAN interface=LAN lease-time=10m name=DHCP_LAN
add address-pool=DHCP_POOL_MGT interface=MGT lease-time=10m name=DHCP_MGT
add address-pool=DHCP_POOL_INT interface=INT lease-time=10m name=DHCP_INT
add address-pool=DHCP_POOL_EXT interface=EXT lease-time=10m name=DHCP_EXT
add address-pool=DHCP_POOL_IOT interface=IOT lease-time=10m name=DHCP_IOT
add address-pool=DHCP_POOL_GUEST interface=GUEST lease-time=10m name=DHCP_GUEST
add address-pool=DHCP_POOL_DMZ interface=DMZ lease-time=10m name=DHCP_DMZ
/port
set 0 baud-rate=115200
/queue type
add cake-diffserv=besteffort cake-nat=yes kind=cake name=cake-default
add cake-ack-filter=filter cake-bandwidth=29.0Mbps cake-diffserv=besteffort cake-nat=yes kind=cake name=cake-up
add cake-bandwidth=84.0Mbps cake-diffserv=besteffort cake-nat=yes cake-wash=yes kind=cake name=cake-down
/queue simple
# CAKE type with bandwidth setting detected, configure traffic limits within queue itself
add bucket-size=0.001/0.001 name=cake queue=cake-down/cake-up target=PROXIMUS total-queue=cake-default
/zerotier
set zt1 comment="ZeroTier Central controller - https://my.zerotier.com/" disabled=yes disabled=yes name=zt1 port=9993
/container config
set registry-url=https://registry-1.docker.io tmpdir=/storage/docker/tmpdir
/interface bridge port
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=no interface=ether3 \
internal-path-cost=10 path-cost=10 pvid=2000
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=no interface=ether5 \
internal-path-cost=10 path-cost=10 pvid=4000
add bridge=bridge comment=defconf ingress-filtering=no interface=ether6 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether7 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether8 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp-sfpplus1 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether1 internal-path-cost=10 \
path-cost=10 pvid=2000
/ip firewall connection tracking
set udp-timeout=20s
/ip neighbor discovery-settings
set discover-interface-list=ALL-LAN
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set accept-router-advertisements=yes max-neighbor-entries=8192
/interface bridge vlan
add bridge=bridge comment=MGT tagged=bridge untagged=sfp-sfpplus1,ether4,ether6,ether7,ether8 vlan-ids=1
add bridge=bridge comment=LAN tagged=bridge,sfp-sfpplus1,ether4,ether6,ether7,ether8 untagged=ether1,ether3 vlan-ids=2000
add bridge=bridge comment=INT tagged=bridge,sfp-sfpplus1,ether4,ether6,ether7,ether8 vlan-ids=2001
add bridge=bridge comment=EXT tagged=bridge,sfp-sfpplus1,ether4,ether6,ether7,ether8 vlan-ids=2002
add bridge=bridge comment=IOT tagged=bridge,sfp-sfpplus1,ether4,ether6,ether7,ether8 vlan-ids=2003
add bridge=bridge comment=DMZ tagged=bridge,sfp-sfpplus1,ether6,ether7,ether8 vlan-ids=1902
add bridge=bridge comment=GUEST tagged=bridge,sfp-sfpplus1,ether4,ether6,ether7,ether8 vlan-ids=1903
add bridge=bridge comment=IPTV tagged=ether8 vlan-ids=30
add bridge=bridge comment=VDSL tagged=bridge,sfp-sfpplus1,ether6,ether7,ether8 untagged=ether5 vlan-ids=4000
add bridge=bridge comment=CLUSTER tagged=sfp-sfpplus1,ether6,ether8 vlan-ids=1905
add bridge=bridge comment=STORAGE tagged=sfp-sfpplus1,ether6,ether8 vlan-ids=1906
/interface list member
add comment=defconf interface=bridge list=ALL-LAN
add comment=defconf interface=PROXIMUS list=WAN
add interface=MGT list=ALL-LAN
add interface=IOT list=ALL-LAN
add interface=INT list=ALL-LAN
add interface=EXT list=ALL-LAN
add interface=LAN list=ALL-LAN
add interface=*14 list=ALL-LAN
add interface=*15 list=ALL-LAN
add interface=vpn list=ALL-LAN
/interface ovpn-server server
set auth=sha1,md5
/interface wireguard peers
add allowed-address=172.19.4.2/32 comment=etienne interface=vpn public-key="fy0eU7d3JpmXaOJIVJ99GfilZoGO0OIGGl/GNKvxUBc="
add allowed-address=10.149.255.0/24,10.249.1.0/24 comment=rb-00 endpoint-address=141.145.197.232 endpoint-port=51820 interface=\
oracle public-key="lDvDOpCKsVbBPmUvZ2fIrNNE3EjDbYqjo/BMObJOzyk="
add allowed-address=172.19.4.3/32 comment=mbp14-ec interface=vpn public-key="TgQHMAJ5gtvgc+h25YlAfaIlrgSZ/Wnx4dVYr6aBDmg="
add allowed-address=192.168.1.0/24 endpoint-address=hcp083zdcs7.sn.mynetname.net endpoint-port=52222 interface=oob-bcn \
public-key="sjL2tz5JJMvobFBfXAbQ+mSJDeTjMX1hQdcpLz4laWM="
/ip address
add address=172.19.1.1/24 interface=MGT network=172.19.1.0
add address=172.20.0.1/16 interface=LAN network=172.20.0.0
add address=172.21.0.1/16 interface=INT network=172.21.0.0
add address=172.22.0.1/16 interface=EXT network=172.22.0.0
add address=172.23.0.1/16 interface=IOT network=172.23.0.0
add address=172.19.2.1/24 interface=DMZ network=172.19.2.0
add address=172.19.3.1/24 interface=GUEST network=172.19.3.0
add address=192.168.1.250/24 disabled=yes interface=VDSL network=192.168.1.0
add address=172.19.4.1/24 interface=vpn network=172.19.4.0
add address=10.149.255.3/24 interface=oracle network=10.149.255.0
add address=10.255.255.1/30 interface=oob-bcn network=10.255.255.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf interface=ether2 use-peer-dns=no
/ip dhcp-server lease
add address=172.19.1.11 mac-address=B0:A7:B9:CB:EF:22
add address=172.19.1.12 mac-address=B0:A7:B9:CB:EE:32
add address=172.19.1.13 mac-address=AC:84:C6:12:97:E2
add address=172.20.1.10 mac-address=00:11:32:0E:9E:A9
add address=172.20.1.12 mac-address=00:11:32:5A:60:4D
add address=172.20.1.21 mac-address=02:11:32:20:01:7F
add address=172.20.1.11 mac-address=00:11:32:46:24:79
add address=172.20.2.12 mac-address=4C:20:B8:E5:DC:DD
add address=172.20.2.11 mac-address=BC:D0:74:30:16:02
add address=172.20.2.110 mac-address=00:E0:4C:68:02:1C
add address=172.19.1.21 mac-address=8A:8A:0C:67:8E:27
add address=172.20.2.13 mac-address=0E:5D:9D:12:00:46
add address=172.20.2.10 comment=mbp14-ec mac-address=C8:89:F3:DE:0B:9F
add address=172.19.1.191 comment=winet-s mac-address=AC:0B:FB:0C:B3:4F
add address=172.20.2.14 comment=pc-marc mac-address=74:56:3C:07:59:8B
add address=172.20.2.15 mac-address=14:7D:DA:8D:23:E7
add address=172.20.1.42 comment=voip-01 disabled=yes mac-address=7C:2F:80:B9:24:9D
add address=172.20.1.41 comment=atv-01 disabled=yes mac-address=1C:B3:C9:07:8B:AF
/ip dhcp-server network
add address=172.19.1.0/24 dns-server=172.19.1.3,172.19.1.4 domain=phi8.ovh gateway=172.19.1.1 ntp-server=172.19.1.1
add address=172.19.2.0/24 dns-server=172.19.1.3,172.19.1.4 domain=phi8.ovh gateway=172.19.2.1 ntp-server=172.19.2.1
add address=172.19.3.0/24 dns-server=172.19.1.3,172.19.1.4 domain=phi8.ovh gateway=172.19.3.1 ntp-server=172.19.3.1
add address=172.20.0.0/16 dns-server=172.19.1.3,172.19.1.4 domain=phi8.ovh gateway=172.20.0.1 ntp-server=172.20.0.1
add address=172.21.0.0/16 dns-server=172.19.1.3,172.19.1.4 domain=phi8.ovh gateway=172.21.0.1 ntp-server=172.21.0.1
add address=172.22.0.0/16 dns-server=172.19.1.3,172.19.1.4 domain=phi8.ovh gateway=172.22.0.1 ntp-server=172.22.0.1
add address=172.23.0.0/16 dns-server=172.19.1.3,172.19.1.4 domain=phi8.ovh gateway=172.23.0.1 ntp-server=172.23.0.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=172.19.1.1 name=rb-00.phi8.ovh
add address=172.19.1.10 name=omada.phi8.ovh
add address=172.19.1.11 name=eap-01.phi8.ovh
add address=172.19.1.12 name=eap-02.phi8.ovh
add address=172.19.1.13 name=eap-03.phi8.ovh
add address=172.19.1.14 name=eap-04.phi8.ovh
add address=172.19.1.31 name=sw-01.phi8.ovh
add address=172.19.1.32 name=sw-02.phi8.ovh
add address=172.19.1.33 name=sw-03.phi8.ovh
add address=172.19.1.34 name=sw-04.phi8.ovh
add address=172.19.1.100 name=srv-00.phi8.ovh
add address=172.19.1.101 name=srv-01.phi8.ovh
add address=172.19.1.102 name=srv-02.phi8.ovh
add address=172.19.1.104 name=rpi-01.phi8.ovh
add address=172.19.1.108 name=lorath-adm.phi8.ovh
add address=172.19.1.109 name=ups-01.phi8.ovh
add address=172.19.1.110 name=pachacamac.phi8.ovh
add address=172.20.1.11 name=nas-02.phi8.ovh
add address=172.20.1.14 name=nas-01.phi8.ovh
/ip firewall address-list
add address=ec190f362db6.sn.mynetname.net list=MyDDNS
/ip firewall filter
add action=accept chain=input comment="Allow Wireguard" dst-port=51001 protocol=udp
add action=accept chain=input dst-port=51002 protocol=udp
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!ALL-LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=forward dst-address=172.16.0.0/12 src-address=172.23.0.0/16
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new \
in-interface-list=WAN
add action=accept chain=input dst-port=51003 protocol=udp
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=443 in-interface-list=WAN protocol=tcp to-addresses=172.19.1.2 to-ports=443
add action=masquerade chain=srcnat src-address=172.19.4.0/24 to-addresses=172.19.1.1
/ip route
add dst-address=10.249.1.0/24 gateway=10.149.255.1
add dst-address=192.168.1.0/24 gateway=oob-bcn
/ip service
set telnet disabled=yes
set ftp disabled=yes
/ipv6 address
add address=::1 from-pool=PROXIMUS interface=LAN
add address=::1 from-pool=PROXIMUS interface=INT
add address=::1 from-pool=PROXIMUS interface=EXT
add address=::1 from-pool=PROXIMUS interface=DMZ
add address=::1 from-pool=PROXIMUS interface=MGT
add address=::1 from-pool=PROXIMUS interface=GUEST
/ipv6 dhcp-client
add interface=PROXIMUS pool-name=PROXIMUS request=prefix use-peer-dns=no
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=\
fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!ALL-LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!ALL-LAN
/ipv6 firewall mangle
add action=change-mss chain=forward new-mss=clamp-to-pmtu out-interface=PROXIMUS passthrough=yes protocol=tcp tcp-flags=syn
/ipv6 nd
set [ find default=yes ] advertise-dns=no mtu=1480
add advertise-dns=no interface=GUEST mtu=1480
add advertise-dns=no interface=DMZ mtu=1480
add advertise-dns=no interface=EXT mtu=1480
add advertise-dns=no interface=INT mtu=1480
add advertise-dns=no interface=LAN mtu=1480
add advertise-dns=no interface=MGT mtu=1480
/system clock
set time-zone-name=Europe/Brussels
/system identity
set name=rb-00
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp server
set enabled=yes multicast=yes
/system ntp client servers
add address=ntp.belnet.be
add address=time.belnet.be
/system ups
add name=EATON port=*80000002
/tool graphing interface
add interface=PROXIMUS
/tool mac-server
set allowed-interface-list=ALL-LAN
/tool mac-server mac-winbox
set allowed-interface-list=ALL-LAN
