Если требуется задаем нужный MAC для интерфейса:
|
1 2 |
/interface ethernet set [ find default-name=ether1 ] mac-address=XX:XX:XX:XX:XX:XX |
Добавляем IP для интерфейсов
|
1 2 3 4 5 |
/ip address add address=192.168.18.1/24 interface=bridge1 network=192.168.18.0 /ip dhcp-client add dhcp-options=hostname,clientid disabled=no interface=ether1 |
Создаем лист для winbox
|
1 2 3 4 5 6 7 8 |
/interface list add name=winbox /interface list member add interface=ether2 list=winbox add interface=ether3 list=winbox add interface=ether4 list=winbox add interface=ether5 list=winbox add interface=wlan1 list=winbox |
Создаем бридж и добавляем в него интерфейсы
|
1 2 3 4 5 6 7 8 |
/interface bridge add fast-forward=no name=bridge1 /interface bridge port add bridge=bridge1 interface=ether2 add bridge=bridge1 interface=ether3 add bridge=bridge1 interface=ether4 add bridge=bridge1 interface=ether5 add bridge=bridge1 interface=wlan1 |
Настраиваем dhcp:
|
1 2 3 4 5 6 |
/ip pool add name=pool1 ranges=192.168.18.100-192.168.18.200 /ip dhcp-server add address-pool=pool1 disabled=no interface=bridge1 name=server1 /ip dhcp-server network add address=192.168.18.0/24 dns-server=192.168.18.1 gateway=192.168.18.1 netmask=24 |
wi-fi
|
1 2 3 4 |
/interface wireless set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-eC disabled=no frequency=auto mode=ap-bridge ssid=Имя_точки_доступа tx-power-mode=all-rates-fixed /interface wireless security-profiles set [ find default=yes ] authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys supplicant-identity=MikroTik wpa2-pre-shared-key=Пароль_сюда |
Включить звук при загрузке (если есть будет beep)
|
1 2 |
/system routerboard settings set silent-boot=no |
Разрешить доступ оп MAC только из списка winbox
|
1 2 |
/tool mac-server mac-winbox set allowed-interface-list=winbox |
задать часовой пояс
|
1 2 |
/system clock set time-zone-name=Europe/Moscow |
Создать список access добавив в него IP
|
1 2 |
/ip firewall address-list add address=146.120.66.100 list=acceess |
Разрешить DNS серверу отвечать на запросы resolve
|
1 2 |
/ip dns set allow-remote-requests=yes |
Простой firewall
|
1 2 3 4 5 6 7 8 9 10 11 |
/ip firewall filter add action=accept chain=input comment="access for allow ip" in-interface=ether1 src-address-list=acceess add action=accept chain=input comment="access icmp" in-interface=ether1 protocol=icmp add action=drop chain=input comment="drop invalid" connection-state=invalid in-interface=ether1 add action=accept chain=input comment="access established and related" connection-state=established,related in-interface=ether1 add action=accept chain=input comment="access control" dst-port=8291 in-interface=bridge1 protocol=tcp add action=drop chain=input comment="drop all" in-interface=ether1 add action=accept chain=forward comment="allow established and related" connection-state=established,related in-interface=ether1 add action=drop chain=forward comment="drob all !dstnat" connection-nat-state=!dstnat in-interface=ether1 log=yes /ip firewall nat add action=masquerade chain=srcnat out-interface=ether1 |
Default firewall 2020
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
/interface list add comment=defconf name=WAN add comment=defconf name=LAN /ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1 add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN /ip firewall nat add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN |