# 2024-10-17 08:53:04 by RouterOS 7.16.1
# software id = REDACTED
#
# model = CRS125-24G-1S
# serial number = 6244054AD9DA
/interface bridge
add admin-mac=REDACTED auto-mac=no comment=defconf name=bridge \
vlan-filtering=yes
/interface ethernet
set [ find default-name=sfp1 ] auto-negotiation=no speed=1G-baseT-full
/interface wireguard
add listen-port=13232 mtu=1420 name=REDACTED
add listen-port=21841 mtu=1420 name=REDACTED
add listen-port=13231 mtu=1420 name=wireguard1
/interface vlan
add interface=sfp1 name=sfp1-v7 vlan-id=7
/interface bonding
add mode=802.3ad name=nas slaves=ether23,ether24
add name=switch slaves=ether21,ether22
/interface pppoe-client
add add-default-route=yes allow=pap,chap,mschap2 disabled=no interface=\
sfp1-v7 name=telekom use-peer-dns=yes user=REDACTED
/interface ethernet switch qos-group
add name=group1 priority=1
/interface list
add name=WAN
add name=LAN
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk connect-priority=0 disabled=no \
name=family-sec
/interface wifi configuration
add channel.reselect-interval=5m..10m disabled=no mode=ap name=family \
security=family-sec security.connect-priority=0 .ft=yes .ft-over-ds=yes \
ssid=REDACTED
/ip pool
add name=pool_ipv4 ranges=192.168.88.100-192.168.88.254
/ip dhcp-server
add address-pool=pool_ipv4 interface=bridge name=dhcp_ipv4
/ipv6 pool
add name=local-ipv6 prefix=fd27:a5c9:3073::/48 prefix-length=64
add name=wireguard-ipv6 prefix=fdc5:fe4d:2037::/48 prefix-length=64
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=ether10
add bridge=bridge comment=defconf interface=ether11
add bridge=bridge comment=defconf interface=ether12
add bridge=bridge comment=defconf interface=ether13
add bridge=bridge comment=defconf interface=ether14
add bridge=bridge comment=defconf interface=ether15
add bridge=bridge comment=defconf interface=ether16
add bridge=bridge comment=defconf interface=ether17
add bridge=bridge comment=defconf interface=ether18
add bridge=bridge comment=defconf interface=ether19
add bridge=bridge comment=defconf interface=ether20
add bridge=bridge comment=defconf disabled=yes interface=sfp1
add bridge=bridge interface=nas
add bridge=bridge interface=switch
/interface list member
add interface=bridge list=LAN
add interface=sfp1 list=WAN
add interface=sfp1-v7 list=WAN
add interface=wireguard1 list=LAN
add interface=REDACTED list=LAN
/interface wifi capsman
set ca-certificate=auto enabled=yes package-path="" require-peer-certificate=\
no upgrade-policy=suggest-same-version
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=family \
supported-bands=5ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration=family \
supported-bands=2ghz-ax
/interface wireguard peers
add allowed-address=192.168.87.10/32,fdc5:fe4d:2037::10/64 client-address=\
192.168.87.10/32,fdc5:fe4d:2037::10/64 client-dns=\
192.168.87.1,fdc5:fe4d:2037::1 client-endpoint=REDACTED interface=wireguard1 name=pixel \
preshared-key=REDACTED private-key=REDACTED public-key=\
"NgDH4twpj5SBFq/ljF9WXRVRplqXKQ/ty/CpySH8aE4="
add allowed-address=192.168.87.11/32,fdc5:fe4d:2037::11/64 client-address=\
192.168.87.11/32,fdc5:fe4d:2037::11/64 client-dns=\
192.168.87.1,fdc5:fe4d:2037::1 client-endpoint=REDACTED interface=wireguard1 name=tuxedo \
preshared-key=REDACTED private-key=REDACTED public-key=\
"GYvw4WCigXf+TK3TJuhNAxah6pbuvjZwFUW0yPUi7ko="
add allowed-address=192.168.87.12/32,fdc5:fe4d:2037::12/64 client-address=\
192.168.87.12/32,fdc5:fe4d:2037::12/64 client-dns=\
192.168.87.1,fdc5:fe4d:2037::1 client-endpoint=REDACTED interface=wireguard1 name=travelrouter \
preshared-key=REDACTED private-key=REDACTED public-key=\
"QnvegVgvyGZKxss2hRs9146Pgqpm7aYnkUWLSZd5OTk="
add allowed-address=192.168.87.13/32,fdc5:fe4d:2037::13/64 client-address=\
192.168.87.13/32,fdc5:fe4d:2037::13/64 client-dns=\
192.168.87.1,fdc5:fe4d:2037::1 client-endpoint=REDACTED interface=wireguard1 name=iphone \
preshared-key=REDACTED public-key=\
"wd+L4MSrFOMopIe54J3SCiXHnUeOIYCNs2HJxVNG0H8="
add allowed-address=10.102.6.0/24 endpoint-address=REDACTED \
endpoint-port=51026 interface=REDACTED name=REDACTED public-key=\
"fhJZDlnX4q2WVktddXUuDmNYrgBGslbcezHpTgWx/x0="
add allowed-address=192.168.86.10/32,::1/64 client-address=\
192.168.86.10/32,::1/64 client-dns=192.168.86.1 client-endpoint=REDACTED endpoint-address="" interface=REDACTED name=REDACTED preshared-key=REDACTED \
public-key="t+fUxKQmQHNFUxYIFr9qzCMaRU5I5bvBSWDVdvf1Cko="
/ip address
add address=192.168.88.1/24 interface=bridge network=192.168.88.0
add address=192.168.87.1/24 interface=wireguard1 network=192.168.87.0
add address=10.102.6.2/24 interface=REDACTED network=10.102.6.0
add address=192.168.86.1/24 interface=REDACTED network=192.168.86.0
/ip arp
add address=192.168.88.6 interface=bridge mac-address=REDACTED
add address=192.168.88.2 interface=bridge mac-address=REDACTED
add address=192.168.88.4 interface=bridge mac-address=REDACTED
add address=192.168.88.5 interface=bridge mac-address=REDACTED
/ip dhcp-client
# Interface not active
add interface=ether1
add disabled=yes interface=sfp1-v7
/ip dhcp-server lease
add address=192.168.88.254 mac-address=REDACTED server=dhcp_ipv4
/ip dhcp-server network
add address=0.0.0.0/24 dns-server=192.168.88.1 gateway=192.168.88.1 netmask=\
24
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=9.9.9.9
/ip dns static
add address=192.168.88.1 name=router.lan type=A
add address=192.168.88.2 name=REDACTED type=A
add address=192.168.88.3 name=REDACTED type=A
add address=192.168.88.6 name=REDACTED type=A
add address=192.168.88.7 name=REDACTED type=A
add address=192.168.88.9 name=REDACTED type=A
add address=192.168.88.10 name=REDACTED type=A
add address=192.168.88.12 name=REDACTED type=A
add address=192.168.88.13 name=nginx.lan type=A
add cname=nginx.lan. name=REDACTED type=CNAME
add cname=nginx.lan. name=REDACTED type=CNAME
/ip firewall address-list
add address=0.0.0.0/8 comment="defconf: RFC6890" list=no_forward_ipv4
add address=169.254.0.0/16 comment="defconf: RFC6890" list=no_forward_ipv4
add address=224.0.0.0/4 comment="defconf: multicast" list=no_forward_ipv4
add address=255.255.255.255 comment="defconf: RFC6890" list=no_forward_ipv4
add address=127.0.0.0/8 comment="defconf: RFC6890" list=bad_ipv4
add address=192.0.0.0/24 comment="defconf: RFC6890" list=bad_ipv4
add address=192.0.2.0/24 comment="defconf: RFC6890 documentation" list=\
bad_ipv4
add address=198.51.100.0/24 comment="defconf: RFC6890 documentation" list=\
bad_ipv4
add address=203.0.113.0/24 comment="defconf: RFC6890 documentation" list=\
bad_ipv4
add address=240.0.0.0/4 comment="defconf: RFC6890 reserved" list=bad_ipv4
add address=0.0.0.0/8 comment="defconf: RFC6890" list=not_global_ipv4
add address=10.0.0.0/8 comment="defconf: RFC6890" list=not_global_ipv4
add address=100.64.0.0/10 comment="defconf: RFC6890" list=not_global_ipv4
add address=169.254.0.0/16 comment="defconf: RFC6890" list=not_global_ipv4
add address=172.16.0.0/12 comment="defconf: RFC6890" list=not_global_ipv4
add address=192.0.0.0/29 comment="defconf: RFC6890" list=not_global_ipv4
add address=192.168.0.0/16 comment="defconf: RFC6890" list=not_global_ipv4
add address=198.18.0.0/15 comment="defconf: RFC6890 benchmark" list=\
not_global_ipv4
add address=255.255.255.255 comment="defconf: RFC6890" list=not_global_ipv4
add address=224.0.0.0/4 comment="defconf: multicast" list=bad_src_ipv4
add address=255.255.255.255 comment="defconf: RFC6890" list=bad_src_ipv4
add address=0.0.0.0/8 comment="defconf: RFC6890" list=bad_dst_ipv4
add address=224.0.0.0/4 comment="defconf: RFC6890" list=bad_dst_ipv4
add address=192.168.88.7 comment=REDACTED list=REDACTED
add address=192.168.88.12 comment=REDACTED list=REDACTED
add address=192.168.88.13 comment=nginx list=REDACTED
/ip firewall filter
add action=accept chain=input comment="allow Wireguard" dst-port=13231 \
protocol=udp
add action=accept chain=input comment="allow REDACTED (Wireguard)" dst-port=\
21841 protocol=udp
add action=accept chain=input comment="allow REDACTED (Wireguard)" dst-port=\
13232 protocol=udp
add action=accept chain=input comment="defconf: accept ICMP after RAW" \
protocol=icmp
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment=\
"drop REDACTED (Wireguard) from accessing router" in-interface=REDACTED
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment=\
"defconf: accept all that matches IPSec policy" disabled=yes \
ipsec-policy=in,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=drop chain=forward comment="defconf: drop bad forward IPs" \
src-address-list=no_forward_ipv4
add action=drop chain=forward comment="defconf: drop bad forward IPs" \
dst-address-list=no_forward_ipv4
add action=drop chain=forward comment="drop REDACTED forward to non-REDACTED" \
dst-address-list=!REDACTED in-interface=REDACTED
/ip firewall nat
add action=accept chain=srcnat comment=\
"defconf: accept all that matches IPSec policy" disabled=yes \
ipsec-policy=out,ipsec
add action=masquerade chain=srcnat comment="defconf: masquerade" \
out-interface=telekom
add action=masquerade chain=srcnat comment=REDACTED log=yes out-interface=REDACTED
/ip firewall raw
add action=accept chain=prerouting comment=\
"defconf: enable for transparent firewall" disabled=yes
add action=accept chain=prerouting comment="defconf: accept DHCP discover" \
dst-address=255.255.255.255 dst-port=67 in-interface-list=LAN protocol=\
udp src-address=0.0.0.0 src-port=68
add action=drop chain=prerouting comment="defconf: drop bogon IP's" \
src-address-list=bad_ipv4
add action=drop chain=prerouting comment="defconf: drop bogon IP's" \
dst-address-list=bad_ipv4
add action=drop chain=prerouting comment="defconf: drop bogon IP's" \
src-address-list=bad_src_ipv4
add action=drop chain=prerouting comment="defconf: drop bogon IP's" \
dst-address-list=bad_dst_ipv4
add action=drop chain=prerouting comment="defconf: drop non global from WAN" \
in-interface-list=WAN src-address-list=not_global_ipv4
add action=drop chain=prerouting comment=\
"defconf: drop forward to local lan from WAN" disabled=yes dst-address=\
192.168.88.0/24 in-interface-list=WAN
add action=drop chain=prerouting comment=\
"defconf: drop local if not from default IP range" disabled=yes \
in-interface-list=LAN src-address=!192.168.88.0/24
add action=drop chain=prerouting comment="defconf: drop bad UDP" port=0 \
protocol=udp
add action=jump chain=prerouting comment="defconf: jump to ICMP chain" \
jump-target=icmp4 protocol=icmp
add action=jump chain=prerouting comment="defconf: jump to TCP chain" \
jump-target=bad_tcp protocol=tcp
add action=accept chain=prerouting comment=\
"defconf: accept everything else from LAN" in-interface-list=LAN
add action=accept chain=prerouting comment=\
"defconf: accept everything else from WAN" in-interface-list=WAN
add action=drop chain=prerouting comment="defconf: drop the rest" disabled=\
yes
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip traffic-flow
set cache-entries=16k interfaces=*53
/ipv6 address
add from-pool=pool-ipv6 interface=bridge
add address=::1 from-pool=pool-ipv6 interface=telekom
add address=::1 from-pool=local-ipv6 interface=bridge
add address=::1 from-pool=wireguard-ipv6 interface=wireguard1
/ipv6 dhcp-client
add add-default-route=yes interface=telekom pool-name=pool-ipv6 request=\
prefix
/ipv6 firewall address-list
add address=fe80::/10 comment="defconf: RFC6890 Linked-Scoped Unicast" list=\
no_forward_ipv6
add address=ff00::/8 comment="defconf: multicast" list=no_forward_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept ICMPv6 after RAW" \
protocol=icmpv6
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=accept chain=input comment="defconf: accept UDP traceroute" \
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
"defconf: accept DHCPv6-Client prefix delegation" dst-port=546 protocol=\
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
protocol=udp
add action=accept chain=input comment="defconf: accept IPSec AH" protocol=\
ipsec-ah
add action=accept chain=input comment="defconf: accept IPSec ESP" protocol=\
ipsec-esp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment="defconf: drop bad forward IPs" \
src-address-list=no_forward_ipv6
add action=drop chain=forward comment="defconf: drop bad forward IPs" \
dst-address-list=no_forward_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6 after RAW" \
protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept AH" protocol=\
ipsec-ah
add action=accept chain=forward comment="defconf: accept ESP" protocol=\
ipsec-esp
add action=accept chain=forward comment=\
"defconf: accept all that matches IPSec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
/lcd
set default-screen=stat-slideshow
/lcd interface
set ether1 disabled=yes
set ether2 disabled=yes
set ether3 disabled=yes
set ether4 disabled=yes
set ether5 disabled=yes
set ether6 disabled=yes
set ether7 disabled=yes
set ether8 disabled=yes
set ether9 disabled=yes
set ether10 disabled=yes
set ether11 disabled=yes
set ether12 disabled=yes
set ether13 disabled=yes
set ether14 disabled=yes
set ether15 disabled=yes
set ether16 disabled=yes
set ether17 disabled=yes
set ether18 disabled=yes
set ether19 disabled=yes
set ether20 disabled=yes
set ether21 disabled=yes
set ether22 disabled=yes
set ether23 disabled=yes
set ether24 disabled=yes
/system clock
set time-zone-name=Europe/Berlin
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.de.pool.ntp.org
add address=1.de.pool.ntp.org
add address=2.de.pool.ntp.org
add address=3.de.pool.ntp.org
/system routerboard settings
set auto-upgrade=yes
/system scheduler
add interval=10m name=dyndns on-event="/system script run dyndns" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=2024-09-05 start-time=07:24:43
/system script
add comment=dyndns dont-require-permissions=no name=strato owner=admin \
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
source=":global ddnsuser \"REDACTED\"\
\n:global ddnspass \"REDACTED\"\
\n:global theinterface \"telekom\"\
\n:global ddnshost1 \"REDACTED\"\
\n\
\n:global ipddns\
\n:global ipfresh [/ip address get [find where interface=\$theinterface] v\
alue-name=address]\
\n:global ip6fresh [/ipv6 address get [find where interface=\$theinterface\
\_from-pool=\"pool-ipv6\"] value-name=address] \
\n\
\n:if ([ :typeof \$ipfresh ] = nil ) do={\
\n\
\n :log info (\"DynDNS: No ip address on \$theinterface .\")\
\n\
\n} else={\
\n\
\n :for i from=( [:len \$ipfresh] - 1) to=0 do={ \
\n\
\n :if ( [:pick \$ipfresh \$i] = \"/\") do={ \
\n\
\n :set ipfresh [:pick \$ipfresh 0 \$i];\
\n\
\n } \
\n }\
\n\
\n \
\n :for i from=( [:len \$ip6fresh] - 1) to=0 do= {\
\n \
\n :if ( [:pick \$ip6fresh \$i] = \"/\") do={\
\n \
\n :set ip6fresh [:pick \$ip6fresh 0 \$i]; \
\n\
\n }\
\n\
\n }\
\n\
\n\
\n :log info (\"DynDNS: IP6-Fresh = \$ip6fresh\")\
\n\
\n :if (\$ipddns != \$ipfresh) do={\
\n\
\n :log info (\"DynDNS: IP-DynDNS = \$ipddns\")\
\n :log info (\"DynDNS: IP-Fresh = \$ipfresh\")\
\n :log info \"DynDNS: Update IP needed, Sending UPDATE...!\"\
\n\
\n :global str1 \"/nic/update\\\?hostname=\$ddnshost1&myip=\$ipfres\
h\"\
\n /tool fetch address=dyndns.strato.com src-path=\$str1 user=\$ddn\
suser password=\$ddnspass mode=https dst-path=(\"/DynDNS.\".\$ddnshost1)\
\n\
\n :delay 1\
\n\
\n :global str1 [/file find name=\"DynDNS.\$ddnshost1\"];\
\n /file remove \$str1\
\n :global ipddns \$ipfresh\
\n :log info \"DynDNS: IP updated to \$ipfresh!\"\
\n\
\n } else={\
\n\
\n :log info \"DynDNS: dont need changes\";\
\n\
\n }\
\n}"
/tool graphing resource
add allow-address=192.168.0.0/16
