315 lines
16 KiB
Plaintext
315 lines
16 KiB
Plaintext
# 2025-09-05 02:45:12 by RouterOS 7.19.5
|
|
# software id = 4W04-URHT
|
|
#
|
|
# model = CRS326-24G-2S+
|
|
# serial number = HKA0AREXJFM
|
|
/interface bridge
|
|
set [find name=bridge] admin-mac=04:F4:1C:B4:17:76 auto-mac=no vlan-filtering=yes
|
|
/interface ethernet
|
|
set [ find default-name=sfp-sfpplus1 ] disabled=yes
|
|
set [ find default-name=sfp-sfpplus2 ] disabled=yes
|
|
/interface wireguard
|
|
add comment="TP10 Multi-Site VPN Hub (FM/DW spokes)" disabled=yes \
|
|
listen-port=51821 mtu=1412 name=wg-hub
|
|
/interface vlan
|
|
add comment=MAIN interface=bridge name=vlan10 vlan-id=10
|
|
add comment=INFRA interface=bridge name=vlan20 vlan-id=20
|
|
add comment=IOT interface=bridge name=vlan30 vlan-id=30
|
|
add comment=MEDIA interface=bridge name=vlan40 vlan-id=40
|
|
add comment=UNTRUSTED interface=bridge name=vlan50 vlan-id=50
|
|
add comment=GUEST interface=bridge name=vlan90 vlan-id=90
|
|
add interface=bridge name=vlan99 vlan-id=99
|
|
add comment=WAN interface=bridge name=vlan100 vlan-id=100
|
|
/interface list
|
|
add comment=TP15 name=WAN
|
|
add comment=TP15 name=LAN
|
|
/ip pool
|
|
add name=pool-v10 ranges=10.40.10.100-10.40.10.200
|
|
add name=pool-v20 ranges=10.40.20.100-10.40.20.200
|
|
add name=pool-v30 ranges=10.40.30.100-10.40.30.250
|
|
add name=pool-v40 ranges=10.40.40.100-10.40.40.200
|
|
add name=pool-v50 ranges=10.40.50.100-10.40.50.200
|
|
add name=pool-v90 ranges=10.40.90.100-10.40.90.200
|
|
add name=pool-v99 ranges=10.40.99.100-10.40.99.200
|
|
/ip dhcp-server
|
|
add address-pool=pool-v10 comment=MAIN disabled=yes interface=vlan10 \
|
|
lease-time=1d name=dhcp-v10
|
|
add address-pool=pool-v20 comment=INFRA disabled=yes interface=vlan20 \
|
|
lease-time=1d name=dhcp-v20
|
|
add address-pool=pool-v30 comment=IOT disabled=yes interface=vlan30 \
|
|
lease-time=1d name=dhcp-v30
|
|
add address-pool=pool-v40 comment=MEDIA disabled=yes interface=vlan40 \
|
|
lease-time=1d name=dhcp-v40
|
|
add address-pool=pool-v50 comment=UNTRUSTED disabled=yes interface=vlan50 \
|
|
lease-time=1d name=dhcp-v50
|
|
add address-pool=pool-v90 comment=GUEST disabled=yes interface=vlan90 \
|
|
lease-time=12h name=dhcp-v90
|
|
add address-pool=pool-v99 comment=MGMT disabled=yes interface=vlan99 \
|
|
lease-time=1d name=dhcp-v99
|
|
/port
|
|
set 0 name=serial0
|
|
/interface bridge port
|
|
set [find interface=ether2] pvid=40
|
|
set [find interface=ether3] pvid=40
|
|
set [find interface=ether5] pvid=40
|
|
/interface bridge vlan
|
|
add bridge=bridge untagged=ether1,ether2 vlan-ids=1
|
|
add bridge=bridge tagged=ether1,ether4,ether8 vlan-ids=10
|
|
add bridge=bridge tagged=ether1,ether4,ether8 vlan-ids=20
|
|
add bridge=bridge tagged=ether1,ether4,ether8 vlan-ids=30
|
|
add bridge=bridge tagged=ether1,ether4,ether8 untagged=ether2,ether3,ether5 \
|
|
vlan-ids=40
|
|
add bridge=bridge tagged=ether1,ether4,ether8 vlan-ids=50
|
|
add bridge=bridge tagged=ether1,ether4,ether8 vlan-ids=90
|
|
add bridge=bridge tagged=ether1,ether4,ether8 vlan-ids=99
|
|
add bridge=bridge tagged=ether1 untagged=ether16 vlan-ids=100
|
|
/interface list member
|
|
add interface=vlan100 list=WAN
|
|
add interface=vlan10 list=LAN
|
|
add interface=vlan20 list=LAN
|
|
add interface=vlan30 list=LAN
|
|
add interface=vlan40 list=LAN
|
|
add interface=vlan50 list=LAN
|
|
add interface=vlan90 list=LAN
|
|
add interface=vlan99 list=LAN
|
|
/interface wireguard peers
|
|
add allowed-address=10.101.0.0/24 endpoint-address=\
|
|
abxhutfgsid9snmy.myfritz.net endpoint-port=52476 interface=wg-hub name=fm \
|
|
public-key="dzRY0lnnUygijChWe5wXZmXPeNcbdALpqBptA3fyiVE="
|
|
add allowed-address=10.95.10.0/24 interface=wg-hub name=dw public-key=\
|
|
"FqYZLztQ/qME5VDie5QLGH++5299WJiE1dPpQnPbzUw="
|
|
/ip address
|
|
add address=10.40.41.211/24 comment=TP15-bringup-vlan1 interface=bridge \
|
|
network=10.40.41.0
|
|
add address=10.40.99.11/24 comment=TP15-mgmt-target interface=vlan99 network=\
|
|
10.40.99.0
|
|
add address=10.40.10.1/24 comment="L3 SVI VLAN10" disabled=yes interface=\
|
|
vlan10 network=10.40.10.0
|
|
add address=10.40.20.1/24 comment="L3 SVI VLAN20" disabled=yes interface=\
|
|
vlan20 network=10.40.20.0
|
|
add address=10.40.30.1/24 comment="L3 SVI VLAN30" disabled=yes interface=\
|
|
vlan30 network=10.40.30.0
|
|
add address=10.40.40.1/24 comment="L3 SVI VLAN40" disabled=yes interface=\
|
|
vlan40 network=10.40.40.0
|
|
add address=10.40.50.1/24 comment="L3 SVI VLAN50" disabled=yes interface=\
|
|
vlan50 network=10.40.50.0
|
|
add address=10.40.90.1/24 comment="L3 SVI VLAN90" disabled=yes interface=\
|
|
vlan90 network=10.40.90.0
|
|
add address=10.40.99.1/24 comment="Mgmt SVI (VLAN99)" disabled=yes interface=\
|
|
vlan99 network=10.40.99.0
|
|
/ip dhcp-client
|
|
add comment="TP15 WAN Liwest (Arris)" disabled=yes interface=vlan100 \
|
|
use-peer-dns=no
|
|
/ip dhcp-server lease
|
|
add address=10.40.10.196 client-id=1:f2:62:4c:e1:af:9 comment=iPhone \
|
|
disabled=yes mac-address=F2:62:4C:E1:AF:09 server=dhcp-v10
|
|
add address=10.40.20.10 comment=nas-bf disabled=yes mac-address=\
|
|
90:09:D0:58:20:F9 server=dhcp-v20
|
|
add address=10.40.30.150 client-id=1:fc:ee:11:3:32:26 comment=\
|
|
"ingenic-3226 / Ender3V3KE-3226" disabled=yes mac-address=\
|
|
FC:EE:11:03:32:26 server=dhcp-v30
|
|
add address=10.40.10.82 client-id=1:56:71:6c:22:e6:a9 comment=Mac disabled=\
|
|
yes mac-address=56:71:6C:22:E6:A9 server=dhcp-v10
|
|
add address=10.40.30.180 client-id=1:e4:bc:96:1f:b2:81 comment=\
|
|
"espressif / Airfryer" disabled=yes mac-address=E4:BC:96:1F:B2:81 server=\
|
|
dhcp-v30
|
|
add address=10.40.30.202 comment=shelly-s22_kueche_steckdose3-2 disabled=yes \
|
|
mac-address=A0:85:E3:C8:65:34 server=dhcp-v30
|
|
add address=10.40.30.203 comment=shelly-s23_dieleug-wohnzimmer_licht \
|
|
disabled=yes mac-address=AC:15:18:7B:62:20 server=dhcp-v30
|
|
add address=10.40.30.204 comment=shelly-s24_bad_spiegelschrank disabled=yes \
|
|
mac-address=14:33:5C:D8:2D:7C server=dhcp-v30
|
|
add address=10.40.30.205 comment=shelly-s25_bad_lichtschalter disabled=yes \
|
|
mac-address=98:A3:16:79:38:50 server=dhcp-v30
|
|
add address=10.40.30.206 comment=shelly-s20_kueche_steckdosen2 disabled=yes \
|
|
mac-address=98:A3:16:7C:5F:EC server=dhcp-v30
|
|
add address=10.40.30.207 comment=shelly-s21_kueche_steckdosen4 disabled=yes \
|
|
mac-address=20:6E:F1:01:F9:F8 server=dhcp-v30
|
|
add address=10.40.30.208 comment=shelly-s1_weihnachten_kueche disabled=yes \
|
|
mac-address=E4:B0:63:D7:C7:A4 server=dhcp-v30
|
|
add address=10.40.30.209 comment=shelly-s2_weihnachten_terrasse disabled=yes \
|
|
mac-address=28:37:2F:36:F4:7C server=dhcp-v30
|
|
add address=10.40.30.210 comment=shelly-s3_weihnachten_kinderzimmer disabled=\
|
|
yes mac-address=E4:B0:63:E4:EF:7C server=dhcp-v30
|
|
add address=10.40.30.211 comment=shelly-s4_kueche_mikrowelle disabled=yes \
|
|
mac-address=E4:B0:63:E4:0F:30 server=dhcp-v30
|
|
add address=10.40.30.212 comment=shelly-s5_kueche_backofen disabled=yes \
|
|
mac-address=D8:85:AC:0C:5C:C8 server=dhcp-v30
|
|
add address=10.40.30.213 comment=shelly-s6_kueche_kuehlschrank disabled=yes \
|
|
mac-address=D0:CF:13:D8:18:FC server=dhcp-v30
|
|
add address=10.40.30.214 comment=shelly-s7_kueche_tiefkuehlschrank disabled=\
|
|
yes mac-address=D0:CF:13:D9:94:E8 server=dhcp-v30
|
|
add address=10.40.30.215 comment=shelly-s8_kueche_geschirrspueler disabled=\
|
|
yes mac-address=E4:B0:63:FA:FD:E0 server=dhcp-v30
|
|
add address=10.40.30.216 comment=shelly-s9_wohnzimmer_sideboard disabled=yes \
|
|
mac-address=E8:F6:0A:61:88:08 server=dhcp-v30
|
|
add address=10.40.30.217 comment=shelly-s10_bad_sonos disabled=yes \
|
|
mac-address=E4:B0:63:FC:57:E4 server=dhcp-v30
|
|
add address=10.40.30.218 comment=shelly-s11_kinderzimmer_sonos disabled=yes \
|
|
mac-address=E4:B0:63:FA:6C:00 server=dhcp-v30
|
|
add address=10.40.30.219 comment=shelly-s12_dieleug_steckdosen disabled=yes \
|
|
mac-address=48:F6:EE:C8:E6:AC server=dhcp-v30
|
|
add address=10.40.30.220 comment=shelly-s13_arbeitszimmer_technik disabled=\
|
|
yes mac-address=48:F6:EE:DD:6A:F4 server=dhcp-v30
|
|
add address=10.40.30.221 comment=shelly-s14_schlafzimmer_bett disabled=yes \
|
|
mac-address=E4:B0:63:FC:59:48 server=dhcp-v30
|
|
add address=10.40.30.222 comment=shelly-s15_technik_pve disabled=yes \
|
|
mac-address=E4:B0:63:FA:D5:34 server=dhcp-v30
|
|
add address=10.40.30.223 comment=shelly-s16_wohnzimmer_steckdosen disabled=\
|
|
yes mac-address=10:20:BA:FA:F5:40 server=dhcp-v30
|
|
add address=10.40.30.224 comment=shelly-s17_bad_steckdosen disabled=yes \
|
|
mac-address=10:20:BA:FB:6D:64 server=dhcp-v30
|
|
add address=10.40.30.225 comment=shelly-s18_kueche_steckdosen1 disabled=yes \
|
|
mac-address=48:F6:EE:CC:16:E4 server=dhcp-v30
|
|
add address=10.40.30.226 comment=shelly-s19_kueche_steckdosen3 disabled=yes \
|
|
mac-address=10:20:BA:FB:70:FC server=dhcp-v30
|
|
add address=10.40.30.227 comment="SwitchBot-floor-lamp / switchbot-floorlamp" \
|
|
disabled=yes mac-address=B8:F8:62:09:F2:04 server=dhcp-v30
|
|
add address=10.40.30.228 comment=\
|
|
"Twinkly-2CA789 / Twinkly_Weihnachtsgirlande" disabled=yes mac-address=\
|
|
98:F4:AB:2C:A7:88 server=dhcp-v30
|
|
add address=10.40.30.230 comment=Withings_waage disabled=yes mac-address=\
|
|
00:24:E4:40:2A:72 server=dhcp-v30
|
|
add address=10.40.30.231 comment=Withings_blutdruck disabled=yes mac-address=\
|
|
A4:7E:FA:18:2C:64 server=dhcp-v30
|
|
add address=10.40.30.232 comment=pve-homematic-raspi-ccu disabled=yes \
|
|
mac-address=BC:24:11:8E:0A:57 server=dhcp-v30
|
|
add address=10.40.30.233 comment=shelly-s26_bad_luefter disabled=yes \
|
|
mac-address=98:A3:16:7A:A3:54 server=dhcp-v30
|
|
add address=10.40.30.236 comment=lichterkette disabled=yes mac-address=\
|
|
A4:F0:0F:5F:D0:EC server=dhcp-v30
|
|
add address=10.40.30.237 comment=lichterkette-mini disabled=yes mac-address=\
|
|
24:DC:C3:9B:89:64 server=dhcp-v30
|
|
add address=10.40.30.241 comment=NukiSmartlock disabled=yes mac-address=\
|
|
28:DB:A7:09:7B:54 server=dhcp-v30
|
|
add address=10.40.30.244 comment=NukiBridge disabled=yes mac-address=\
|
|
24:62:AB:B1:63:F4 server=dhcp-v30
|
|
add address=10.40.30.5 comment="P750W / P750W" disabled=yes mac-address=\
|
|
4C:EB:BD:E3:25:F2 server=dhcp-v30
|
|
add address=10.40.30.8 comment="DTUBI-414392337823 / DTUBI-414392337823" \
|
|
disabled=yes mac-address=54:F2:9F:12:51:F0 server=dhcp-v30
|
|
add address=10.40.40.11 comment=tv disabled=yes mac-address=70:AF:24:B8:C9:86 \
|
|
server=dhcp-v40
|
|
add address=10.40.40.191 client-id=1:34:7e:5c:32:37:96 comment=SonosZP \
|
|
disabled=yes mac-address=34:7E:5C:32:37:96 server=dhcp-v40
|
|
add address=10.40.40.192 client-id=1:34:7e:5c:32:33:b8 comment=SonosZP \
|
|
disabled=yes mac-address=34:7E:5C:32:33:B8 server=dhcp-v40
|
|
add address=10.40.40.193 client-id=1:78:28:ca:80:2a:f6 comment=SonosZP \
|
|
disabled=yes mac-address=78:28:CA:80:2A:F6 server=dhcp-v40
|
|
add address=10.40.40.194 client-id=1:48:a6:b8:14:fe:d0 comment=SonosZP \
|
|
disabled=yes mac-address=48:A6:B8:14:FE:D0 server=dhcp-v40
|
|
add address=10.40.40.195 client-id=1:78:28:ca:82:16:c2 comment=SonosZP \
|
|
disabled=yes mac-address=78:28:CA:82:16:C2 server=dhcp-v40
|
|
add address=10.40.40.196 client-id=1:48:a6:b8:16:38:ae comment=SonosZP \
|
|
disabled=yes mac-address=48:A6:B8:16:38:AE server=dhcp-v40
|
|
add address=10.40.40.197 client-id=1:48:a6:b8:14:fe:f2 comment=SonosZP \
|
|
disabled=yes mac-address=48:A6:B8:14:FE:F2 server=dhcp-v40
|
|
add address=10.40.40.198 comment="SonosZP / SonosTerrasse" disabled=yes \
|
|
mac-address=78:28:CA:D2:0D:AC server=dhcp-v40
|
|
add address=10.40.40.199 client-id=1:48:a6:b8:b:63:10 comment=SonosZP \
|
|
disabled=yes mac-address=48:A6:B8:0B:63:10 server=dhcp-v40
|
|
add address=10.40.40.200 client-id=1:48:a6:b8:69:69:7b comment=SonosZP \
|
|
disabled=yes mac-address=48:A6:B8:69:69:7B server=dhcp-v40
|
|
add address=10.40.40.201 client-id=1:94:9f:3e:49:59:ee comment=SonosZP \
|
|
disabled=yes mac-address=94:9F:3E:49:59:EE server=dhcp-v40
|
|
/ip dhcp-server network
|
|
add address=10.40.10.0/24 dns-server=10.40.10.1 domain=bf.lan gateway=\
|
|
10.40.10.1
|
|
add address=10.40.20.0/24 dns-server=10.40.20.1 domain=bf.lan gateway=\
|
|
10.40.20.1
|
|
add address=10.40.30.0/24 dns-server=10.40.30.1 domain=bf.lan gateway=\
|
|
10.40.30.1
|
|
add address=10.40.40.0/24 dns-server=10.40.40.1 domain=bf.lan gateway=\
|
|
10.40.40.1
|
|
add address=10.40.50.0/24 dns-server=10.40.50.1 domain=bf.lan gateway=\
|
|
10.40.50.1
|
|
add address=10.40.90.0/24 dns-server=10.40.90.1 domain=bf.lan gateway=\
|
|
10.40.90.1
|
|
add address=10.40.99.0/24 dns-server=10.40.99.1 domain=bf.lan gateway=\
|
|
10.40.99.1
|
|
/ip dns
|
|
set allow-remote-requests=yes mdns-repeat-ifaces=\
|
|
vlan10,vlan20,vlan40,vlan30,vlan90 servers=1.1.1.1 use-doh-server=\
|
|
https://px35ynlol3.cloudflare-gateway.com/dns-query verify-doh-cert=yes
|
|
/ip dns static
|
|
add address=10.40.99.1 comment="core = GW/Router" name=router.lan type=A
|
|
add address=10.40.99.3 comment="ap1 = reiner AP" name=ap1.bf.lan type=A
|
|
add address=10.40.99.2 comment="ap2 = reiner AP" name=ap2.bf.lan type=A
|
|
add address=10.40.99.1 comment="crs326-core (L3)" name=core.bf.lan type=A
|
|
add address=10.40.99.12 comment=crs326-branch name=branch.bf.lan type=A
|
|
add address=10.40.20.167 name=macmini.bf.lan type=A
|
|
add address=10.40.20.100 name=pve.bf.lan type=A
|
|
add address=10.40.20.173 name=pve-mcp.bf.lan type=A
|
|
add address=10.40.20.10 name=nas.bf.lan type=A
|
|
add address=10.40.20.126 name=docker.bf.lan type=A
|
|
add address=10.40.20.20 name=platform-pg.bf.lan type=A
|
|
/ip firewall filter
|
|
add action=accept chain=forward comment="defconf: accept est,rel,untracked" \
|
|
connection-state=established,related,untracked
|
|
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
|
|
connection-state=established,related hw-offload=yes
|
|
add action=drop chain=forward comment="defconf: drop invalid" \
|
|
connection-state=invalid
|
|
add action=drop chain=forward comment="defconf: drop WAN !dstnat" \
|
|
connection-nat-state=!dstnat in-interface-list=WAN
|
|
add action=accept chain=forward comment="TP10: allow from WG spokes (FM/DW)" \
|
|
in-interface=wg-hub
|
|
add action=accept chain=forward comment="TP10: allow to WG spokes (FM/DW)" \
|
|
out-interface=wg-hub
|
|
add action=accept chain=forward comment="TP5: MAIN->MEDIA" in-interface=\
|
|
vlan10 out-interface=vlan40
|
|
add action=accept chain=forward comment="TP5: MEDIA->MAIN" in-interface=\
|
|
vlan40 out-interface=vlan10
|
|
add action=accept chain=forward comment="TP5: INFRA->MEDIA" in-interface=\
|
|
vlan20 out-interface=vlan40
|
|
add action=accept chain=forward comment="TP5: MEDIA->INFRA" in-interface=\
|
|
vlan40 out-interface=vlan20
|
|
add action=accept chain=forward comment="TP5: GUEST->MEDIA" in-interface=\
|
|
vlan90 out-interface=vlan40
|
|
add action=accept chain=forward comment="TP5: MEDIA->GUEST" in-interface=\
|
|
vlan40 out-interface=vlan90
|
|
add action=accept chain=input comment=TP10-seal-est connection-state=\
|
|
established,related,untracked
|
|
add action=drop chain=input comment=TP10-seal-inv connection-state=invalid
|
|
add action=accept chain=input comment="TP10: WG hub listen" dst-port=51821 \
|
|
protocol=udp
|
|
add action=accept chain=input comment=TP10-seal-dhcp dst-port=68 \
|
|
in-interface-list=WAN protocol=udp
|
|
add action=accept chain=input comment=TP10-seal-icmp protocol=icmp
|
|
add action=accept chain=input comment=TP10-seal-lan in-interface-list=LAN
|
|
add action=drop chain=input comment=TP10-seal-wandrop in-interface-list=WAN
|
|
add action=accept chain=input comment="TP5: mDNS in vlan10" dst-port=5353 \
|
|
in-interface=vlan10 protocol=udp
|
|
add action=accept chain=input comment="TP5: mDNS in vlan40" dst-port=5353 \
|
|
in-interface=vlan40 protocol=udp
|
|
add action=accept chain=input comment="TP5: mDNS in vlan20" dst-port=5353 \
|
|
in-interface=vlan20 protocol=udp
|
|
add action=accept chain=input comment="TP5: mDNS in vlan30" dst-port=5353 \
|
|
in-interface=vlan30 protocol=udp
|
|
add action=accept chain=input comment="TP5: mDNS in vlan90" dst-port=5353 \
|
|
in-interface=vlan90 protocol=udp
|
|
/ip firewall nat
|
|
add action=accept chain=srcnat comment=\
|
|
"TP4: no-NAT inter-VLAN (vor masquerade)" dst-address=10.40.0.0/16
|
|
add action=masquerade chain=srcnat comment="defconf: masquerade WAN" \
|
|
out-interface-list=WAN
|
|
/ip hotspot profile
|
|
set [ find default=yes ] html-directory=hotspot
|
|
/ip route
|
|
add comment=TP15-bringup dst-address=0.0.0.0/0 gateway=10.40.41.1
|
|
add comment="TP10: FM spoke -> wg-hub" dst-address=10.101.0.0/24 gateway=\
|
|
wg-hub
|
|
add comment="TP10: DW spoke -> wg-hub" dst-address=10.95.10.0/24 gateway=\
|
|
wg-hub
|
|
/ip service
|
|
set ftp disabled=yes
|
|
set ssh address=10.40.0.0/16
|
|
set telnet disabled=yes
|
|
set www address=10.40.0.0/16
|
|
set api address=10.40.0.0/16
|
|
set api-ssl disabled=yes
|
|
/system identity
|
|
set name=crs326-core
|
|
/system routerboard settings
|
|
set enter-setup-on=delete-key
|