559 lines
28 KiB
Plaintext
559 lines
28 KiB
Plaintext
# 2026-08-06 06:16:12 by RouterOS 7.23.2
|
|
# software id = 2ATI-ZRRH
|
|
#
|
|
# model = C52iG-5HaxD2HaxD
|
|
# serial number = HM70BFZBYVQ
|
|
/interface bridge
|
|
add admin-mac=D0:EA:11:4D:40:E1 auto-mac=no comment=defconf name=bridge \
|
|
vlan-filtering=yes
|
|
/interface wireguard
|
|
add comment="TP10 Multi-Site VPN Hub (FM/DW spokes). Kein IP aufs IF (Routing \
|
|
via AllowedIPs/Routes)." listen-port=51821 mtu=1412 name=wg-hub
|
|
/interface vlan
|
|
add comment="MAIN 10.40.10.0/24" interface=bridge name=vlan10 vlan-id=10
|
|
add comment="INFRA 10.40.20.0/24" interface=bridge name=vlan20 vlan-id=20
|
|
add comment="IOT 10.40.30.0/24" interface=bridge name=vlan30 vlan-id=30
|
|
add comment="MEDIA 10.40.40.0/24" interface=bridge name=vlan40 vlan-id=40
|
|
add comment="UNTRUSTED 10.40.50.0/24" interface=bridge name=vlan50 vlan-id=50
|
|
add comment="GUEST 10.40.90.0/24" interface=bridge name=vlan90 vlan-id=90
|
|
add comment="MGMT 10.40.99.0/24" interface=bridge name=vlan99 vlan-id=99
|
|
add comment="WAN Arris (Liwest)" interface=bridge name=vlan100 vlan-id=100
|
|
/interface list
|
|
add comment=defconf name=WAN
|
|
add comment=defconf name=LAN
|
|
/interface wifi channel
|
|
add band=2ghz-ax disabled=no frequency=2462 name=ch-2g width=20mhz
|
|
add band=5ghz-ax disabled=no frequency=5745 name=ch-5g skip-dfs-channels=\
|
|
10min-cac width=20/40/80mhz
|
|
/interface wifi datapath
|
|
add bridge=bridge name=dp-main vlan-id=10
|
|
add bridge=bridge name=dp-iot vlan-id=30
|
|
add bridge=bridge name=dp-media vlan-id=40
|
|
add bridge=bridge name=dp-untrusted vlan-id=50
|
|
add bridge=bridge name=dp-guest vlan-id=90
|
|
add bridge=bridge name=dp-infra vlan-id=20
|
|
/interface wifi security
|
|
add authentication-types=wpa3-psk disabled=no ft=yes ft-over-ds=yes name=\
|
|
sec-main
|
|
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=no name=sec-iot
|
|
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=no ft-over-ds=no \
|
|
name=sec-media
|
|
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=no name=\
|
|
sec-untrusted
|
|
add authentication-types=wpa2-psk,wpa3-psk ft=yes ft-over-ds=yes name=\
|
|
sec-guest
|
|
add authentication-types=wpa2-psk,wpa3-psk ft=no name=sec-infra
|
|
/interface wifi configuration
|
|
add country=Austria disabled=no mode=ap name=cfg-main-2g security=sec-main \
|
|
ssid=dirtyvader-main tx-power=20
|
|
add country=Austria datapath=dp-iot mode=ap multicast-enhance=enabled name=\
|
|
cfg-iot security=sec-iot ssid=dirtyvader-iot
|
|
add country=Austria datapath=dp-media mode=ap multicast-enhance=enabled name=\
|
|
cfg-media security=sec-media ssid=dirtyvader-media
|
|
add country=Austria datapath=dp-untrusted mode=ap name=cfg-untrusted \
|
|
security=sec-untrusted ssid=dirtyvader-untrusted
|
|
add country=Austria datapath=dp-guest mode=ap name=cfg-guest security=\
|
|
sec-guest ssid=dirtyvader-guest
|
|
add country=Austria datapath=dp-infra mode=ap name=cfg-infra security=\
|
|
sec-infra ssid=dirtyvader-infra
|
|
/interface wifi
|
|
set [ find default-name=wifi2 ] channel.frequency=2412 configuration=\
|
|
cfg-main-2g configuration.manager=local disabled=no
|
|
add configuration=cfg-guest disabled=no mac-address=D2:EA:11:4D:40:EB \
|
|
master-interface=wifi2 name=w2-guest
|
|
add configuration=cfg-iot disabled=no mac-address=D2:EA:11:4D:40:E8 \
|
|
master-interface=wifi2 name=w2-iot
|
|
add configuration=cfg-media disabled=no mac-address=D2:EA:11:4D:40:E9 \
|
|
master-interface=wifi2 name=w2-media
|
|
add configuration=cfg-untrusted disabled=no mac-address=D2:EA:11:4D:40:EA \
|
|
master-interface=wifi2 name=w2-untrusted
|
|
/interface wifi steering
|
|
add name=st-main neighbor-group=bf-main rrm=yes wnm=yes
|
|
/interface wifi configuration
|
|
add channel=ch-5g country=Austria datapath=dp-main mode=ap name=cfg-main-5g \
|
|
security=sec-main ssid=dirtyvader-main steering=st-main
|
|
/interface wifi
|
|
set [ find default-name=wifi1 ] channel.frequency=5180 configuration=\
|
|
cfg-main-5g configuration.manager=local disabled=no
|
|
add configuration=cfg-guest disabled=no mac-address=D2:EA:11:4D:40:E7 \
|
|
master-interface=wifi1 name=w5-guest
|
|
add configuration=cfg-media disabled=no mac-address=D2:EA:11:4D:40:E5 \
|
|
master-interface=wifi1 name=w5-media
|
|
add configuration=cfg-untrusted disabled=no mac-address=D2:EA:11:4D:40:E6 \
|
|
master-interface=wifi1 name=w5-untrusted
|
|
/ip dhcp-server option
|
|
add code=6 name="dns 1.1.1.1" value=0x01010101
|
|
add code=138 name=omada-inform value=0x0A2814AF
|
|
/ip pool
|
|
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
|
|
add name=pool-v10 ranges=10.40.10.100-10.40.10.200
|
|
add name=pool-v20 ranges=10.40.20.100-10.40.20.200
|
|
add name=pool-v30 ranges=10.40.30.100-10.40.30.250
|
|
add name=pool-v40 ranges=10.40.40.100-10.40.40.200
|
|
add name=pool-v50 ranges=10.40.50.100-10.40.50.200
|
|
add name=pool-v90 ranges=10.40.90.100-10.40.90.200
|
|
add name=pool-v99 ranges=10.40.99.100-10.40.99.200
|
|
add comment="BF flat .41 (legacy, retiring)" name=pool-v1 ranges=\
|
|
10.40.41.180-10.40.41.199
|
|
/ip dhcp-server
|
|
add address-pool=pool-v1 disabled=yes interface=bridge lease-time=2h name=\
|
|
defconf
|
|
add address-pool=pool-v10 comment=MAIN interface=vlan10 lease-time=1d name=\
|
|
dhcp-v10
|
|
add address-pool=pool-v20 comment=INFRA interface=vlan20 lease-time=1d name=\
|
|
dhcp-v20
|
|
add address-pool=pool-v30 comment=IOT interface=vlan30 lease-time=1d name=\
|
|
dhcp-v30
|
|
add address-pool=pool-v40 comment=MEDIA interface=vlan40 lease-time=1d name=\
|
|
dhcp-v40
|
|
add address-pool=pool-v50 comment=UNTRUSTED interface=vlan50 lease-time=1d \
|
|
name=dhcp-v50
|
|
add address-pool=pool-v90 comment=GUEST interface=vlan90 lease-time=12h name=\
|
|
dhcp-v90
|
|
add address-pool=pool-v99 comment=MGMT interface=vlan99 lease-time=1d name=\
|
|
dhcp-v99
|
|
/system logging action
|
|
add disk-file-name=wan-test disk-lines-per-file=2000 name=wantest target=disk
|
|
/system script
|
|
add dont-require-permissions=no name=wantest-probe owner=admin policy=\
|
|
read,write,policy,test source=" :local ts ([/system clock get date] . \" \
|
|
\" . [/system clock get time])\
|
|
\n :local e1stat \"\?\"\
|
|
\n :do { :set e1stat [/ip dhcp-client get [find interface=ether1] status]\
|
|
\_} on-error={}\
|
|
\n :local e1addr \"-\"\
|
|
\n :do { :set e1addr [/ip dhcp-client get [find interface=ether1] address\
|
|
] } on-error={}\
|
|
\n :local e1mac [/interface ethernet get [find name=ether1] mac-address]\
|
|
\n :log info (\"WANTEST [\" . \$ts . \"] ether1 status=\" . \$e1stat . \"\
|
|
\_addr=\" . \$e1addr . \" mac=\" . \$e1mac)\
|
|
\n :local gw \"-\"\
|
|
\n :do { :set gw [/ip route get [find dst-address=\"0.0.0.0/0\" active=ye\
|
|
s] gateway] } on-error={}\
|
|
\n :log info (\"WANTEST route default-gw=\" . \$gw)\
|
|
\n # WAN-Routing+NAT: Router -> public 1.1.1.1 (UDP/53). UNABH\C3\84NGIG \
|
|
von ap1-DNS-Config.\
|
|
\n # (ICMP/HTTPS sind hier geblockt -> :resolve gegen feste IP ist das ro\
|
|
buste Signal.)\
|
|
\n :do { :local w [:resolve \"google.com\" server=1.1.1.1] ; :log info (\
|
|
\"WANTEST wan-reach via-1.1.1.1 ok google.com=\" . \$w) } on-error={ :log \
|
|
info \"WANTEST wan-reach via-1.1.1.1 FAIL (Routing/NAT\?)\" }\
|
|
\n # DoH end-to-end: ap1-Resolver = was die Clients als DNS bekommen\
|
|
\n :do { :local d [:resolve \"google.com\"] ; :log info (\"WANTEST dns-do\
|
|
h ok google.com=\" . \$d) } on-error={ :log info \"WANTEST dns-doh FAIL (D\
|
|
oH/Bootstrap\?)\" }"
|
|
add dont-require-permissions=no name=wantest-run owner=admin policy=\
|
|
read,write,policy,test source=" :global WTN\
|
|
\n :if (([:typeof \$WTN] = \"nothing\") or (\$WTN = \"\")) do={ :set WTN \
|
|
24 }\
|
|
\n :log info (\"WANTEST run start (\" . \$WTN . \"x @15s, ~\" . (\$WTN * \
|
|
15 / 60) . \" min)\")\
|
|
\n :for i from=1 to=\$WTN do={\
|
|
\n /system script run wantest-probe\
|
|
\n :delay 15s\
|
|
\n }\
|
|
\n :log info \"WANTEST run done\""
|
|
add dont-require-permissions=no name=wanmac-clone owner=admin policy=\
|
|
read,write,policy,test source=" :global FBMAC\
|
|
\n :if (([:typeof \$FBMAC] = \"nothing\") or (\$FBMAC = \"\")) do={ :set \
|
|
FBMAC \"0C:72:74:36:90:99\" }\
|
|
\n :global E1ORIG\
|
|
\n :set E1ORIG [/interface ethernet get [find name=ether1] mac-address]\
|
|
\n :log info (\"WANTEST macclone: orig=\" . \$E1ORIG . \" -> fb=\" . \$FB\
|
|
MAC . \" (Auto-Revert in ~90s)\")\
|
|
\n /interface ethernet set [find name=ether1] mac-address=\$FBMAC\
|
|
\n :do { /ip dhcp-client release [find interface=ether1] } on-error={}\
|
|
\n :delay 2s\
|
|
\n :do { /ip dhcp-client renew [find interface=ether1] } on-error={}\
|
|
\n :delay 25s\
|
|
\n :for i from=1 to=4 do={ /system script run wantest-probe ; :delay 15s \
|
|
}\
|
|
\n # --- garantierter Auto-Revert im selben Lauf (kein Scheduler n\C3\B6t\
|
|
ig) ---\
|
|
\n /interface ethernet reset-mac-address [find name=ether1]\
|
|
\n :do { /ip dhcp-client release [find interface=ether1] } on-error={}\
|
|
\n :delay 2s\
|
|
\n :do { /ip dhcp-client renew [find interface=ether1] } on-error={}\
|
|
\n :delay 15s\
|
|
\n /system script run wantest-probe\
|
|
\n :log info (\"WANTEST macclone done -> revert auf factory-MAC (orig war\
|
|
\_\" . \$E1ORIG . \")\")"
|
|
add dont-require-permissions=no name=wanmac-revert owner=admin policy=\
|
|
read,write,policy,test source=" /interface ethernet reset-mac-address [fi\
|
|
nd name=ether1]\
|
|
\n :do { /ip dhcp-client release [find interface=ether1] } on-error={}\
|
|
\n :delay 2s\
|
|
\n :do { /ip dhcp-client renew [find interface=ether1] } on-error={}\
|
|
\n :delay 10s\
|
|
\n /system script run wantest-probe\
|
|
\n :log info \"WANTEST macclone manual-revert -> factory-MAC\""
|
|
/disk settings
|
|
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
|
|
/interface bridge port
|
|
add bridge=bridge comment=defconf interface=ether2
|
|
add bridge=bridge comment=defconf interface=ether3
|
|
add bridge=bridge comment=defconf interface=ether4
|
|
add bridge=bridge comment=defconf interface=ether5
|
|
add bridge=bridge comment=defconf interface=wifi2
|
|
add bridge=bridge interface=ether1
|
|
/interface bridge vlan
|
|
add bridge=bridge untagged=bridge,ether2 vlan-ids=1
|
|
add bridge=bridge tagged=bridge,ether2,ether1 vlan-ids=10
|
|
add bridge=bridge tagged=bridge,ether2,ether1 vlan-ids=20
|
|
add bridge=bridge tagged=bridge,ether2,ether1 vlan-ids=30
|
|
add bridge=bridge tagged=bridge,ether2,ether1 vlan-ids=40
|
|
add bridge=bridge tagged=bridge,ether2,ether1 vlan-ids=50
|
|
add bridge=bridge tagged=bridge,ether2,ether1 vlan-ids=90
|
|
add bridge=bridge tagged=bridge,ether2,ether1 vlan-ids=99
|
|
add bridge=bridge tagged=bridge,ether2,ether1 vlan-ids=100
|
|
/interface list member
|
|
add comment=defconf interface=bridge list=LAN
|
|
add comment=defconf interface=ether1 list=WAN
|
|
add comment="WAN Arris via vlan100" interface=vlan100 list=WAN
|
|
/interface wifi access-list
|
|
add action=accept comment="pin P750W to ap1 (1/2): accept on ap1 iot" \
|
|
disabled=yes interface=w2-iot mac-address=4C:EB:BD:E3:25:F2
|
|
add action=reject comment=\
|
|
"pin P750W to ap1 (2/2): reject on any other AP incl dynamic ap2 VAPs" \
|
|
disabled=yes mac-address=4C:EB:BD:E3:25:F2
|
|
/interface wifi cap
|
|
set caps-man-addresses=10.40.41.1 discovery-interfaces=bridge
|
|
/interface wifi capsman
|
|
set enabled=yes interfaces=bridge
|
|
/interface wifi provisioning
|
|
add action=create-dynamic-enabled master-configuration=cfg-main-2g \
|
|
slave-configurations=cfg-iot,cfg-media,cfg-untrusted,cfg-guest,cfg-infra \
|
|
supported-bands=2ghz-ax
|
|
add action=create-dynamic-enabled master-configuration=cfg-main-5g \
|
|
slave-configurations=cfg-media,cfg-untrusted,cfg-guest,cfg-infra \
|
|
supported-bands=5ghz-ax
|
|
/interface wireguard peers
|
|
add allowed-address=10.101.0.0/24 comment=fm endpoint-address=\
|
|
abxhutfgsid9snmy.myfritz.net endpoint-port=52476 interface=wg-hub name=fm \
|
|
public-key="dzRY0lnnUygijChWe5wXZmXPeNcbdALpqBptA3fyiVE="
|
|
add allowed-address=10.95.10.0/24 comment=dw interface=wg-hub name=dw \
|
|
public-key="FqYZLztQ/qME5VDie5QLGH++5299WJiE1dPpQnPbzUw="
|
|
/ip address
|
|
add address=10.40.41.1/24 comment=defconf interface=bridge network=10.40.41.0
|
|
add address=10.40.10.1/24 comment="MAIN GW" interface=vlan10 network=\
|
|
10.40.10.0
|
|
add address=10.40.20.1/24 comment="INFRA GW" interface=vlan20 network=\
|
|
10.40.20.0
|
|
add address=10.40.30.1/24 comment="IOT GW" interface=vlan30 network=\
|
|
10.40.30.0
|
|
add address=10.40.40.1/24 comment="MEDIA GW" interface=vlan40 network=\
|
|
10.40.40.0
|
|
add address=10.40.50.1/24 comment="UNTRUSTED GW" interface=vlan50 network=\
|
|
10.40.50.0
|
|
add address=10.40.90.1/24 comment="GUEST GW" interface=vlan90 network=\
|
|
10.40.90.0
|
|
add address=10.40.99.1/24 comment="MGMT GW" interface=vlan99 network=\
|
|
10.40.99.0
|
|
add address=10.40.41.254/24 comment="Secondary = alte FB-GW-IP; haelt statisch\
|
|
e .41-Hosts online nach Arris-Swap (ap1 NATs + WG-Hub)" interface=bridge \
|
|
network=10.40.41.0
|
|
/ip dhcp-client
|
|
add comment=defconf disabled=yes interface=ether1 name=client1 use-peer-dns=\
|
|
no
|
|
add comment="WAN Arris DHCP (Liwest) via vlan100" interface=vlan100 name=\
|
|
client2 use-peer-dns=no use-peer-ntp=no
|
|
/ip dhcp-server lease
|
|
add address=10.40.10.82 client-id=1:56:71:6c:22:e6:a9 dhcp-option=\
|
|
"dns 1.1.1.1" mac-address=56:71:6C:22:E6:A9 server=dhcp-v10
|
|
add address=10.40.10.196 client-id=1:f2:62:4c:e1:af:9 mac-address=\
|
|
F2:62:4C:E1:AF:09 server=dhcp-v10
|
|
add address=10.40.40.199 client-id=1:48:a6:b8:b:63:10 mac-address=\
|
|
48:A6:B8:0B:63:10 server=dhcp-v40
|
|
add address=10.40.40.191 client-id=1:34:7e:5c:32:37:96 mac-address=\
|
|
34:7E:5C:32:37:96 server=dhcp-v40
|
|
add address=10.40.40.192 client-id=1:34:7e:5c:32:33:b8 mac-address=\
|
|
34:7E:5C:32:33:B8 server=dhcp-v40
|
|
add address=10.40.40.193 client-id=1:78:28:ca:80:2a:f6 mac-address=\
|
|
78:28:CA:80:2A:F6 server=dhcp-v40
|
|
add address=10.40.40.195 client-id=1:78:28:ca:82:16:c2 mac-address=\
|
|
78:28:CA:82:16:C2 server=dhcp-v40
|
|
add address=10.40.40.201 client-id=1:94:9f:3e:49:59:ee mac-address=\
|
|
94:9F:3E:49:59:EE server=dhcp-v40
|
|
add address=10.40.40.196 client-id=1:48:a6:b8:16:38:ae mac-address=\
|
|
48:A6:B8:16:38:AE server=dhcp-v40
|
|
add address=10.40.40.197 client-id=1:48:a6:b8:14:fe:f2 mac-address=\
|
|
48:A6:B8:14:FE:F2 server=dhcp-v40
|
|
add address=10.40.40.200 client-id=1:48:a6:b8:69:69:7b mac-address=\
|
|
48:A6:B8:69:69:7B server=dhcp-v40
|
|
add address=10.40.40.194 client-id=1:48:a6:b8:14:fe:d0 mac-address=\
|
|
48:A6:B8:14:FE:D0 server=dhcp-v40
|
|
add address=10.40.40.198 comment=SonosTerrasse mac-address=78:28:CA:D2:0D:AC \
|
|
server=dhcp-v40
|
|
add address=10.40.30.202 comment=shelly-s22_kueche_steckdose3-2 mac-address=\
|
|
A0:85:E3:C8:65:34 server=dhcp-v30
|
|
add address=10.40.30.203 comment=shelly-s23_dieleug-wohnzimmer_licht \
|
|
mac-address=AC:15:18:7B:62:20 server=dhcp-v30
|
|
add address=10.40.30.205 comment=shelly-s25_bad_lichtschalter mac-address=\
|
|
98:A3:16:79:38:50 server=dhcp-v30
|
|
add address=10.40.30.206 comment=shelly-s20_kueche_steckdosen2 mac-address=\
|
|
98:A3:16:7C:5F:EC server=dhcp-v30
|
|
add address=10.40.30.207 comment=shelly-s21_kueche_steckdosen4 mac-address=\
|
|
20:6E:F1:01:F9:F8 server=dhcp-v30
|
|
add address=10.40.30.208 comment=shelly-s1_weihnachten_kueche mac-address=\
|
|
E4:B0:63:D7:C7:A4 server=dhcp-v30
|
|
add address=10.40.30.209 comment=shelly-s2_weihnachten_terrasse mac-address=\
|
|
28:37:2F:36:F4:7C server=dhcp-v30
|
|
add address=10.40.30.210 comment=shelly-s3_weihnachten_kinderzimmer \
|
|
mac-address=E4:B0:63:E4:EF:7C server=dhcp-v30
|
|
add address=10.40.30.211 comment=shelly-s4_kueche_mikrowelle mac-address=\
|
|
E4:B0:63:E4:0F:30 server=dhcp-v30
|
|
add address=10.40.30.212 comment=shelly-s5_kueche_backofen mac-address=\
|
|
D8:85:AC:0C:5C:C8 server=dhcp-v30
|
|
add address=10.40.30.213 comment=shelly-s6_kueche_kuehlschrank mac-address=\
|
|
D0:CF:13:D8:18:FC server=dhcp-v30
|
|
add address=10.40.30.214 comment=shelly-s7_kueche_tiefkuehlschrank \
|
|
mac-address=D0:CF:13:D9:94:E8 server=dhcp-v30
|
|
add address=10.40.30.215 comment=shelly-s8_kueche_geschirrspueler \
|
|
mac-address=E4:B0:63:FA:FD:E0 server=dhcp-v30
|
|
add address=10.40.30.216 comment=shelly-s9_wohnzimmer_sideboard mac-address=\
|
|
E8:F6:0A:61:88:08 server=dhcp-v30
|
|
add address=10.40.30.217 comment=shelly-s10_bad_sonos mac-address=\
|
|
E4:B0:63:FC:57:E4 server=dhcp-v30
|
|
add address=10.40.30.218 comment=shelly-s11_kinderzimmer_sonos mac-address=\
|
|
E4:B0:63:FA:6C:00 server=dhcp-v30
|
|
add address=10.40.30.219 comment=shelly-s12_dieleug_steckdosen mac-address=\
|
|
48:F6:EE:C8:E6:AC server=dhcp-v30
|
|
add address=10.40.30.220 comment=shelly-s13_arbeitszimmer_technik \
|
|
mac-address=48:F6:EE:DD:6A:F4 server=dhcp-v30
|
|
add address=10.40.30.221 comment=shelly-s14_schlafzimmer_bett mac-address=\
|
|
E4:B0:63:FC:59:48 server=dhcp-v30
|
|
add address=10.40.30.222 comment=shelly-s15_technik_pve mac-address=\
|
|
E4:B0:63:FA:D5:34 server=dhcp-v30
|
|
add address=10.40.30.223 comment=shelly-s16_wohnzimmer_steckdosen \
|
|
mac-address=10:20:BA:FA:F5:40 server=dhcp-v30
|
|
add address=10.40.30.224 comment=shelly-s17_bad_steckdosen mac-address=\
|
|
10:20:BA:FB:6D:64 server=dhcp-v30
|
|
add address=10.40.30.225 comment=shelly-s18_kueche_steckdosen1 mac-address=\
|
|
48:F6:EE:CC:16:E4 server=dhcp-v30
|
|
add address=10.40.30.226 comment=shelly-s19_kueche_steckdosen3 mac-address=\
|
|
10:20:BA:FB:70:FC server=dhcp-v30
|
|
add address=10.40.30.227 comment=switchbot-floorlamp mac-address=\
|
|
B8:F8:62:09:F2:04 server=dhcp-v30
|
|
add address=10.40.30.228 comment=Twinkly_Weihnachtsgirlande mac-address=\
|
|
98:F4:AB:2C:A7:88 server=dhcp-v30
|
|
add address=10.40.30.230 comment=Withings_waage mac-address=00:24:E4:40:2A:72 \
|
|
server=dhcp-v30
|
|
add address=10.40.30.231 comment=Withings_blutdruck mac-address=\
|
|
A4:7E:FA:18:2C:64 server=dhcp-v30
|
|
add address=10.40.30.232 comment=pve-homematic-raspi-ccu mac-address=\
|
|
BC:24:11:8E:0A:57 server=dhcp-v30
|
|
add address=10.40.30.233 comment=shelly-s26_bad_luefter mac-address=\
|
|
98:A3:16:7A:A3:54 server=dhcp-v30
|
|
add address=10.40.30.236 comment=lichterkette mac-address=A4:F0:0F:5F:D0:EC \
|
|
server=dhcp-v30
|
|
add address=10.40.30.237 comment=lichterkette-mini mac-address=\
|
|
24:DC:C3:9B:89:64 server=dhcp-v30
|
|
add address=10.40.30.241 comment=NukiSmartlock mac-address=28:DB:A7:09:7B:54 \
|
|
server=dhcp-v30
|
|
add address=10.40.30.244 comment=NukiBridge mac-address=24:62:AB:B1:63:F4 \
|
|
server=dhcp-v30
|
|
add address=10.40.30.8 comment=DTUBI-414392337823 mac-address=\
|
|
54:F2:9F:12:51:F0 server=dhcp-v30
|
|
add address=10.40.20.10 comment=nas-bf mac-address=90:09:D0:58:20:F9 server=\
|
|
dhcp-v20
|
|
add address=10.40.40.11 comment=tv mac-address=70:AF:24:B8:C9:86 server=\
|
|
dhcp-v40
|
|
add address=10.40.30.5 comment=P750W mac-address=4C:EB:BD:E3:25:F2 server=\
|
|
dhcp-v30
|
|
add address=10.40.30.180 client-id=1:e4:bc:96:1f:b2:81 comment=Airfryer \
|
|
dhcp-option="dns 1.1.1.1" mac-address=E4:BC:96:1F:B2:81 server=dhcp-v30
|
|
add address=10.40.30.204 comment=shelly-s24_bad_spiegelschrank mac-address=\
|
|
14:33:5C:D8:2D:7C server=dhcp-v30
|
|
add address=10.40.30.150 client-id=1:fc:ee:11:3:32:26 comment=Ender3V3KE-3226 \
|
|
mac-address=FC:EE:11:03:32:26 server=dhcp-v30
|
|
/ip dhcp-server network
|
|
add address=10.40.10.0/24 comment=MAIN dns-server=10.40.10.1 gateway=\
|
|
10.40.10.1
|
|
add address=10.40.20.0/24 comment=INFRA dns-server=10.40.20.1 gateway=\
|
|
10.40.20.1
|
|
add address=10.40.30.0/24 comment=IOT dns-server=10.40.30.1 gateway=\
|
|
10.40.30.1
|
|
add address=10.40.40.0/24 comment=MEDIA dns-server=10.40.40.1 gateway=\
|
|
10.40.40.1
|
|
add address=10.40.41.0/24 comment=defconf dns-server=10.40.41.1 gateway=\
|
|
10.40.41.1 netmask=24
|
|
add address=10.40.50.0/24 comment=UNTRUSTED dns-server=10.40.50.1 gateway=\
|
|
10.40.50.1
|
|
add address=10.40.90.0/24 comment=GUEST dns-server=10.40.90.1 gateway=\
|
|
10.40.90.1
|
|
add address=10.40.99.0/24 comment=MGMT dhcp-option=omada-inform dns-server=\
|
|
10.40.99.1 gateway=10.40.99.1
|
|
/ip dns
|
|
set allow-remote-requests=yes mdns-repeat-ifaces=\
|
|
vlan10,vlan20,vlan40,vlan30,vlan90,bridge servers=1.1.1.1 use-doh-server=\
|
|
https://px35ynlol3.cloudflare-gateway.com/dns-query verify-doh-cert=yes
|
|
/ip dns static
|
|
add address=10.40.41.1 comment=defconf name=router.lan type=A
|
|
add address=10.40.41.2 comment=\
|
|
"TP4-transition; update to 10.40.99.2 after MGMT migration" name=\
|
|
ap2.bf.lan type=A
|
|
add address=10.40.41.11 comment="ALLNET core switch" name=sw1.bf.lan type=A
|
|
add address=10.40.41.12 comment="Omada access switch" name=sw2.bf.lan type=A
|
|
add address=10.40.20.167 comment=\
|
|
"Mac mini (INFRA VLAN20, migriert 2026-06-16)" name=macmini.bf.lan type=A
|
|
add address=10.40.20.100 comment="Proxmox hypervisor" name=pve.bf.lan type=A
|
|
add address=10.40.20.173 comment="pve-mcp SSE server" name=pve-mcp.bf.lan \
|
|
type=A
|
|
add address=10.40.20.10 comment=\
|
|
"DS923+ NAS (VLAN20, TP14.1, DNS-Sweep TP14.3 2026-07-16)" name=\
|
|
nas.bf.lan type=A
|
|
add address=10.40.20.126 comment=\
|
|
"Docker-LXC / Portainer (VLAN20, TP14.2, DNS-Sweep TP14.3 2026-07-16)" \
|
|
name=docker.bf.lan type=A
|
|
add address=10.40.99.1 comment=\
|
|
"TP19.1: ap1 MGMT = vlan99 GW (live since TP4), no separate move needed" \
|
|
name=ap1.bf.lan type=A
|
|
add address=10.40.20.20 comment=\
|
|
"TP20: Platform-Postgres LXC 105 on pve, PG16, nautobot DB" name=\
|
|
platform-pg.bf.lan type=A
|
|
/ip firewall filter
|
|
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
|
|
ipsec-policy=in,ipsec
|
|
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
|
|
ipsec-policy=out,ipsec
|
|
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
|
|
connection-state=established,related
|
|
add action=accept chain=forward comment=\
|
|
"defconf: accept established,related, untracked" connection-state=\
|
|
established,related,untracked
|
|
add action=drop chain=forward comment="defconf: drop invalid" \
|
|
connection-state=invalid
|
|
add action=drop chain=forward comment=\
|
|
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
|
|
in-interface-list=WAN
|
|
add action=accept chain=input comment=TP10-seal-est connection-state=\
|
|
established,related,untracked
|
|
add action=drop chain=input comment=TP10-seal-inv connection-state=invalid
|
|
add action=accept chain=input comment="TP10: WG hub listen (51821)" dst-port=\
|
|
51821 protocol=udp
|
|
add action=accept chain=forward comment="TP10: allow from WG spokes (FM/DW)" \
|
|
in-interface=wg-hub
|
|
add action=accept chain=forward comment="TP10: allow to WG spokes (FM/DW)" \
|
|
out-interface=wg-hub
|
|
add action=accept chain=input comment=TP10-seal-dhcp dst-port=68 \
|
|
in-interface-list=WAN protocol=udp
|
|
add action=accept chain=input comment=TP10-seal-icmp protocol=icmp
|
|
add action=accept chain=input comment=TP10-seal-lan in-interface-list=LAN
|
|
add action=drop chain=input comment=TP10-seal-wandrop in-interface-list=WAN
|
|
add action=accept chain=forward comment=\
|
|
"TP5: MAIN->MEDIA forward (AirPlay/Sonos)" in-interface=vlan10 \
|
|
out-interface=vlan40
|
|
add action=accept chain=forward comment=\
|
|
"TP5: MEDIA->MAIN forward (AirPlay/Sonos)" in-interface=vlan40 \
|
|
out-interface=vlan10
|
|
add action=accept chain=input comment=\
|
|
"TP5: mDNS 5353 input vlan10 (repeater)" dst-port=5353 in-interface=\
|
|
vlan10 protocol=udp
|
|
add action=accept chain=input comment=\
|
|
"TP5: mDNS 5353 input vlan40 (repeater)" dst-port=5353 in-interface=\
|
|
vlan40 protocol=udp
|
|
add action=accept chain=forward comment=\
|
|
"TP5: INFRA->MEDIA forward (HA<->Sonos)" in-interface=vlan20 \
|
|
out-interface=vlan40
|
|
add action=accept chain=forward comment=\
|
|
"TP5: MEDIA->INFRA forward (HA<->Sonos)" in-interface=vlan40 \
|
|
out-interface=vlan20
|
|
add action=accept chain=input comment=\
|
|
"TP5: mDNS 5353 input vlan20 (repeater/HA)" dst-port=5353 in-interface=\
|
|
vlan20 protocol=udp
|
|
add action=accept chain=input comment=\
|
|
"TP5: mDNS 5353 input vlan30 (repeater)" dst-port=5353 in-interface=\
|
|
vlan30 protocol=udp
|
|
add action=accept chain=input comment=\
|
|
"TP5: mDNS 5353 input vlan90 (repeater)" dst-port=5353 in-interface=\
|
|
vlan90 protocol=udp
|
|
add action=accept chain=forward comment=\
|
|
"TP5: GUEST->MEDIA forward (Sonos/Cast)" in-interface=vlan90 \
|
|
out-interface=vlan40
|
|
add action=accept chain=forward comment=\
|
|
"TP5: MEDIA->GUEST forward (Sonos/Cast)" in-interface=vlan40 \
|
|
out-interface=vlan90
|
|
/ip firewall nat
|
|
add action=masquerade chain=srcnat comment="defconf: masquerade" \
|
|
ipsec-policy=out,none out-interface-list=WAN
|
|
add action=accept chain=srcnat comment=\
|
|
"TP4: no-NAT inter-VLAN (LAN-internal, before masquerade)" dst-address=\
|
|
10.40.0.0/16
|
|
add action=masquerade chain=srcnat comment="TP4: masquerade VLANs toward FB" \
|
|
disabled=yes out-interface=bridge
|
|
add action=masquerade chain=srcnat comment=\
|
|
"TP4: masquerade VLANs via ether1 (Liwest WAN)" disabled=yes \
|
|
out-interface=ether1
|
|
/ip route
|
|
add comment="TP10: FM spoke -> wg-hub" dst-address=10.101.0.0/24 gateway=\
|
|
wg-hub
|
|
add comment="TP10: DW spoke (kuenftig) -> wg-hub" dst-address=10.95.10.0/24 \
|
|
gateway=wg-hub
|
|
/ipv6 firewall address-list
|
|
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
|
|
add address=::1/128 comment="defconf: lo" list=bad_ipv6
|
|
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
|
|
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
|
|
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
|
|
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
|
|
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
|
|
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
|
|
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
|
|
/ipv6 firewall filter
|
|
add action=accept chain=input comment=\
|
|
"defconf: accept established,related,untracked" connection-state=\
|
|
established,related,untracked
|
|
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
|
|
invalid
|
|
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
|
|
icmpv6
|
|
add action=accept chain=input comment="defconf: accept UDP traceroute" \
|
|
dst-port=33434-33534 protocol=udp
|
|
add action=accept chain=input comment=\
|
|
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
|
|
udp src-address=fe80::/10
|
|
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
|
|
protocol=udp
|
|
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
|
|
ipsec-ah
|
|
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
|
|
ipsec-esp
|
|
add action=accept chain=input comment=\
|
|
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
|
|
add action=drop chain=input comment=\
|
|
"defconf: drop everything else not coming from LAN" in-interface-list=\
|
|
!LAN
|
|
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \
|
|
connection-state=established,related
|
|
add action=accept chain=forward comment=\
|
|
"defconf: accept established,related,untracked" connection-state=\
|
|
established,related,untracked
|
|
add action=drop chain=forward comment="defconf: drop invalid" \
|
|
connection-state=invalid
|
|
add action=drop chain=forward comment=\
|
|
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
|
|
add action=drop chain=forward comment=\
|
|
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
|
|
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
|
|
hop-limit=equal:1 protocol=icmpv6
|
|
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
|
|
icmpv6
|
|
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
|
|
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
|
|
500,4500 protocol=udp
|
|
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
|
|
ipsec-ah
|
|
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
|
|
ipsec-esp
|
|
add action=accept chain=forward comment=\
|
|
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
|
|
add action=drop chain=forward comment=\
|
|
"defconf: drop everything else not coming from LAN" in-interface-list=\
|
|
!LAN
|
|
/system clock
|
|
set time-zone-name=Europe/Vienna
|
|
/system identity
|
|
set name=ap1
|
|
/system logging
|
|
add action=wantest topics=script
|