# ====== Initial Mikrotik configuration template ====== # By Gautier HUSSON - HUSSON CONSULTING SAS - Liberasys (Britany, FRANCE) # contact_web@liberasys.com - www.liberasys.com # Revision : 0.4 / 20180316 # Status : not much tested, please prepare your serial console or USB/WIFI dongle ! #TODO : change admin name, not working anymore #TODO : debug 2048bits certificate generation, not working anymore #TODO : ethernet : configure loop protection (check if bug correction is OK) #TODO : check vlan names between differents arrays #TODO : verify we have at last one port associated to admin vlan #TODO : firewall : implement DNS resolution in access-lists #TODO : firewall : optimisation for : established/related sooner, add some connection state = new #TODO : firewall : add a generic function that create rules for brute force mitigation over TCP and input a list of ports (ex : 3389) #TODO : Certificates : generates new ones only if olders are bad #TODO : check functionnalModeConfig // switch mode and VLAN unaware chip #TODO : bridges : add DHCP server/client configuration an apply it #TODO : look at HTTPs protection, maybe disallow it from all # Disclaimer of Warranty. # THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY # APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT # HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY # OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR # PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM # IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF # ALL NECESSARY SERVICING, REPAIR OR CORRECTION. # Limitation of Liability. # IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING # WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS # THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY # GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE # USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF # DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD # PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), # EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF # SUCH DAMAGES. # ====================================================================== # TIPS with scripts (or /import for syntax check) - thanks to Martin S. from Mikrotik :-) : # ====================================================================== # Create and edit system script with CLI : # Remark : you can otherwise import them from file. # /system script remove staging # /system script add name=staging # /system script edit staging source # paste your script # Ctrl+o # Review your syntax : # /system script edit staging source # other solution : # /system script print where name=staging # Run your script : # /system script run staging # ====================================================================== # = Advices # ====================================================================== # 1) change parameters here under in "Input variables" paragraph # 2) either : # - start from blank configuration (use serial terminal): # /system reset-configuration no-defaults=yes # with serial line, pass lines with copy/paste # do it by paragraphs or serial line will give errors - buffer ov maybe # (sudo screen /dev/ttyUSB0 115200) # - upload the file (.rsc) on your mikrotik # CLI : /system reset-configuration no-defaults=yes run-after-reset= # - apply with /import or script run, at your risk (can cut legs !) :put "" :put "========================================================================" :put "=== Setting environment global variables" :put "========================================================================" # Remark : everywhere there is an IP, you can put nothing ("") and the configurations using # the IP will be bypassed. Everywhere but authorizedAdminNetwork ! :-) # functionnalModeConfig defines the mode of configuration # 3 possible values : # - "switch" : the adminVlanNameConfig only will have an IP, and no routing will be configured # - "router" : all the VLANs will be forwarded and the OS will do routing # - "firewall" : all the VLANs will be forwarded and the routing will be firewalled :global functionnalModeConfig "firewall" # /!\ !!! CHANGE ME !!!! /!\ : :global adminUserName "miktikadm" :global adminPassword "miktikadm31337" # /!\ !!! CHANGE ME !!!! /!\ : # vlan names definition (will be used in bridge names and vlan interfaces too) :global vlanNamesConfig { "admin-admin"="1"; "admin-capsman"="10"; "pro-dmz"="20"; "pro-voip"="30"; "pro-vidsurv"="40"; "pro-lan"="50"; "pro-wifi"="55"; "pro-vpn-site"="60"; "pro-vpn-user-managed"="65"; "fournisseurs-dmz"="150"; "pro-invite"="170"; "guest-wifi"="190"; "pro-vpn-user-unmanaged"="210"; "fai1"="230"; } :global adminVlanNameConfig "admin-admin" :global internetVlanNameConfig "fai1" # Ips on bridges : :global bridgesIps { "admin-admin"="10.1.1.254/24"; "pro-lan"="192.168.1.1/24"; "pro-vpn-user-managed"="10.1.65.254/24"; "pro-vpn-user-unmanaged"="10.1.210.254/24"; "fai1"="10.1.230.253/24" } # vlan definition per interface # special data structure in order do describe wanted configuration # for vlans array, the special value "all" is replaced by each vlan :global vlansConfig { ether1={mode="untagged"; vlans={"pro-lan";};}; ether2={mode="untagged"; vlans={"pro-lan";};}; ether3={mode="untagged"; vlans={"pro-lan";};}; ether4={mode="untagged"; vlans={"admin-admin";};}; ether5={mode="untagged"; vlans={"fai1";};}; # ether6={mode="untagged"; vlans={"pro-lan";};}; # ether7={mode="untagged"; vlans={"pro-lan";};}; # ether8={mode="untagged"; vlans={"pro-lan";};}; # ether9={mode="untagged"; vlans={"pro-lan";};}; # ether10={mode="untagged"; vlans={"pro-lan";};}; # ether11={mode="untagged"; vlans={"pro-lan";};}; # ether12={mode="untagged"; vlans={"pro-lan";};}; # ether13={mode="untagged"; vlans={"pro-lan";};}; # ether14={mode="untagged"; vlans={"pro-lan";};}; # ether15={mode="untagged"; vlans={"pro-lan";};}; # ether16={mode="untagged"; vlans={"pro-lan";};}; # ether17={mode="untagged"; vlans={"pro-lan";};}; # ether18={mode="untagged"; vlans={"pro-lan";};}; # ether19={mode="untagged"; vlans={"pro-lan";};}; # ether20={mode="untagged"; vlans={"pro-lan";};}; # ether21={mode="trunk"; vlans={"pro-lan"; "fai1"};}; # ether22={mode="tagged";vlans={"fai1"};}; # ether23={mode="untagged"; vlans={"fai1";};}; # ether24={mode="trunk"; vlans={"all";};}; sfp1={mode="trunk"; vlans={"all";};}; # sfp2={mode="trunk"; vlans={"all";};}; # sfp3={mode="trunk"; vlans={"all";};}; # sfp4={mode="trunk"; vlans={"all";};}; # sfp9={mode="trunk"; vlans={"all";};}; # sfp10={mode="trunk"; vlans={"all";};}; # sfp11={mode="trunk"; vlans={"all";};}; # sfp12={mode="trunk"; vlans={"all";};}; } :global localFqdn "test-staging.liberasys.com"; :global timeZone "Europe/Paris" :global authorizedAdminNetwork "10.1.1.0/24" :global defaultGw "10.1.230.254" :global dnsServers "10.1.230.254,8.8.8.8" :global ntpServerIp1 "37.187.56.220" :global ntpServerIp2 "5.135.3.88" :global ntpServersFqdns "0.fr.pool.ntp.org,1.fr.pool.ntp.org,2.fr.pool.ntp.org,3.fr.pool.ntp.org" :global syslogServerIp "10.1.1.200" :global sshPortMikrotik "42022" :global httpsPortMikrotik "42443" :global sstpPortMikrotik "42444" # verboseConfig : "yes" or "no" :global verboseConfig "yes" # DON'T TOUCH THOSE VARIABLES : :global configurationOk "true" # ====================================================================== # = Copyright and SOS beeps # ====================================================================== # Initial delay, if system is booting, it is mandatory #:delay 20s; :put "====== Initial Mikrotik configuration template ======" :put "By Gautier HUSSON - HUSSON CONSULTING SAS - Liberasys" :put "License : CC BY 4.0" :put " https://creativecommons.org/licenses/by/4.0/" :put "" :put "WARNING WARNING WARNING WARNING WARNING WARNING" :put "WARNING WARNING WARNING WARNING WARNING WARNING" :put "WARNING WARNING WARNING WARNING WARNING WARNING" :put "" :put "You will loose almost all your configuration." :put "You have 5 seconds to quit (Ctrl + C)." :put "" :delay 0.2s :beep length=0.1s :delay 0.2s :beep length=0.1s :delay 0.2s :beep length=0.1s :delay 0.5s :beep length=0.3s :delay 0.5s :beep length=0.3s :delay 0.5s :beep length=0.3s :delay 0.5s :beep length=0.1s :delay 0.2s :beep length=0.1s :delay 0.2s :beep length=0.1s :delay 0.5s :put "" :put "========================================================================" :put "=== Defining internal functions" :put "========================================================================" # keyInSimpleArray: returns true or false # arg1: key name # arg2: array (without values attached to keys) # use example: :put [$keyInArray "plop" $localEthernetInterfaces] :global keyInSimpleArray do={ :local arraySize [:len $2] :if ( $arraySize = 0) do={ :return "false"; }; :foreach key in=$2 do={ :if ($1 = $key) do={ :return "true"; }; } :return "false"; } # keyInArray: returns true or false # arg1: key name # arg2: array (with values attached to keys) # use example: :put [$keyInArray "plop" $localEthernetInterfaces] :global keyInArray do={ :local arraySize [:len $2] :if ( $arraySize = 0) do={ :return "false"; }; :foreach key,value in=$2 do={ :if ($1 = $key) do={ :return "true"; }; } :return "false"; } :put "" :put "========================================================================" :put "=== Generating some variables" :put "========================================================================" # Compute administration IP :global administrationIp :set administrationIp :global administrationIp :set administrationIp [:pick ($bridgesIps->$adminVlanNameConfig) 0 [:find ($bridgesIps->$adminVlanNameConfig) "/"]] # Compute Internet bridge name :global internetBridgeNameConfig :set internetBridgeNameConfig :global internetBridgeNameConfig :set internetBridgeNameConfig ("br-".$internetVlanNameConfig."-v".($vlanNamesConfig->$internetVlanNameConfig)) # Compute Admin bridge name :global adminBridgeNameConfig :set adminBridgeNameConfig :global adminBridgeNameConfig :set adminBridgeNameConfig ("br-".$adminVlanNameConfig."-v".($vlanNamesConfig->$adminVlanNameConfig)) # Compute hostname :global localHostname; :set localHostname; :global localHostname; :set localHostname [:pick ($localFqdn) 0 [:find ($localFqdn) "."]]; # Replace vlan "all" by each vlan in vlansConfig :global vlanNameArray :set vlanNameArray :global vlanNameArray :foreach vlanName,vlanId in=$vlanNamesConfig do={ :set vlanNameArray ($vlanNameArray, $vlanName) } :foreach iface,conf in=$vlansConfig do={ :foreach vlan in=($conf->"vlans") do={ :if (vlan = "all") do={ :set ($vlansConfig->$iface->"vlans") $vlanNameArray } } } # Create table of all ethernet interfaces :global localEthernetInterfaces :set localEthernetInterfaces :global localEthernetInterfaces :foreach ifaceIndex in=[/interface find where type="ether"] do={ #:put [/interface ethernet get value-name=default-name number=$ifaceIndex] :set localEthernetInterfaces ($localEthernetInterfaces, [/interface ethernet get value-name=default-name number=$ifaceIndex]) } #:put [:tostr $localEthernetInterfaces] #:environment print # Create array for EGRESS ports TO TAG : vlan -> interfaces list :global egressPortsToTagArray :set egressPortsToTagArray :global egressPortsToTagArray ([:toarray ""]) :foreach iface,conf in=$vlansConfig do={ :if ($conf->"mode" = "tagged" or $conf->"mode" = "trunk") do={ :foreach vlan in=($conf->"vlans") do={ #:put ($iface.":".($conf->"mode")." : ".$vlan) :set ($egressPortsToTagArray->($vlanNamesConfig->$vlan)) (($egressPortsToTagArray->($vlanNamesConfig->$vlan)).$iface.",") } } } # translate sub arrays in form of values to arrays :foreach vlanId,ifaces in=$egressPortsToTagArray do={ :set ($egressPortsToTagArray->$vlanId) ([:toarray ($egressPortsToTagArray->$vlanId)]) } # Create array for INGRESS ports TO TAG : vlan -> interfaces list (same begin as egressPortsToTagArray, with only untagged ports) :global ingressPortsToTagArray; :set $ingressPortsToTagArray; :global ingressPortsToTagArray ([:toarray ""]); :foreach iface,conf in=$vlansConfig do={ :if ($conf->"mode" = "untagged") do={ :foreach vlan in=($conf->"vlans") do={ :set ($ingressPortsToTagArray->($vlanNamesConfig->$vlan)) (($ingressPortsToTagArray->($vlanNamesConfig->$vlan)).$iface.",") } } } # translate sub arrays in form of values to arrays :foreach vlanId,ifaces in=$ingressPortsToTagArray do={ :set ($ingressPortsToTagArray->$vlanId) ([:toarray ($ingressPortsToTagArray->$vlanId)]) } :put "" :put "========================================================================" :put "=== Checking input variables" :put "========================================================================" # Print the VLANS definitions :if ($verboseConfig = "yes") do={ :put "=== vlansConfig :" :foreach key,value in=$vlansConfig do={ :put ($key." (".([:tostr ($value->"mode")]).")") :foreach key2 in=($value->"vlans") do={ :put (" ".([:tostr ($key2)])) } } } # Print the interfaces per vlan table :if ($verboseConfig = "yes") do={ :put "=== egressPortsToTagArray :" :foreach vlanId,ifaces in=$egressPortsToTagArray do={ :put ("Vlan : ".$vlanId) :foreach iface in=$ifaces do={ :put (" ".$iface) } } } # Check that the authorizedAdminNetwork IP is filled :if ($configurationOk = "true") do={ :if ([:len $authorizedAdminNetwork] < 7) do={ :put ("!!!!!!!! Invalid IP for $authorizedAdminNetwork, your equipment will be unmanageable") :beep frequency=220 length=2s :set configurationOk "false" } } # Check bridges IPs : there should be at last one IP in the administration VLAN :if ($configurationOk = "true") do={ :if ([:len ($bridgesIps->$adminVlanNameConfig)] < 1) do={ :put ("!!!!!!!! No IP configured on admin bridge, your equipment will be unmanageable") :beep frequency=220 length=2s :set configurationOk "false" } } # Check bridges IPs : in switch mode, only the admin bridge should have an IP :if ($configurationOk = "true") do={ :if ($functionnalModeConfig = "switch") do={ :if ([:len $bridgesIps] != 1) do={ :put ("!!!!!!!! Too many IPs configured on bridges") :beep frequency=220 length=2s :set configurationOk "false" } } } # Check vlansConfig array : interface names :if ($configurationOk = "true") do={ :foreach key,value in=$vlansConfig do={ :if (!([$keyInSimpleArray $key $localEthernetInterfaces] = "true")) do={ :put ("!!!!!!!! Invalid interface found: ".$key) :beep frequency=220 length=2s :set configurationOk "false" } } } # Check vlansConfig array : mode :if ($configurationOk = "true") do={ :foreach key,value in=$vlansConfig do={ :if ($value->"mode" != "untagged" and $value->"mode" != "tagged" and $value->"mode" != "trunk") do={ :put ("!!!!!!!! Invalid mode found: \"".$value->"mode"."\" for \"".$key."\" interface") :beep frequency=220 length=2s :set configurationOk "false" } } } # Check vlansConfig array : vlans number :if ($configurationOk = "true") do={ :foreach key,value in=$vlansConfig do={ :local vlanNumber ([:len ($value->"vlans")]) #:put ("vlan number for ".$key." : ".$vlanNumber) :if ($value->"mode" = "untagged" or $value->"mode" = "tagged") do={ :if ([:len ($value->"vlans")] != 1) do={ :put ("!!!!!!!! Invalid vlan numbers found for ".$key." (".$vlanNumber." vlans for ".($value->"mode")." mode : ".[:tostr ($value->"vlans")]." )") :beep frequency=220 length=2s :set configurationOk "false" } } :if ($value->"mode" = "trunk") do={ :if ([:len ($value->"vlans")] < 1) do={ :put ("!!!!!!!! Invalid vlan numbers found for ".$key." (".$vlanNumber." vlans for ".($value->"mode")." mode )") :beep frequency=220 length=2s :set configurationOk "false" } } } } # Check vlansConfig array : vlans names :if ($configurationOk = "true") do={ :foreach key,value in=$vlansConfig do={ :foreach key2 in=($value->"vlans") do={ #:put ($key." ".$key2) :if (!([$keyInArray $key2 $vlanNamesConfig] = "true")) do={ :put ("!!!!!!!! Invalid vlan name found : ".$key2." for ".$key) :beep frequency=220 length=2s :set configurationOk "false" } } } } # Check functionnalModeConfig value :if ($configurationOk = "true") do={ :if ($functionnalModeConfig != "switch" and $functionnalModeConfig != "router" and $functionnalModeConfig != "firewall") do={ :put ("!!!!!!!! Invalid functionnal name found : ".$functionnalModeConfig.". Possible values : switch, service, firewall") :beep frequency=220 length=2s :set configurationOk "false" } } # Get out if configuration is bad :if ($configurationOk = "false") do={ :return "Bad configuration detected, abording !" } :put "" :put "========================================================================" :put "=== Removing existing conflictual configuration - for idempotency" :put "========================================================================" # Remove certificates :foreach certificate in=[/certificate find] do={ :do { /certificate remove $certificate } on-error={} } # Remove firewall rules, address-lists and NATs :foreach rule in=[/ip firewall filter find where !dynamic] do={ :do { /ip firewall filter remove $rule } on-error={} } :foreach addressList in=[/ip firewall address-list find where !dynamic] do={ :do { /ip firewall address-list remove $addressList } on-error={} } :foreach natRule in=[/ip firewall nat find where !dynamic] do={ :do { /ip firewall nat remove $natRule } on-error={} } # Bridges and vlan interfaces :foreach port in=[/interface bridge port find] do={ :do { /interface bridge port remove $port } on-error={} } :foreach vlanIface in=[/interface vlan find] do={ :do { /interface vlan remove $vlanIface } on-error={} } :foreach bridge in=[/interface bridge find] do={ :do { /interface bridge remove $bridge } on-error={} } # Reset interfaces names :do { :foreach iface in=[/interface ethernet find] do={ :do { /interface ethernet set $iface name=[get $iface default-name] } on-error={} } } # Remove interfaces IPs :foreach ipAddress in=[/ip address find where !dynamic] do={ :do { /ip address remove $ipAddress } on-error={} } # Remove routes :foreach route in=[/ip route find where !dynamic] do={ :do { /ip route remove $route } on-error={} } # Remove system logging and syslog :do { /system logging remove [/system logging find where action="remoteSyslog" and topics="!debug,!packet"] } on-error={} :do { /system logging remove [/system logging find where action="remoteSyslog" and topics="dhcp"] } on-error={} :do { /system logging remove [/system logging find where action="remoteSyslog" and topics="account"] } on-error={} :do { /system logging remove [/system logging find where prefix="debug" and topics="wireless"] } on-error={} :do { /system logging remove [/system logging find where prefix="debug" and topics="manager"] } on-error={} :do { /system logging remove [/system logging find where topics="account"] } on-error={} :do { /system logging action remove [/system logging action find where name="remoteSyslog" and target="remote"] } on-error={} # Remove DNS entries :foreach dnsEntry in=[/ip dns static find where !dynamic] do={ :do { /ip dns static remove $dnsEntry } on-error={} } :put "" :put "======================================================================" :put " = Doing basic staging and system services configuration" :put "======================================================================" # Wait for interfaces to be up { :local count 0; :while ([/interface ethernet find] = "") do={ :if ($count = 30) do={ :put "Waiting for interfaces to be up..." :log warning "DefConf: Unable to find ethernet interfaces"; /quit; } :delay 1s; :set count ($count +1); }; } :do { /port set 0 name=serial0 } on-error={} /system routerboard settings set boot-device=flash-boot protected-routerboot=disabled /system identity set name=$localFqdn /user add name=$"adminUserName" group=full password="$adminPassword" disabled=no /user remove admin :if ([:len $dnsServers] > 0) do={ /ip dns set allow-remote-requests=yes servers="$dnsServers" cache-max-ttl=1d } /ip dns static add address=$administrationIp name="$localHostname" add address=$administrationIp name="$localFqdn" /ip cloud set update-time=no /ip cloud set ddns-enabled=yes /ip upnp set enabled=no /ip upnp set show-dummy-rule=no /ip settings set rp-filter=strict /ip neighbor discovery set discover-interface-list=none /ip proxy set enabled=no /ip socks set enabled=no /ip service set telnet disabled=yes set api disabled=yes set api-ssl disabled=yes set telnet address="$authorizedAdminNetwork" set api address="$authorizedAdminNetwork" set api-ssl address="$authorizedAdminNetwork" set ftp address="$authorizedAdminNetwork" set www address="$authorizedAdminNetwork" set winbox address="$authorizedAdminNetwork" set www-ssl address="0.0.0.0/0" set ssh address="0.0.0.0/0" set ssh port="$sshPortMikrotik" set www-ssl port="$httpsPortMikrotik" :do { /ip ssh set strong-crypto=yes } on-error={} set www disabled=yes /tool bandwidth-server set enabled=no /tool mac-server set allowed-interface-list=none /tool mac-server mac-winbox set allowed-interface-list=none /tool mac-server ping set enabled=no /system clock set time-zone-autodetect=no set time-zone-name="$timeZone" :if ( ([:len $ntpServerIp1] > 0) and ([:len $ntpServerIp2] > 0) ) do={ /system ntp client set enabled=yes servers="$ntpServerIp1,$ntpServerIp2" } else={ :if ([:len $ntpServerIp1] > 0) do={ /system ntp client set enabled=yes servers="$ntpServerIp1" } } :if ([:len $ntpServersFqdns] > 0) do={ /system ntp client set enabled=yes servers="$ntpServersFqdns" } :if ([:len $syslogServerIp] > 0) do={ /system logging action add name=remoteSyslog remote="$syslogServerIp" target="remote" /system logging add action="remoteSyslog" topics="!debug,!packet" /system logging add action="remoteSyslog" topics="dhcp" /system logging add topics="account" } /system logging add prefix="debug" topics="wireless" /system logging add prefix="debug" topics="manager" /system logging add topics="account" /interface bridge settings set allow-fast-path=yes use-ip-firewall=no use-ip-firewall-for-pppoe=no use-ip-firewall-for-vlan=no :put "" :put "========================================================================" :put "=== Configuring bridges, vlan interfaces and associating them" :put "========================================================================" # Create bridges (associated to vlans) :foreach vlanName,vlanId in=$vlanNamesConfig do={ /interface bridge add name=("br-".$vlanName."-v".$vlanId) } :if ($verboseConfig = "yes") do={ /interface bridge print brief } # Create vlan interfaces :foreach vlanName,vlanId in=$vlanNamesConfig do={ :foreach iface in=($egressPortsToTagArray->$vlanId) do={ /interface vlan add interface=$iface name=("vlif-".$vlanName."-".$iface."-v".$vlanId) vlan-id=$vlanId } } :if ($verboseConfig = "yes") do={ /interface vlan print brief } # Add vlan interfaces to the corresponding bridges :foreach vlanName,vlanId in=$vlanNamesConfig do={ :foreach iface in=($egressPortsToTagArray->$vlanId) do={ #:put ("br-".$vlanName."-v".$vlanId." "."vlif-".$vlanName."-".$iface."-v".$vlanId) /interface bridge port add bridge=("br-".$vlanName."-v".$vlanId) interface=("vlif-".$vlanName."-".$iface."-v".$vlanId) } } :if ($verboseConfig = "yes") do={ /interface bridge port print brief } # Add untagged ports to corresponding bridges :foreach vlanName,vlanId in=$vlanNamesConfig do={ :foreach iface in=([:toarray ($ingressPortsToTagArray->$vlanId)]) do={ #:put ("br-".$vlanName."-v".$vlanId." ".$iface) /interface bridge port add bridge=("br-".$vlanName."-v".$vlanId) interface=$iface } } :if ($verboseConfig = "yes") do={ /interface bridge port print } # Do not allow discovery /ip neighbor discovery set discover-interface-list=none :put "" :put "======================================================================" :put "= Configuring IP addresses and default route" :put "======================================================================" :foreach vlanName,ipAdressAndMaskSize in=$bridgesIps do={ :if ([:len $ipAdressAndMaskSize] > 0) do={ /ip address add address="$ipAdressAndMaskSize" interface=("br-".$vlanName."-v".($vlanNamesConfig->$vlanName)) } } :if ($verboseConfig = "yes") do={ /ip address print } :if ([:len $defaultGw] > 0) do={ /ip route add distance=1 gateway="$defaultGw" } :if ($verboseConfig = "yes") do={ /ip route print } :put "" :put "======================================================================" :put "= Configuring masquerading" :put "======================================================================" :if ($functionnalModeConfig = "firewall" ) do={ /ip firewall nat add action=masquerade chain=srcnat log=yes log-prefix=out_masq out-interface=$internetBridgeNameConfig } :put "" :put "======================================================================" :put "= Configuring adress-lists" :put "======================================================================" :if ($functionnalModeConfig = "firewall" ) do={ /ip firewall address-list add address="$authorizedAdminNetwork" comment="Allowed IPs for this equipment managment " list=support add address=10.0.0.0/8 comment="CLASS A - Private[RFC 1918] ### Check if you need this subnet before enable it" disabled=yes list=bogons add address=172.16.0.0/12 comment="CLASS B - Private[RFC 1918] ### Check if you need this subnet before enable it" disabled=yes list=bogons add address=192.168.0.0/16 comment="CLASS C - Private[RFC 1918] ### Check if you need this subnet before enable it" disabled=yes list=bogons add address=224.0.0.0/4 comment="CLASS D / MULTICAST IANA ### Check if you need this subnet before enable it" list=bogons add address=0.0.0.0/8 comment="Self-Identification [RFC 3330]" list=bogons add address=127.0.0.0/16 comment="Loopback [RFC 3330]" list=bogons add address=100.64.0.0/10 comment="RFC6890" list=bogons add address=169.254.0.0/16 comment="Link Local [RFC 3330]" list=bogons add address=192.0.0.0/24 comment="RFC6890" list=bogons add address=192.0.2.0/24 comment="Reserved - IANA - TestNet1" list=bogons add address=192.88.99.0/24 comment="6to4 Relay Anycast [RFC 3068]" list=bogons add address=198.18.0.0/15 comment="NIDB Testing" list=bogons add address=198.51.100.0/24 comment="Reserved - IANA - TestNet2" list=bogons add address=203.0.113.0/24 comment="Reserved - IANA - TestNet3" list=bogons add address=240.0.0.0/4 comment="RFC6890" list=bogons } :put "" :put "======================================================================" :put "= Configuring firewall rules : invalid packets dropping" :put "======================================================================" :if ($functionnalModeConfig = "firewall" ) do={ /ip firewall filter add action=passthrough chain=separator comment="################################ DROP INVALID PACKETS" add action=drop chain=input comment="Drop input invalid packets" connection-state=invalid log=yes add action=drop chain=output comment="Drop output invalid packets" connection-state=invalid log=yes add action=drop chain=forward comment="Drop forward invalid packets" connection-state=invalid log=yes } :put "" :put "======================================================================" :put "= Configuring firewall rules : attacks mitigation" :put "======================================================================" :if ($functionnalModeConfig = "firewall" ) do={ /ip firewall filter add action=passthrough chain=comment comment="################################ ATTACKs MITIGATION" add chain=forward action=drop dst-address-list=bogons comment="Drop to bogon list" add chain=input action=drop src-address-list=Port_Scanner comment="Drop to port scan list" add chain=forward action=drop dst-port=25,587 protocol=tcp src-address-list=spammers comment="Drop spammers" add chain=input action=drop protocol=tcp dst-port="22,$sshPortMikrotik" src-address-list=ssh_blacklist comment="Drop ssh brute forcers" disabled=no add chain=input action=drop protocol=tcp dst-port=3389 src-address-list=rdp_blacklist comment="Drop RDP brute forcers" disabled=no add chain=input action=drop protocol=tcp dst-port="443,$httpsPortMikrotik" src-address-list=https_blacklist comment="Drop https brute forcers" disabled=no add chain=input action=add-src-to-address-list address-list="Port_Scanner" protocol=tcp psd=21,3s,3,1 address-list-timeout=2w comment="Port scanners" disabled=no add chain=input action=add-src-to-address-list address-list="Port_Scanner" protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg address-list-timeout=2w comment="NMAP FIN Stealth scan" add chain=input action=add-src-to-address-list address-list="Port_Scanner" protocol=tcp tcp-flags=fin,syn address-list-timeout=2w comment="SYN/FIN scan" add chain=input action=add-src-to-address-list address-list="Port_Scanner" protocol=tcp tcp-flags=syn,rst address-list-timeout=2w comment="SYN/RST scan" add chain=input action=add-src-to-address-list address-list="Port_Scanner" protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack address-list-timeout=2w comment="FIN/PSH/URG scan" add chain=input action=add-src-to-address-list address-list="Port_Scanner" protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg address-list-timeout=2w comment="ALL/ALL scan" add chain=input action=add-src-to-address-list address-list="Port_Scanner" protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg address-list-timeout=2w comment="NMAP NULL scan" add chain=forward action=add-src-to-address-list address-list=spammers address-list-timeout=3h connection-state=new connection-limit=30,32 dst-port=25,587 limit=30/1m,0:packet protocol=tcp comment="Add Spammers to the list for 3 hours" add chain=input action=add-src-to-address-list address-list=ssh_blacklist protocol=tcp dst-port="22,$sshPortMikrotik" connection-state=new src-address-list=ssh_stage3 address-list-timeout=1d comment="Add SSH brute forcer to ssh_blacklist list" disabled=no add chain=input action=add-src-to-address-list address-list=ssh_stage3 protocol=tcp dst-port="22,$sshPortMikrotik" connection-state=new src-address-list=ssh_stage2 address-list-timeout=1m comment="Add SSH brute forcer to ssh_stage3 list" disabled=no add chain=input action=add-src-to-address-list address-list=ssh_stage2 protocol=tcp dst-port="22,$sshPortMikrotik" connection-state=new src-address-list=ssh_stage1 address-list-timeout=1m comment="Add SSH brute forcer to ssh_stage2 list" disabled=no add chain=input action=add-src-to-address-list address-list=ssh_stage1 protocol=tcp dst-port="22,$sshPortMikrotik" connection-state=new address-list-timeout=1m comment="Add SSH brute forcer to ssh_stage1 list" disabled=no add chain=input action=add-src-to-address-list address-list=rdp_blacklist protocol=tcp dst-port=3389 connection-state=new src-address-list=rdp_stage4 address-list-timeout=1d comment="Add RDP brute forcer to rdp_blacklist list" disabled=no add chain=input action=add-src-to-address-list address-list=rdp_stage4 protocol=tcp dst-port=3389 connection-state=new src-address-list=rdp_stage3 address-list-timeout=1m comment="Add RDP brute forcer to rdp_stage4 list" disabled=no add chain=input action=add-src-to-address-list address-list=rdp_stage3 protocol=tcp dst-port=3389 connection-state=new src-address-list=rdp_stage2 address-list-timeout=1m comment="Add RDP brute forcer to rdp_stage3 list" disabled=no add chain=input action=add-src-to-address-list address-list=rdp_stage2 protocol=tcp dst-port=3389 connection-state=new src-address-list=rdp_stage1 address-list-timeout=1m comment="Add RDP brute forcer to rdp_stage2 list" disabled=no add chain=input action=add-src-to-address-list address-list=rdp_stage1 protocol=tcp dst-port=3389 connection-state=new address-list-timeout=1m comment="Add RDP brute forcer to rdp_stage1 list" disabled=no add chain=input action=add-src-to-address-list address-list=https_blacklist address-list-timeout=1h connection-state=new connection-limit=30,32 dst-port="443,$httpsPortMikrotik" limit=5/1m,0:packet protocol=tcp comment="Add HTTPS brute forcer to https_blacklist list" } :put "" :put "======================================================================" :put "= Configuring firewall rules : established/related" :put "======================================================================" :if ($functionnalModeConfig = "firewall" ) do={ /ip firewall filter add action=passthrough chain=comment comment="################################ ESTABLISHED / RELATED" add chain=input comment="Accept established/related connections/packets" connection-state=established,related add chain=forward comment="Accept established/related connections/packets" connection-state=established,related add chain=output comment="Accept established/related connections/packets" connection-state=established,related } :put "" :put "======================================================================" :put "= Configuring firewall rules : input" :put "======================================================================" :if ($functionnalModeConfig = "firewall" ) do={ /ip firewall filter add action=passthrough chain=comment comment="################################ INPUT" add action=drop chain=input comment="Drop all access to FW admin - except to support list" dst-port="21,22,$sshPortMikrotik,23,80,443,$httpsPortMikrotik,8291,8728,8729" protocol=tcp src-address-list=!support add action=drop chain=input comment="Drop MT Discovery Protocol" dst-port=5678 protocol=udp add action=accept chain=input comment="Allow full access to SUPPORT address list" log-prefix=support-access src-address-list=support add action=accept chain=input comment="Allow localhost traffic" dst-address=127.0.0.1 src-address=127.0.0.1 add action=accept chain=input comment="Allow Broadcast Traffic" dst-address-type=broadcast add action=accept chain=input comment="EXAMPLE Allow CAPs to reach CAPsMAN" dst-port=5246,5247 in-interface=$adminBridgeNameConfig log=yes log-prefix=capsman-in protocol=udp disabled=yes add action=accept chain=input comment="Allow UPnP udp/1900" dst-port=1900 protocol=udp disabled=yes add action=accept chain=input comment="Allow UPnP tcp/2828" dst-port=2828 protocol=tcp disabled=yes add action=accept chain=input comment="Allow SNMP requests from support tcp/161" dst-port=161 protocol=tcp src-address-list=support add action=accept chain=input comment="Allow SNMP requests from support udp/161" dst-port=161 protocol=udp src-address-list=support add action=accept chain=input comment="Allow DHCP requests from clients" src-port=68 dst-port=67 in-interface="!$internetBridgeNameConfig" protocol=udp add action=accept chain=input comment="Allow DHCP answers from others" src-port=67 dst-port=68 in-interface="!$internetBridgeNameConfig" protocol=udp add action=accept chain=input comment="Allow DNS requests from clients udp/53" dst-port=53 protocol=udp in-interface="!$internetBridgeNameConfig" add action=accept chain=input comment="Allow DNS requests from clients tcp/53" dst-port=53 protocol=tcp in-interface="!$internetBridgeNameConfig" add action=accept chain=input comment="Allow NTP requests from clients" dst-port=123 protocol=udp in-interface="!$internetBridgeNameConfig" add action=accept chain=input comment="Allow Web Proxy requests from clients" dst-port=8080 protocol=tcp disabled=yes add action=accept chain=input comment="Allow Socks requests from clients for Hotspot" dst-port=1080 protocol=tcp disabled=yes add action=accept chain=input comment="AllowBandwidth server requests from clients" dst-port=2000 protocol=tcp disabled=yes add action=accept chain=input comment="Allow PPTP connections from clients (tcp/1723)" dst-port=1723 protocol=tcp disabled=yes add action=accept chain=input comment="Allow PPTP and EoIP connections from clients (gre)" protocol=gre disabled=yes add action=accept chain=input comment="Allow IPIP connections from clients" protocol=ipencap disabled=yes add action=accept chain=input comment="Allow IPSec connections from clients (IKE)" dst-port=500 protocol=udp disabled=yes add action=accept chain=input comment="Allow IPSec connections from clients (IKE2/nat traversal)" protocol=udp disabled=yes add action=accept chain=input comment="Allow IPSec connections from clients (ESP)" protocol=ipsec-esp disabled=yes add action=accept chain=input comment="Allow IPSec connections from clients (AH)" protocol=ipsec-ah disabled=yes add action=accept chain=input comment="Allow OpenVPN connections from clients tcp/1194" dst-port=1194 protocol=tcp disabled=yes add action=accept chain=input comment="Allow OpenVPN connections from clients udp/1194" dst-port=1194 protocol=udp disabled=yes add action=accept chain=input comment="Allow SSTP connections from clients tcp/$sstpPortMikrotik" dst-port="$sstpPortMikrotik" protocol=tcp disabled=yes add action=accept chain=input comment="Allow RIP connections from others" dst-port=520-521 protocol=udp disabled=yes add action=accept chain=input comment="Allow OSPF connections from others" protocol=ospf disabled=yes add action=accept chain=input comment="Allow BGP connections from others" dst-port=179 protocol=tcp disabled=yes add action=accept chain=input comment="Allow BGP connections from others" dst-port=5000-5100 protocol=udp disabled=yes add action=jump chain=input comment="Jump for icmp input flow" jump-target=ICMP protocol=icmp } :put "" :put "======================================================================" :put "= Configuring firewall rules : output" :put "======================================================================" :if ($functionnalModeConfig = "firewall" ) do={ /ip firewall filter add action=passthrough chain=comment comment="################################ OUTPUT" add action=accept chain=output comment="Allow localhost traffic" dst-address=127.0.0.1 src-address=127.0.0.1 add action=accept chain=output comment="Allow Broadcast Traffic" dst-address-type=broadcast add action=accept chain=output comment="Allow Mikrotik Cloud Traffic" dst-port=15252 protocol=udp add action=accept chain=output comment="EXAMPLE Allow CAPsMAN to reach CAPs" log=yes log-prefix=capsman-out out-interface=$adminBridgeNameConfig protocol=udp src-port=5246,5247 disabled=yes add action=accept chain=output comment="Allow UPnP udp/1900" dst-port=1900 protocol=udp disabled=yes add action=accept chain=output comment="Allow UPnP tcp/2828" dst-port=2828 protocol=tcp disabled=yes add action=accept chain=output comment="Allow SNMP traps outgoing tcp/162" dst-port=162 protocol=tcp dst-address-list=support add action=accept chain=output comment="Allow SNMP traps outgoing udp/162" dst-port=162 protocol=udp dst-address-list=support add action=accept chain=output comment="Allow DHCP requests from firewall" src-port=68 dst-port=67 protocol=udp add action=accept chain=output comment="Allow DHCP answers from firewall" src-port=67 dst-port=68 protocol=udp add action=accept chain=output comment="Allow DNS requests from firewall udp/53" dst-port=53 protocol=udp add action=accept chain=output comment="Allow DNS requests from firewall tcp/53" dst-port=53 protocol=tcp add action=accept chain=output comment="Allow NTP requests from firewall" dst-port=123 protocol=udp add action=accept chain=output comment="Allow WEB requests from firewall" dst-port=80,8080,443 protocol=tcp :if ([:len $syslogServerIp] > 0) do={ add action=accept chain=output comment="Allow Syslog sending to syslog server tcp/514" dst-address="$syslogServerIp" dst-port=514 protocol=tcp add action=accept chain=output comment="Allow Syslog sending to syslog server udp/514" dst-address="$syslogServerIp" dst-port=514 protocol=udp } add action=accept chain=output comment="Allow PPTP connections from firewall (tcp/1723)" dst-port=1723 protocol=tcp disabled=yes add action=accept chain=output comment="Allow PPTP and EoIP connections from firewall (gre)" protocol=gre disabled=yes add action=accept chain=output comment="Allow IPIP connections from firewall" protocol=ipencap disabled=yes add action=accept chain=output comment="Allow IPSec connections from firewall (IKE)" dst-port=500 protocol=udp disabled=yes add action=accept chain=output comment="Allow IPSec connections from firewall (IKE2/nat traversal)" dst-port=4500 protocol=udp disabled=yes add action=accept chain=output comment="Allow IPSec connections from firewall (ESP)" protocol=ipsec-esp disabled=yes add action=accept chain=output comment="Allow IPSec connections from firewall (AH)" protocol=ipsec-ah disabled=yes add action=accept chain=output comment="Allow OpenVPN connections from firewall tcp/1194" dst-port=1194 protocol=tcp disabled=yes add action=accept chain=output comment="Allow OpenVPN connections from firewall udp/1194" dst-port=1194 protocol=udp disabled=yes add action=accept chain=output comment="Allow SSTP connections from firewall tcp/$sstpPortMikrotik" dst-port="$sstpPortMikrotik" protocol=tcp disabled=yes add action=accept chain=output comment="Allow RIP connections to others" dst-port=520-521 protocol=udp disabled=yes add action=accept chain=output comment="Allow OSPF connections to others" protocol=ospf disabled=yes add action=accept chain=output comment="Allow BGP connections to others" dst-port=179 protocol=tcp disabled=yes add action=accept chain=output comment="Allow BGP connections to others" dst-port=5000-5100 protocol=udp disabled=yes add action=jump chain=output comment="Jump for icmp output" jump-target=ICMP protocol=icmp } :put "" :put "======================================================================" :put "= Configuring firewall rules : forward" :put "======================================================================" :if ($functionnalModeConfig = "firewall" ) do={ /ip firewall filter add action=passthrough chain=separator comment="################################ FORWARD" add action=drop chain=forward comment="Drop uTorrent" dst-port=53658 protocol=tcp disabled=yes add action=drop chain=forward comment="Drop DC++ tcp/13336" dst-port=13336 protocol=tcp disabled=yes add action=drop chain=forward comment="Drop DC++ tcp/19030" dst-port=19030 protocol=tcp disabled=yes add action=drop chain=forward comment="Drop DC++ udp/12620" dst-port=12620 protocol=udp disabled=yes add action=jump chain=forward comment="Jump for icmp forward flow" jump-target=ICMP protocol=icmp add chain=forward comment="Accept Internet outgoing" out-interface="$internetBridgeNameConfig" } :put "" :put "======================================================================" :put "= Configuring firewall rules : ICMP chain" :put "======================================================================" :if ($functionnalModeConfig = "firewall" ) do={ /ip firewall filter add action=passthrough chain=comment comment="################################ ICMP" add action=accept chain=ICMP comment="Echo request - Avoiding Ping Flood" icmp-options=8:0 limit=1,5:packet protocol=icmp add action=accept chain=ICMP comment="Echo reply" icmp-options=0:0 protocol=icmp add action=accept chain=ICMP comment="Time Exceeded" icmp-options=11:0 protocol=icmp add action=accept chain=ICMP comment="Destination unreachable" icmp-options=3:0-1 protocol=icmp add action=accept chain=ICMP comment=PMTUD icmp-options=3:4 protocol=icmp add action=drop chain=ICMP comment="Drop to the other ICMPs" protocol=icmp } :put "" :put "======================================================================" :put "= Configuring firewall rules : final rejects/drops" :put "======================================================================" :if ($functionnalModeConfig = "firewall" ) do={ /ip firewall filter add action=passthrough chain=comment comment="################################ FINAL REJECT / DROP" add action=reject chain=input in-interface="!$internetBridgeNameConfig" log=yes log-prefix=reject:input reject-with=icmp-admin-prohibited add action=reject chain=forward in-interface="!$internetBridgeNameConfig" log=yes log-prefix=reject:forward reject-with=icmp-admin-prohibited add action=reject chain=output log=yes log-prefix=reject:output out-interface="!$internetBridgeNameConfig" reject-with=icmp-admin-prohibited add action=drop chain=input log=yes log-prefix=drop:input add action=drop chain=forward log=yes log-prefix=drop:forward add action=drop chain=output log=yes log-prefix=drop:output } :put "" :put "======================================================================" :put " = HTTPS certificate generation (takes some time...)" :put "======================================================================" /certificate add name="catmpl-$localHostname" common-name="ca-$localHostname" key-usage=key-cert-sign,crl-sign days-valid=10000 key-size=2048 add name="fwtmpl-$localHostname" common-name="$localFqdn" days-valid=10000 key-size=2048 sign "catmpl-$localHostname" ca-crl-host=127.0.0.1 name="ca-$localHostname" :delay 1s sign ca="ca-$localHostname" "fwtmpl-$localHostname" name="$localHostname" :delay 1s set "ca-$localHostname" trusted=yes set "$localHostname" trusted=yes export-certificate "ca-$localHostname" /ip service set www-ssl certificate="$localHostname" disabled=no # Wait for certificates to be created { :local count 0; :while ([/certificate find where name="$localHostname"] = "") do={ :if ($count = 30) do={ /quit; } :delay 1s; :set count ($count +1); }; } :put "" :put "========================================================================" :put "=== Destroying defined global variables" :put "========================================================================" :set vlanNamesConfig :set bridgesIps :set adminVlanNameConfig :set internetVlanNameConfig :set internetBridgeNameConfig :set adminBridgeNameConfig :set vlansConfig :set functionnalModeConfig :set verboseConfig :set keyInSimpleArray :set keyInArray :set vlanNameArray :set localEthernetInterfaces :set egressPortsToTagArray :set ingressPortsToTagArray :set configurationOk :set administrationIp :set defaultGw :set localHostname :set localFqdn :set dnsServers :set timeZone :set ntpServerIp1 :set ntpServerIp2 :set ntpServersFqdns :set syslogServerIp :set adminUserName :set adminPassword :set authorizedAdminNetwork :set sshPortMikrotik :set httpsPortMikrotik :set sstpPortMikrotik :put "========================================================================" :put "=== Some usefull scripts" :put "========================================================================" /system script add name=backup_script owner=creadmin source=":local curDate [/system clock get date]\ \n:local curTime [/system clock get time]\ \n:local systemName [/system identity get name]\ \n:local curMonth [:pick \$curDate 0 3]\ \n :set curMonth ( [ :find key=\"\$curMonth\" in=\"jan,feb,mar,apr,may,jun,jul,aug,sep,oct,nov,dec\" from=-1 ] / 4 + 1)\ \n if ( \$curMonth < 10 ) do={\ \n :set curMonth ( \"0\".\$curMonth )\ \n } else={\ \n :set curMonth \$curMonth\ \n }\ \n:local curDay [:pick \$curDate 4 6]\ \n:local curYear [:pick \$curDate 7 13]\ \n:local curHour [:pick \$curTime 0 2]\ \n:local curMin [:pick \$curTime 3 5]\ \n\ \n/\ \n/export show-sensitive file=( \"\$systemName\".\"-\".\"\$curYear\".\"\$curMonth\".\"\$curDay\" .\"-\".\"\$curHour\".\"\$curMin\" )\ \n/file print" :put "" :put "========================================================================" :put "=== End of script noise" :put "========================================================================" :for i from=500 to=10000 step=500 do={ :beep frequency=$i length=11ms; :delay 11ms; } :delay 50ms; :for i from=500 to=10000 step=500 do={ :beep frequency=$i length=11ms; :delay 11ms; } :delay 50ms; :for i from=500 to=10000 step=500 do={ :beep frequency=$i length=11ms; :delay 11ms; } :put "======================================================================" :put "======================================================================" :put "======================================================================" :put "====MANUAL ADDING FOR EXAMPLES =======================================" :put "======================================================================" :put "======================================================================" :put "======================================================================" /ip pool add name=dhcpp-admin-admin ranges=10.1.1.101-10.1.1.199 add name=dhcpp-pro-lan ranges=192.168.1.101-192.168.1.199 add name=dhcpp-pro-lan-vpn-user-inside_lan ranges=192.168.1.51-192.168.1.99 add name=dhcpp-vpn-user-managed ranges=10.1.65.101-10.1.65.199 add name=dhcpp-vpn-user-unmanaged ranges=10.1.210.101-10.1.210.199 /ip dhcp-server add address-pool=dhcpp-admin-admin disabled=no interface=br-admin-admin-v1 name=dhcps-admin-admin add address-pool=dhcpp-pro-lan disabled=no interface=br-pro-lan-v50 name=dhcps-pro-lan /ip dhcp-server network add address=10.1.1.0/24 dns-server=10.1.1.254 gateway=10.1.1.254 add address=192.168.1.0/24 dns-server=192.168.1.1 gateway=192.168.1.1 /ip firewall address-list add address=1.2.3.4 comment="Robert VAL - XTRACmpy - home" list=support add address=192.168.1.0/24 comment="Local Admin via pro-lan" list=support /interface wireless disable wlan1 /interface wireless disable wlan2 # !!! Go to DHCP client to FAI interface ! #ip address disable [find where address="10.1.230.253/24"] #/ip dhcp-client add interface=br-fai1-v230 disabled=no /ip cloud force-update :delay 10s /ip cloud print /system clock print /ip firewall filter enable [find where comment="Allow SSTP connections from clients tcp/42444"] :put "" :put "======================================================================" :put " = Set variables for SSTP script " :put "======================================================================" / :global sstpPortMikrotik "42444" :global lanBridge "br-pro-lan-v50" :global lanBridgeIp "192.168.1.1" :global lanDnsServer "192.168.1.1" :global lanUserIpPool "dhcpp-pro-lan-vpn-user-inside_lan" :global managedUserBridge "br-pro-vpn-user-managed-v65" :global managedUserBridgeIp "10.1.65.254" :global managedUserDnsServer "10.1.65.254" :global managedUserIpPool "dhcpp-vpn-user-managed" :global notManagedUserBridge "br-pro-vpn-user-unmanaged-v210" :global notManagedUserBridgeIp "10.1.210.254" :global notManagedUserDnsServer "10.1.210.254" :global notManagedUserIpPool "dhcpp-vpn-user-unmanaged" :global initialUserName "ghusson" :global initialUserPassword "ghusson.1" :global wanIp [/ip cloud get public-address]; :global ddnsName [/ip cloud get dns-name]; /env print :put "" :put "======================================================================" :put " = HTTPS certificate generation for SSTP server(takes some time...)" :put "======================================================================" /certificate add name="sstpcatmpl-$ddnsName" common-name="ca-$ddnsName" key-usage=key-cert-sign,crl-sign days-valid=10000 key-size=2048 add name="sstpclitmpl-$ddnsName" common-name="$ddnsName" days-valid=10000 key-size=2048 sign "sstpcatmpl-$ddnsName" ca-crl-host="" name="ca-$ddnsName" :delay 1s sign ca="ca-$ddnsName" "sstpclitmpl-$ddnsName" name="$ddnsName" :delay 1s set "ca-$ddnsName" trusted=yes set "$ddnsName" trusted=yes export-certificate "ca-$ddnsName" # Wait for certificates to be created { :local count 0; :while ([/certificate find where name="$ddnsName"] = "") do={ :if ($count = 30) do={ /quit; } :delay 1s; :set count ($count +1); }; } :put "" :put "======================================================================" :put " = Enable SSTP server, add initial user profile and enable proxy-arp " :put "======================================================================" /interface list add name=iflist_sstp_inside_lan /interface list add name=iflist_sstp_managed /interface list add name=iflist_sstp_unmanaged # VPN users directly in LAN (trusted, or admins) : inside lan /ppp profile add bridge="$lanBridge" change-tcp-mss=yes comment="SSTP VPN Profile for clients inside pro lan"\ dns-server="$lanDnsServer" local-address="$lanBridgeIp" name=ppp_profile_sstp_inside_lan only-one=yes\ remote-address="$lanUserIpPool" use-compression=yes use-encryption=yes use-mpls=no use-upnp=no interface-list=iflist_sstp_inside_lan # VPN users that have customer managed equipment : managed /ppp profile add bridge="$managedUserBridge" change-tcp-mss=yes comment="SSTP VPN Profile for managed clients"\ dns-server="$managedUserDnsServer" local-address="$managedUserBridgeIp" name=ppp_profile_sstp_managed only-one=yes\ remote-address="$managedUserIpPool" use-compression=yes use-encryption=yes use-mpls=no use-upnp=no interface-list=iflist_sstp_managed # VPN users that have personnal equipment : UNmanaged /ppp profile add bridge="$notManagedUserBridge" change-tcp-mss=yes comment="SSTP VPN Profile for UNmanaged clients"\ dns-server="$notManagedUserDnsServer" local-address="$notManagedUserBridgeIp" name=ppp_profile_sstp_unmanaged only-one=yes\ remote-address="$notManagedUserIpPool" use-compression=yes use-encryption=yes use-mpls=no use-upnp=no interface-list=iflist_sstp_unmanaged /interface sstp-server server set default-profile=ppp_profile_sstp_unmanaged /interface sstp-server server set certificate="$ddnsName" /interface sstp-server server set authentication=mschap2 /interface sstp-server server set port="$sstpPortMikrotik" /interface sstp-server server set keepalive-timeout=60 /interface sstp-server server set enabled=yes /ppp secret add name="$initialUserName" password="$initialUserPassword" service=sstp profile=ppp_profile_sstp_managed /interface bridge set "$lanBridge" arp=proxy-arp /interface bridge set "$managedUserBridge" arp=proxy-arp :put "" :put "======================================================================" :put " = Create firewall rules " :put "======================================================================" /ip firewall filter # sstp_inside_lan add action=accept chain=forward comment="SSTP inside LAN -> LAN" in-interface-list=iflist_sstp_inside_lan out-interface="$lanBridge" log=yes log-prefix=sstpinlan disabled=no add action=accept chain=forward comment="SSTP inside LAN -> inside LAN" in-interface-list=iflist_sstp_inside_lan out-interface-list=iflist_sstp_inside_lan log=yes log-prefix=sstpinlan disabled=no add action=accept chain=forward comment="LAN -> inside LAN" in-interface="$lanBridge" out-interface-list=iflist_sstp_inside_lan log=yes log-prefix=sstpinlan disabled=no # sstp_managed add action=accept chain=forward comment="SSTP managed -> LAN" in-interface-list=iflist_sstp_managed out-interface="$lanBridge" log=yes log-prefix=sstpmngd disabled=no add action=accept chain=forward comment="SSTP managed -> SSTP managed" in-interface-list=iflist_sstp_managed out-interface-list=iflist_sstp_managed log=yes log-prefix=sstpmngd disabled=yes add action=accept chain=forward comment="LAN -> SSTP managed" in-interface="$lanBridge" out-interface-list=iflist_sstp_managed log=yes log-prefix=sstpmngd disabled=no # sstp_unmanaged add action=accept chain=forward comment="SSTP UNmanaged -> LAN" in-interface-list=iflist_sstp_unmanaged out-interface="$lanBridge" log=yes log-prefix=sstpunmngd disabled=no add action=accept chain=forward comment="SSTP UNmanaged -> SSTP UNmanaged" in-interface-list=iflist_sstp_unmanaged out-interface-list=iflist_sstp_unmanaged log=yes log-prefix=sstpunmngd disabled=yes add action=accept chain=forward comment="LAN -> SSTP UNmanaged" in-interface="$lanBridge" out-interface-list=iflist_sstp_unmanaged log=yes log-prefix=sstpunmngd disabled=yes :put "" :put "======================================================================" :put " = Clean variables for SSTP script " :put "======================================================================" :set sstpPortMikrotik :set managedUserDnsServer :set managedUserBridgeIp :set managedUserBridge :set notManagedUserDnsServer :set notManagedUserBridgeIp :set notManagedUserBridge :set initialUserName :set initialUserPassword :set managedUserIpPool :set wanIp :set ddnsName