TP21.1: Core-Cutover-Recovery — crs326-core als L3-Router live
crs326-core ist jetzt der produktive L3-Router (ersetzt ap1, das plattgemacht + getrennt wurde). Nach dem Cutover fehlten DHCP, WAN, WG-Hub und DNS-Upstream -> aus dem letzten ap1-Backup (ap1-pre-core-cutover-20260806-073616) wiederhergestellt. - DHCP: 7 Server (dhcp-v10..v99) + 8 Networks + 54 Leases (routeros/tp21-core-dhcp-from-ap1.rsc; VLAN1-Legacy + omada-inform weg) - WAN: dhcp-client vlan100 -> Liwest 90.146.33.177, NAT-Masquerade (nur WAN-Variante; disabled bridge/ether1-Regeln bewusst nicht), Blackhole-Selbst-Default-Route entfernt - WG-Hub (TP10): Interface + fm/dw-Peers + Routen; Privkey aus gitignored ap1-wg-hub.privkey -> Hub-Pubkey unveraendert, beide Spokes handshaken (routeros/tp21-core-wan-wg-restore.rsc, Privkey redacted) - DNS: allow-remote-requests=yes + plain 1.1.1.1 (core hat certs=0 -> DoH-Cloudflare-Gateway ist TODO); entsperrte auch FM (Hub-DNS) - Identity ap1 -> crs326-core; routers.yaml auf Zielschema core .99.1 / branch .99.2 / ap1 .99.11 / ap2 .99.12 - disabled/invalid-Fallen bereinigt: WG-Forward-Regeln mit stale *1D Interface-ID -> wg-hub; tote gateway=""-WG-Routen entfernt Doku: teilprojekte.md TP21.1 + CLAUDE.md HW-Tabelle nachgezogen. Offene TODOs: DoH-Restore, Nautobot-Write-back, branch-88er-Check, core ether4, ap1/ap2-Reprovisionierung (WLAN-Rebuild). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
@@ -29,9 +29,9 @@ GW je VLAN = `.1` · APs: ap1=`.1`, ap2=`.2` · Switches: ALLNET=`.11`, Omada=`.
|
||||
|---|---|---|
|
||||
| ALLNET Core-Switch (sw1) | 10.40.41.11 (interim, VLAN1) | `telnet 10.40.41.11` · User: `claudecode` · PW: `switch/.secrets` |
|
||||
| ~~Omada Access-Switch (sw2)~~ | — | ❌ **abgebaut 2026-07-23** (TP15 Branch-Tausch) — durch `crs326-branch` in Technik OG ersetzt, physisch entfernt |
|
||||
| **crs326-branch** (CRS326, Technik OG) | **10.40.99.13** (VLAN99, über sw1 #8) · VLAN1-Temp `.41.213` | RouterOS 7.19.5 · `admin`/`~/.secrets` (`CRS326_BRANCH_*`) · REST `http://10.40.99.13/rest` · MikroMCP `routers.yaml` (live nach MCP-Neustart) · **TP15 ✅ 2026-07-23: ersetzt sw2**, volle Portbelegung (ether1 Uplink→sw1#8, 2/8 NAS, 3 Drucker, 4 Dock, 5/6 Sonos, 7 macmini, 24 ap2) · sw-id RGZJ-UK0T, MAC 04:F4:1C:B4:15:58 |
|
||||
| **crs326-core** (CRS326, Technik UG) | **10.40.99.11** (VLAN99, erreichbar erst wenn sw1#12 99T trägt) · VLAN1-Temp `.41.211` (an sw1 #12) | RouterOS 7.19.5 · `admin`/`~/.secrets` (`CRS326_CORE_*`) · REST `http://10.40.41.211/rest` · **TP15 ✅ 2026-07-23 grundkonfiguriert, NICHT produktiv** — wird Core/L3-Router (ersetzt sw1) in eigener Session · sw-id 4W04-URHT, MAC 04:F4:1C:B4:17:76 |
|
||||
| hAP ax² #1 (ap1) | 10.40.10.1 (Mgmt-Zugriff) · `platform-pg.bf.lan`-artige DNS-Statics unter `bf.lan` | MikroMCP (live) · **TP4 ✅: L3-Router, GW je VLAN = .1**, vlan99-GW `10.40.99.1` seit TP4 live |
|
||||
| **crs326-branch** (CRS326, Technik OG) | **10.40.99.2** (VLAN99; temp VLAN10 `.10.2`) · Bootstrap Rev4 2026-08-08 | RouterOS 7.19.5 · `admin`/`~/.secrets` (`CRS326_BRANCH_*`) · REST `http://10.40.99.2/rest` · MikroMCP `routers.yaml` (live nach MCP-Neustart) · **TP15 ✅: ersetzt sw2** (L2-Switch), volle Portbelegung (ether1 Uplink-Trunk, 2/8 NAS, 3 Drucker, 4 Dock, 5/6 Sonos, 7 macmini, 24 ap2) · sw-id RGZJ-UK0T, MAC 04:F4:1C:B4:15:58 |
|
||||
| **crs326-core** (CRS326, Technik UG) | **10.40.99.1** (VLAN99-SVI = L3-GW; same-subnet-Fallback `10.40.10.1`) · Identity `crs326-core` | RouterOS 7.19.5 · `admin`/`~/.secrets` (`CRS326_CORE_*`) · MikroMCP routerId `crs326-core` (nach MCP-Neustart) · **TP15/TP21.1 ✅ 2026-08-08: PRODUKTIVER L3-Router** (ersetzt ap1) — Routing/DHCP (7 Server + 54 Leases)/DNS (plain `1.1.1.1`, DoH-Cloudflare-TODO)/NAT/WG-Hub (fm+dw live); WAN `vlan100`=Liwest `90.146.33.177` · sw-id 4W04-URHT, MAC 04:F4:1C:B4:17:76 |
|
||||
| hAP ax² #1 (ap1) | ❌ **Werksreset + getrennt (2026-08-08)** — L3-Rolle → `crs326-core`; Ziel-Mgmt `10.40.99.11` | wird **reiner AP** (WLAN-Neuprovisionierung, eigene Session) · alte L3-Config-Referenz = `routeros/ap1-pre-core-cutover-20260806-073616.rsc` |
|
||||
| hAP ax² #2 (ap2) | 10.40.41.2 (VLAN1, TP19.1-Umzug auf `.99.2` vertagt bis TP21/Nautobot) | MikroMCP (live) · **Port 2 am Omada-Switch** |
|
||||
| NAS (nas-bf, DS923) | 10.40.20.10 | SSH `adm.christoph@10.40.20.10` (kein PW nötig) · Docker (Portainer endpointId=14) |
|
||||
| platform-pg (LXC 105, pve) | 10.40.20.20 | SSH via pve (`pct exec 105 --`) · **TP20 ✅ 2026-07-16: PG16, DB `nautobot`, Creds `postgres/.secrets`** |
|
||||
|
||||
@@ -548,13 +548,23 @@ FT kaschierte das bisher als „Roaming" statt „schwache Abdeckung".
|
||||
- **Offen:** ap1/ap2/crs326-Adoption + Compliance-Push (RouterOS-API); RouterOS-Nornir-Dispatcher falls nötig; Branch-Renumber `.13→.12` und AP-Mgmt-IP-Fix in Datenmodell beim Cutover; Secret-Handling für WG-Privkey in Nautobot/Nornir klären (aktuell lokale Injektion).
|
||||
- Abh.: **TP20** (Postgres muss stehen), Gitea ✅, RouterOS-Router (ap1/ap2, dauerhaft).
|
||||
|
||||
### TP21.1 — CRS326-Branch Recovery nach Lockout ▸ 🔴 OFFEN (2026-08-08)
|
||||
- **Auslöser:** während TP21-Passwort-Umstellung ist `crs326-branch` (10.40.99.13 / geplant .99.2) management-unerreichbar geworden. Ping und MAC-Winbox-Connect (MNDP/Winbox Layer2) schlagen fehl. Der Switch leitet aber weiterhin Traffic weiter (NAS VLAN20 erreichbar).
|
||||
- **Hypothese:** nach einem Reboot sind alle Ports wieder `disabled=yes` (bekanntes Muster aus dem Branch-Bring-up 2026-07-23 — Disable-Regex erfasste die gewünschten Ports nicht korrekt) **oder** die Management-IP/VLAN-Konfiguration wurde überschrieben.
|
||||
- **Rettungspfad:** physischer Reset auf Werkseinstellungen (`192.168.88.1/24`) über Reset-Taster, dann Bring-up von Hand wiederholen. Dabei ist der Branch-Bring-up-Stand aus `docs/tp15-crs326-session-handoff-prompt.md`/`nautobot/ingest-crs326-ports.py` maßgeblich.
|
||||
- **Kritikalität:** HOCH — am Branch hängen NAS, Sonos (Media), Drucker, Dock, Mac mini, ap2. Während des Recoveries kein VLAN20/30/40/50/90/99-Zugang über diesen Pfad.
|
||||
- **Abhängigkeit:** User muss physisch am Gerät sein (Console/Winbox-MAC/Reset). TP21-Weiterarbeit an MikroTik-Geräten blockiert bis der Branch wieder management-erreichbar ist.
|
||||
- **Nächster Schritt (Session-Neustart):** Reset → Grundkonfiguration Bridge+VLAN-Filtering+Uplink-Trunk → Mgmt-IP `.99.13` wiederherstellen → Portbelegung 1:1 aus TP15-Bring-up nachziehen → dann erst weiter mit TP21-Passwort-Rotation + AP-Reprovisionierung.
|
||||
### TP21.1 — Core-Cutover-Recovery (ap1 → crs326-core als L3-Router) ▸ ✅ NETZ WIEDER LIVE (2026-08-08); Aufräum-Todos offen
|
||||
> **Kern-Erkenntnis (wichtig gegen Doku-Verwirrung):** **`crs326-core` IST jetzt der produktive L3-Router.** Der Core-Cutover (TP15) wurde faktisch vollzogen — ap1 wurde plattgemacht/getrennt, core hat Routing/DHCP/DNS/NAT/WG-Hub übernommen. core-Mgmt = **`10.40.99.1`** (vlan99-SVI) bzw. same-subnet-Fallback **`10.40.10.1`** (RouterOS-Version 7.19.5 identifiziert das Gerät zweifelsfrei als CRS326, nicht als hAP/ap1). Die CLAUDE.md-Zeile „core grundkonfiguriert, NICHT produktiv" ist damit **überholt**.
|
||||
- **Verlauf:** Ausgangssymptom war ein L3-Ausfall-Eindruck (kein DHCP, „kein Routing nach .20.x"). Ursache = **unvollständiger Cutover**: core hatte L3-SVIs + Firewall, aber es fehlten DHCP-Server, WAN-Egress, WG-Hub und der DNS-Resolver-Upstream. ap1 (bisher alleiniges L3-Gerät) war bereits Werksreset + getrennt.
|
||||
- ✅ **DHCP wiederhergestellt** aus letztem ap1-Backup (`routeros/ap1-pre-core-cutover-20260806-073616.rsc`): 7 Server (`dhcp-v10…v99`) + 8 Networks + **54 statische Reservierungen** + Option `dns 1.1.1.1`. Reproduzierbar in `routeros/tp21-core-dhcp-from-ap1.rsc`. Legacy VLAN1 (pool-v1/defconf) + tote omada-inform-Option bewusst weggelassen.
|
||||
- ✅ **WAN/Internet:** dhcp-client auf `vlan100` → Liwest-Public-IP `90.146.33.177` gebunden (Arris hängt physisch an core.vlan100), NAT-Masquerade `out-interface-list=WAN`, Default-Route korrekt; die self-pointing Blackhole-Route `0.0.0.0/0 via 10.40.99.1` entfernt. **disabled-Falle beachtet:** die ap1-Masquerade-Regeln `out-interface=bridge`/`=ether1` sind `disabled=yes` und wurden NICHT übernommen.
|
||||
- ✅ **WG-Hub (TP10)** neu aufgebaut: `wg-hub` (listen 51821, Privkey aus `routeros/ap1-wg-hub.privkey`, Hub-Pubkey unverändert) + Peers `fm`/`dw` + Routen. **Beide Tunnel handshaken** (dw + fm live). Reproduzierbar (Privkey redacted) in `routeros/tp21-core-wan-wg-restore.rsc`.
|
||||
- ✅ **DNS gefixt:** core hatte `allow-remote-requests=no` + leeren Upstream → Client-DNS tot UND Hub konnte myfritz (FM-Endpoint) nicht auflösen. Fix = `allow-remote-requests=yes` + `servers=1.1.1.1` (**plain**, weil core `certs=0` → `verify-doh-cert` unmöglich). Das entsperrte auch FM.
|
||||
- ✅ **Identity** auf `crs326-core` gesetzt (war fälschlich „ap1" — genau diese Altlast stiftete Verwirrung). `mcp/mikromcp/config/routers.yaml` auf Zielschema: core `.99.1`, branch `.99.2`, ap1 `.99.11`, ap2 `.99.12` (wirkt nach MCP-Neustart; danach core via routerId `crs326-core`).
|
||||
- ✅ **disabled/invalid-Falle bereinigt (User-Hinweis „keine disabled-Falle?"):** (a) die 2 TP10-WG-Forward-Regeln (`allow from/to WG spokes`) waren `I`=invalid, weil aus dem ap1-Backup mit der **stale Interface-ID `*1D`** übernommen → auf `in/out-interface=wg-hub` (per Name) korrigiert; (b) 2 **inaktive WG-Route-Leichen** (`gateway=""`, aus einem früheren Cutover-Versuch vor Existenz von wg-hub) entfernt, nur die aktiven `gateway=wg-hub` bleiben. **Finaler Sweep sauber:** filter-invalid=0, nat-invalid=0, routes-inactive=0, if-disabled=2 (nur ungenutzte `sfp-sfpplus1/2`, gewollt).
|
||||
- ✅ **Backups:** `core-pre-dhcp-restore-20260808.backup` (vor Eingriff) + `core-post-tp21-recovery-20260808.backup` (nach allen Fixes neu gezogen) auf dem Gerät.
|
||||
- ℹ️ **branch** ist gesund (L2, forwardet), Mgmt `10.40.99.2` (+ temp `10.40.10.2`) — via core-MNDP bestätigt. Das in Winbox-MAC gesehene „0.0.0.0" ist der bekannte Discovery-Artefakt (Gerät hat auf dem Discovery-VLAN keine IP), kein echtes Problem.
|
||||
- 🔜 **TODO (Aufräum-Liste, spätere Session — danach WLAN-Neuprovisionierung):**
|
||||
1. **DoH-Cloudflare-Gateway auf core wiederherstellen** (aktuell nur plain 1.1.1.1, keine Filterung/Account-Bindung): CA-Bundle importieren → `use-doh-server=https://px35ynlol3.cloudflare-gateway.com/dns-query verify-doh-cert=yes` (Referenz-Config liegt auf **ap1**).
|
||||
2. **Intended config nach Nautobot zurückschreiben** (die Direkt-Writes liefen unter der CRS326-Cutover-Governance-Ausnahme).
|
||||
3. **branch `192.168.88.1`-Rest verifizieren** (Bootstrap Rev 4 entfernt es in Zeile 70; via MCP noch nicht gegengeprüft, weil Registry-Umstellung MCP-Neustart braucht).
|
||||
4. **core `ether4`** prüfen/geraderücken — laut User evtl. sein NIC (Dock/Monitor), steht aber als tagged Trunk in der Bridge-VLAN-Tabelle.
|
||||
5. **`ap1`/`ap2` Neuprovisionierung** (WLAN-Rebuild, eigene Session) — ap1 ist Werksreset; danach greifen die `.99.11`/`.99.12`-Registry-Einträge.
|
||||
|
||||
### TP-R — Router-Capabilities-Sweep ▸ FERTIG (`docs/research/routeros-capabilities.md`)
|
||||
- **Leitsatz: nativ vor Container, NAS vor Router** (128MB-Flash-Limit).
|
||||
|
||||
@@ -3,6 +3,12 @@
|
||||
# Alle Geräte sprechen REST über PLAIN HTTP auf Port 80.
|
||||
# -> tls.enabled: false (rest-client.ts: scheme = tls.enabled ? https : http)
|
||||
# Änderungen hier werden erst nach MikroMCP-Neustart wirksam.
|
||||
#
|
||||
# TP21.1-Stand (2026-08-08): crs326-core IST der L3-Router (Routing/DHCP/DNS/NAT/WG-Hub live).
|
||||
# core mgmt = 10.40.99.1 (vlan99-SVI, aus VLAN10-Client via core geroutet erreichbar;
|
||||
# Same-Subnet-Fallback = 10.40.10.1). branch = 10.40.99.2 (L2, .10.2 temp).
|
||||
# ap1/ap2 (.99.11/.99.12) = Zielwerte — ap1 ist derzeit Werksreset/getrennt und kommt
|
||||
# erst mit der WLAN-Neuprovisionierung (eigene Session) zurück.
|
||||
|
||||
routers:
|
||||
ap1:
|
||||
|
||||
71
routeros/tp21-branch-bootstrap.rsc
Normal file
71
routeros/tp21-branch-bootstrap.rsc
Normal file
@@ -0,0 +1,71 @@
|
||||
# TP21.1 — crs326-branch Bootstrap (Stand 2026-08-08, Rev 4)
|
||||
#
|
||||
# Hintergrund:
|
||||
# - WinBox-MAC-Scan zeigt 0.0.0.0, solange das Gerät auf dem Discovery-VLAN keine IP hat.
|
||||
# - Sichere Bring-up-Reihenfolge: Ports → VLAN-Tabelle → VLAN-Interfaces → IPs →
|
||||
# vlan-filtering → Werkseinstellungen bereinigen.
|
||||
# - bridge MUSS in jeder Bridge-VLAN-Zeile tagged sein, sonst sieht die CPU das VLAN nicht.
|
||||
# - NAS-Ports (ether2/8) sind tagged VLAN20 (NAS spricht selbst tagged).
|
||||
#
|
||||
# Vor dem Import: ether1 (Uplink) und ether24 (ap2) abziehen.
|
||||
# Nach dem Import: WinBox auf 10.40.10.2 verbinden, dann uplink einstecken.
|
||||
|
||||
/system identity set name=crs326-branch
|
||||
|
||||
/interface bridge port
|
||||
# Trunk-Ports (Uplink + AP + NAS)
|
||||
set [find interface=ether1] pvid=1 disabled=no
|
||||
set [find interface=ether2] pvid=1 disabled=no
|
||||
set [find interface=ether8] pvid=1 disabled=no
|
||||
set [find interface=ether24] pvid=1 disabled=no
|
||||
|
||||
# ACCESS-Ports
|
||||
set [find interface=ether3] pvid=10 disabled=no
|
||||
set [find interface=ether4] pvid=10 disabled=no
|
||||
set [find interface=ether5] pvid=40 disabled=no
|
||||
set [find interface=ether6] pvid=40 disabled=no
|
||||
set [find interface=ether7] pvid=20 disabled=no
|
||||
|
||||
# Restliche Ethernet-Ports flexibel als INFRA vorbelegen, aber enabled
|
||||
set [find interface=ether9] pvid=20 disabled=no
|
||||
set [find interface=ether10] pvid=20 disabled=no
|
||||
set [find interface=ether11] pvid=20 disabled=no
|
||||
set [find interface=ether12] pvid=20 disabled=no
|
||||
set [find interface=ether13] pvid=20 disabled=no
|
||||
set [find interface=ether14] pvid=20 disabled=no
|
||||
set [find interface=ether15] pvid=20 disabled=no
|
||||
set [find interface=ether16] pvid=20 disabled=no
|
||||
set [find interface=ether17] pvid=20 disabled=no
|
||||
set [find interface=ether18] pvid=20 disabled=no
|
||||
set [find interface=ether19] pvid=20 disabled=no
|
||||
set [find interface=ether20] pvid=20 disabled=no
|
||||
set [find interface=ether21] pvid=20 disabled=no
|
||||
set [find interface=ether22] pvid=20 disabled=no
|
||||
set [find interface=ether23] pvid=20 disabled=no
|
||||
set [find interface=sfp-sfpplus1] pvid=1 disabled=yes
|
||||
set [find interface=sfp-sfpplus2] pvid=1 disabled=yes
|
||||
|
||||
/interface bridge vlan
|
||||
add bridge=bridge tagged=ether1,ether24,bridge untagged=ether3,ether4 vlan-ids=10 comment=MAIN
|
||||
add bridge=bridge tagged=ether1,ether2,ether8,ether24,bridge untagged=ether7,ether9,ether10,ether11,ether12,ether13,ether14,ether15,ether16,ether17,ether18,ether19,ether20,ether21,ether22,ether23 vlan-ids=20 comment=INFRA
|
||||
add bridge=bridge tagged=ether1,ether24,bridge vlan-ids=30 comment=IOT
|
||||
add bridge=bridge tagged=ether1,ether24,bridge untagged=ether5,ether6 vlan-ids=40 comment=MEDIA
|
||||
add bridge=bridge tagged=ether1,ether24,bridge vlan-ids=50 comment=UNTRUSTED
|
||||
add bridge=bridge tagged=ether1,ether24,bridge vlan-ids=90 comment=GUEST
|
||||
add bridge=bridge tagged=ether1,ether24,bridge vlan-ids=99 comment=MGMT
|
||||
|
||||
/interface vlan add name=vlan10 interface=bridge vlan-id=10 comment="TEMP Mgmt VLAN10"
|
||||
/interface vlan add name=vlan99 interface=bridge vlan-id=99 comment=MGMT
|
||||
|
||||
/ip address
|
||||
add address=10.40.99.2/24 interface=vlan99 comment="TP21-mgmt-target"
|
||||
add address=10.40.10.2/24 interface=vlan10 comment="TEMP Bring-up VLAN10"
|
||||
|
||||
/ip dns set servers=10.40.99.1 allow-remote-requests=no
|
||||
|
||||
/interface bridge set [find name=bridge] vlan-filtering=yes
|
||||
|
||||
/ip route add dst-address=0.0.0.0/0 gateway=10.40.99.1 comment="TP21-default"
|
||||
|
||||
:do { /ip address remove [find address="192.168.88.1/24"] } on-error={}
|
||||
:do { /ip dhcp-client disable [find interface=bridge] } on-error={}
|
||||
82
routeros/tp21-core-dhcp-from-ap1.rsc
Normal file
82
routeros/tp21-core-dhcp-from-ap1.rsc
Normal file
@@ -0,0 +1,82 @@
|
||||
# TP21.1 core DHCP restore from ap1-pre-core-cutover-20260806-073616.rsc
|
||||
## options
|
||||
:do { /ip dhcp-server option add code=6 name="dns 1.1.1.1" value=0x01010101 } on-error={}
|
||||
## pools
|
||||
:do { /ip pool add name=pool-v10 ranges=10.40.10.100-10.40.10.200 } on-error={}
|
||||
:do { /ip pool add name=pool-v20 ranges=10.40.20.100-10.40.20.200 } on-error={}
|
||||
:do { /ip pool add name=pool-v30 ranges=10.40.30.100-10.40.30.250 } on-error={}
|
||||
:do { /ip pool add name=pool-v40 ranges=10.40.40.100-10.40.40.200 } on-error={}
|
||||
:do { /ip pool add name=pool-v50 ranges=10.40.50.100-10.40.50.200 } on-error={}
|
||||
:do { /ip pool add name=pool-v90 ranges=10.40.90.100-10.40.90.200 } on-error={}
|
||||
:do { /ip pool add name=pool-v99 ranges=10.40.99.100-10.40.99.200 } on-error={}
|
||||
## dhcp-servers
|
||||
:do { /ip dhcp-server add address-pool=pool-v10 comment=MAIN interface=vlan10 lease-time=1d name=dhcp-v10 } on-error={}
|
||||
:do { /ip dhcp-server add address-pool=pool-v20 comment=INFRA interface=vlan20 lease-time=1d name=dhcp-v20 } on-error={}
|
||||
:do { /ip dhcp-server add address-pool=pool-v30 comment=IOT interface=vlan30 lease-time=1d name=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server add address-pool=pool-v40 comment=MEDIA interface=vlan40 lease-time=1d name=dhcp-v40 } on-error={}
|
||||
:do { /ip dhcp-server add address-pool=pool-v50 comment=UNTRUSTED interface=vlan50 lease-time=1d name=dhcp-v50 } on-error={}
|
||||
:do { /ip dhcp-server add address-pool=pool-v90 comment=GUEST interface=vlan90 lease-time=12h name=dhcp-v90 } on-error={}
|
||||
:do { /ip dhcp-server add address-pool=pool-v99 comment=MGMT interface=vlan99 lease-time=1d name=dhcp-v99 } on-error={}
|
||||
## networks
|
||||
:do { /ip dhcp-server network add address=10.40.10.0/24 comment=MAIN dns-server=10.40.10.1 gateway=10.40.10.1 } on-error={}
|
||||
:do { /ip dhcp-server network add address=10.40.20.0/24 comment=INFRA dns-server=10.40.20.1 gateway=10.40.20.1 } on-error={}
|
||||
:do { /ip dhcp-server network add address=10.40.30.0/24 comment=IOT dns-server=10.40.30.1 gateway=10.40.30.1 } on-error={}
|
||||
:do { /ip dhcp-server network add address=10.40.40.0/24 comment=MEDIA dns-server=10.40.40.1 gateway=10.40.40.1 } on-error={}
|
||||
:do { /ip dhcp-server network add address=10.40.50.0/24 comment=UNTRUSTED dns-server=10.40.50.1 gateway=10.40.50.1 } on-error={}
|
||||
:do { /ip dhcp-server network add address=10.40.90.0/24 comment=GUEST dns-server=10.40.90.1 gateway=10.40.90.1 } on-error={}
|
||||
:do { /ip dhcp-server network add address=10.40.99.0/24 comment=MGMT dns-server=10.40.99.1 gateway=10.40.99.1 } on-error={}
|
||||
## leases
|
||||
:do { /ip dhcp-server lease add address=10.40.10.82 client-id=1:56:71:6c:22:e6:a9 dhcp-option="dns 1.1.1.1" mac-address=56:71:6C:22:E6:A9 server=dhcp-v10 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.10.196 client-id=1:f2:62:4c:e1:af:9 mac-address=F2:62:4C:E1:AF:09 server=dhcp-v10 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.40.199 client-id=1:48:a6:b8:b:63:10 mac-address=48:A6:B8:0B:63:10 server=dhcp-v40 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.40.191 client-id=1:34:7e:5c:32:37:96 mac-address=34:7E:5C:32:37:96 server=dhcp-v40 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.40.192 client-id=1:34:7e:5c:32:33:b8 mac-address=34:7E:5C:32:33:B8 server=dhcp-v40 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.40.193 client-id=1:78:28:ca:80:2a:f6 mac-address=78:28:CA:80:2A:F6 server=dhcp-v40 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.40.195 client-id=1:78:28:ca:82:16:c2 mac-address=78:28:CA:82:16:C2 server=dhcp-v40 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.40.201 client-id=1:94:9f:3e:49:59:ee mac-address=94:9F:3E:49:59:EE server=dhcp-v40 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.40.196 client-id=1:48:a6:b8:16:38:ae mac-address=48:A6:B8:16:38:AE server=dhcp-v40 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.40.197 client-id=1:48:a6:b8:14:fe:f2 mac-address=48:A6:B8:14:FE:F2 server=dhcp-v40 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.40.200 client-id=1:48:a6:b8:69:69:7b mac-address=48:A6:B8:69:69:7B server=dhcp-v40 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.40.194 client-id=1:48:a6:b8:14:fe:d0 mac-address=48:A6:B8:14:FE:D0 server=dhcp-v40 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.40.198 comment=SonosTerrasse mac-address=78:28:CA:D2:0D:AC server=dhcp-v40 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.202 comment=shelly-s22_kueche_steckdose3-2 mac-address=A0:85:E3:C8:65:34 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.203 comment=shelly-s23_dieleug-wohnzimmer_licht mac-address=AC:15:18:7B:62:20 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.205 comment=shelly-s25_bad_lichtschalter mac-address=98:A3:16:79:38:50 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.206 comment=shelly-s20_kueche_steckdosen2 mac-address=98:A3:16:7C:5F:EC server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.207 comment=shelly-s21_kueche_steckdosen4 mac-address=20:6E:F1:01:F9:F8 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.208 comment=shelly-s1_weihnachten_kueche mac-address=E4:B0:63:D7:C7:A4 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.209 comment=shelly-s2_weihnachten_terrasse mac-address=28:37:2F:36:F4:7C server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.210 comment=shelly-s3_weihnachten_kinderzimmer mac-address=E4:B0:63:E4:EF:7C server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.211 comment=shelly-s4_kueche_mikrowelle mac-address=E4:B0:63:E4:0F:30 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.212 comment=shelly-s5_kueche_backofen mac-address=D8:85:AC:0C:5C:C8 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.213 comment=shelly-s6_kueche_kuehlschrank mac-address=D0:CF:13:D8:18:FC server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.214 comment=shelly-s7_kueche_tiefkuehlschrank mac-address=D0:CF:13:D9:94:E8 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.215 comment=shelly-s8_kueche_geschirrspueler mac-address=E4:B0:63:FA:FD:E0 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.216 comment=shelly-s9_wohnzimmer_sideboard mac-address=E8:F6:0A:61:88:08 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.217 comment=shelly-s10_bad_sonos mac-address=E4:B0:63:FC:57:E4 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.218 comment=shelly-s11_kinderzimmer_sonos mac-address=E4:B0:63:FA:6C:00 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.219 comment=shelly-s12_dieleug_steckdosen mac-address=48:F6:EE:C8:E6:AC server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.220 comment=shelly-s13_arbeitszimmer_technik mac-address=48:F6:EE:DD:6A:F4 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.221 comment=shelly-s14_schlafzimmer_bett mac-address=E4:B0:63:FC:59:48 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.222 comment=shelly-s15_technik_pve mac-address=E4:B0:63:FA:D5:34 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.223 comment=shelly-s16_wohnzimmer_steckdosen mac-address=10:20:BA:FA:F5:40 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.224 comment=shelly-s17_bad_steckdosen mac-address=10:20:BA:FB:6D:64 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.225 comment=shelly-s18_kueche_steckdosen1 mac-address=48:F6:EE:CC:16:E4 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.226 comment=shelly-s19_kueche_steckdosen3 mac-address=10:20:BA:FB:70:FC server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.227 comment=switchbot-floorlamp mac-address=B8:F8:62:09:F2:04 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.228 comment=Twinkly_Weihnachtsgirlande mac-address=98:F4:AB:2C:A7:88 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.230 comment=Withings_waage mac-address=00:24:E4:40:2A:72 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.231 comment=Withings_blutdruck mac-address=A4:7E:FA:18:2C:64 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.232 comment=pve-homematic-raspi-ccu mac-address=BC:24:11:8E:0A:57 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.233 comment=shelly-s26_bad_luefter mac-address=98:A3:16:7A:A3:54 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.236 comment=lichterkette mac-address=A4:F0:0F:5F:D0:EC server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.237 comment=lichterkette-mini mac-address=24:DC:C3:9B:89:64 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.241 comment=NukiSmartlock mac-address=28:DB:A7:09:7B:54 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.244 comment=NukiBridge mac-address=24:62:AB:B1:63:F4 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.8 comment=DTUBI-414392337823 mac-address=54:F2:9F:12:51:F0 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.20.10 comment=nas-bf mac-address=90:09:D0:58:20:F9 server=dhcp-v20 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.40.11 comment=tv mac-address=70:AF:24:B8:C9:86 server=dhcp-v40 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.5 comment=P750W mac-address=4C:EB:BD:E3:25:F2 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.180 client-id=1:e4:bc:96:1f:b2:81 comment=Airfryer dhcp-option="dns 1.1.1.1" mac-address=E4:BC:96:1F:B2:81 server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.204 comment=shelly-s24_bad_spiegelschrank mac-address=14:33:5C:D8:2D:7C server=dhcp-v30 } on-error={}
|
||||
:do { /ip dhcp-server lease add address=10.40.30.150 client-id=1:fc:ee:11:3:32:26 comment=Ender3V3KE-3226 mac-address=FC:EE:11:03:32:26 server=dhcp-v30 } on-error={}
|
||||
40
routeros/tp21-core-wan-wg-restore.rsc
Normal file
40
routeros/tp21-core-wan-wg-restore.rsc
Normal file
@@ -0,0 +1,40 @@
|
||||
# TP21.1 — crs326-core WAN + WG-Hub + NAT restore (2026-08-08)
|
||||
#
|
||||
# Kontext: Beim Core-Cutover (ap1 -> crs326-core als L3-Router) fehlten nach dem
|
||||
# ap1-Plattmachen auf core noch WAN-Egress und der WG-Hub. DHCP wurde separat
|
||||
# via tp21-core-dhcp-from-ap1.rsc wiederhergestellt.
|
||||
# Quelle = letztes ap1-Backup routeros/ap1-pre-core-cutover-20260806-073616.rsc.
|
||||
#
|
||||
# WICHTIG (disabled-Falle): ap1 hatte 3 Masquerade-Regeln, davon 2 disabled=yes
|
||||
# (out-interface=bridge / out-interface=ether1). Auf core NUR die WAN-Variante
|
||||
# (out-interface-list=WAN, wobei WAN-Liste = vlan100). Die disabled-Regeln NICHT
|
||||
# übernehmen.
|
||||
#
|
||||
# Der WG-Privkey ist ein Secret und steht NICHT hier -> aus routeros/ap1-wg-hub.privkey
|
||||
# (gitignored) einsetzen. Der abgeleitete Hub-Pubkey bleibt identisch
|
||||
# (P/bztIk13cAmLHbN6oHGGnWAKLZsqR5TXAbFP+NGGBk=), damit FM/DW-Spokes weiter matchen.
|
||||
|
||||
# --- WG-Hub (TP10 Multi-Site VPN) ---
|
||||
:do { /interface wireguard add name=wg-hub listen-port=51821 mtu=1412 comment="TP10 Multi-Site VPN Hub (FM/DW spokes)" } on-error={}
|
||||
:do { /interface wireguard set [find name=wg-hub] private-key="<aus routeros/ap1-wg-hub.privkey>" } on-error={}
|
||||
:do { /interface wireguard peers add interface=wg-hub name=fm comment=fm allowed-address=10.101.0.0/24 endpoint-address=abxhutfgsid9snmy.myfritz.net endpoint-port=52476 public-key="dzRY0lnnUygijChWe5wXZmXPeNcbdALpqBptA3fyiVE=" } on-error={}
|
||||
:do { /interface wireguard peers add interface=wg-hub name=dw comment=dw allowed-address=10.95.10.0/24 public-key="FqYZLztQ/qME5VDie5QLGH++5299WJiE1dPpQnPbzUw=" } on-error={}
|
||||
:do { /ip route add dst-address=10.101.0.0/24 gateway=wg-hub comment="TP10: FM spoke -> wg-hub" } on-error={}
|
||||
:do { /ip route add dst-address=10.95.10.0/24 gateway=wg-hub comment="TP10: DW spoke -> wg-hub" } on-error={}
|
||||
|
||||
# --- NAT (nur WAN-Variante; bridge/ether1-Masquerade bewusst NICHT) ---
|
||||
:do { /ip firewall nat add action=accept chain=srcnat dst-address=10.40.0.0/16 comment="TP4: no-NAT inter-VLAN (LAN-internal, before masquerade)" } on-error={}
|
||||
:do { /ip firewall nat add action=masquerade chain=srcnat out-interface-list=WAN ipsec-policy=out,none comment="defconf: masquerade" } on-error={}
|
||||
|
||||
# --- WAN dhcp-client auf vlan100 (Liwest); Blackhole-Selbst-Default-Route weg ---
|
||||
:do { /ip dhcp-client add interface=vlan100 use-peer-dns=no use-peer-ntp=no comment="WAN Arris DHCP (Liwest) via vlan100" } on-error={}
|
||||
:do { /ip route remove [find dst-address=0.0.0.0/0 gateway=10.40.99.1] } on-error={}
|
||||
|
||||
# --- DNS-Resolver (PROVISORISCH plain, DoH-TODO s.u.) ---
|
||||
# core hatte allow-remote-requests=no + leeren Upstream -> Client-DNS tot + FM-Hub
|
||||
# konnte myfritz nicht auflösen. Fix (plain, weil core keine CA-Certs hat -> certs=0,
|
||||
# verify-doh-cert unmöglich):
|
||||
:do { /ip dns set allow-remote-requests=yes servers=1.1.1.1 } on-error={}
|
||||
# TODO (spätere Session, VOR/mit WLAN-Rebuild): CA-Bundle auf core importieren, dann
|
||||
# DoH-Cloudflare-Gateway wie ap1 setzen:
|
||||
# /ip dns set use-doh-server=https://px35ynlol3.cloudflare-gateway.com/dns-query verify-doh-cert=yes
|
||||
Reference in New Issue
Block a user