====== Mikrotik notes ====== Every router is factory pre-configured with IP address 192.168.88.1/24 on ether1 or ether2 port. Default username is **admin** with empty password. http://wiki.mikrotik.com/wiki/Manual:First_time_startup **RQ :** pour les points d'accès WIFI : se connecter au SSID Mikrotik_XXXX Soit avant de brancher : on charge le backup boot loader, Soit juste après avoir branché : on charge le default loader. ===== Buttons and Jumpers ===== ==== Loading the backup RouterBOOT loader ==== Hold this button before applying power, release after three seconds since powering, to load backup Boot loader. This might be necessary if the device is not operation because of a failed RouterBOOT upgrade. When you have started the device with the backup loader, you can either set RouterOS to force backup loader in the RouterBOARD settings, or have a chance to reinstall the failed RouterBOOT from a fwf file (total 3 seconds). ==== Resetting the RouterOS configuration ==== If you keep holding this button for 2 more seconds until LED light starts flashing, release the button to reset RouterOS configuration (total 5 seconds). ==== Enabling CAPs mode ==== To connect this device to a wireless network managed by CAPsMAN, keep holding the button for 5 more seconds, LED turns solid, release now to turn on CAPs mode (total 10 seconds). ==== Starting the RouterBOARD in Netinstall mode ==== Or Keep holding the button for 5 more seconds until until LED turns off, then release it to make the RouterBOARD look for Netinstall servers. You can also simply keep the button pressed until the device shows up in the Netinstall program on Windows (total 15 seconds). ===== netinstall ===== Mettre IP fixe sur carte, donner IP du sous réseau à netinstall. **/!\** Ne pas cocher intégrer un script, sinon ce sera la conf par defaut si restauration de conf. **/!\** Lors du netinstall, la partition est reformatée, tout ce qui était dans la flash est perdu ! /export /import **attention :** si tous les paquets ne sont pas présents, cela génère des erreurs L'export ne contient pas user/passwd d'admin Attention au nom et nombre d'interfaces. Pour plus de chance de succès, utiliser le scripting : set [ find default-name=ether6 ] name=ether2 Vérifier que les règles de firewall ont été rechargées /system reboot ===== Configurations (gérer les) ===== ==== sauvegarder une configuration ==== export file=date_equipment ==== RECHARGER une configuration ==== Se connecter en Out Of Band Management, reseter la conf : /certificate> /system reset-configuration no-defaults=yes Passer la sauvegarde de la conf à la main (gros copier coller) Régénérer le certificat SSL et le mot de passe d'administration :


# /!\  !!! CHANGE ME !!!!  /!\ :
:global adminUserName "sqdfkljqskjh"
:global adminPassword "lsqdkjfqhflhj"
:global localFqdn "slqdkfjhqlh.liberasys.com";
# /!\  !!! CHANGE ME !!!!  /!\ :

# Compute hostname
:global localHostname;
:set localHostname;
:global localHostname;
:set localHostname [:pick ($localFqdn) 0 [:find ($localFqdn) "."]];

# Change default admin user
/user add name=$"adminUserName" group=full password="$adminPassword" disabled=no
/user remove admin


:put ""
:put "======================================================================"
:put " = HTTPS certificate generation (takes some time...)"
:put "======================================================================"

/certificate
add name="catmpl-$localHostname" common-name="ca-$localHostname" key-usage=key-cert-sign,crl-sign days-valid=10000 key-size=2048
add name="fwtmpl-$localHostname" common-name="$localFqdn"  days-valid=10000 key-size=2048
sign "catmpl-$localHostname" ca-crl-host=127.0.0.1 name="ca-$localHostname"
:delay 1s
sign ca="ca-$localHostname" "fwtmpl-$localHostname" name="$localHostname"
:delay 1s
set "ca-$localHostname" trusted=yes
set "$localHostname" trusted=yes
export-certificate "ca-$localHostname"
/ip service set www-ssl certificate="$localHostname" disabled=no

# Wait for certificates to be created
  {
  :local count 0;
  :while ([/certificate find where name="$localHostname"] = "") do={
    :if ($count = 30) do={
      /quit;
      }
    :delay 1s; :set count ($count +1);
    };
  }

Reseter l'équipement : /system reboot ==== factory conf ==== /system reset-configuration ==== blank conf ==== /system reset-configuration no-defaults=yes ==== afficher le script de config par defaut ==== /system default-configuration print ===== Le /system backup ===== - génère un fichier chiffré en RC4, avec le mot de passe du user en cours. - ne sauvegarde pas les données user/password ni Dude - est considéré comme un binaire - permet un restore sur le même type déquipement seulement - reset button : http://wiki.mikrotik.com/wiki/Manual:Reset_button - downloads : http://www.mikrotik.com/download - netinstall : http://wiki.mikrotik.com/wiki/Manual:Netinstall - config reset : http://wiki.mikrotik.com/wiki/Manual:Configuration_Management#Configuration_Reset ===== upgrade ===== menu quick set, upgrade ou (>6.31) : { /system package update check-for-updates once :delay 1s; :if ( [get status] = "New version is available") do={ install } } ===== certificats pour openvpn (CA et certificat routeur) ===== /certificate add name=catmpl-sd-114049-fw common-name=ca-sd-114049-fw key-usage=key-cert-sign,crl-sign days-valid=10000 add name=fwtmpl-sd-114049-fw common-name=sd-114049-fw days-valid=10000 sign catmpl-sd-114049-fw name=ca-sd-114049-fw sign ca=ca-sd-114049-fw fwtmpl-sd-114049-fw name=sd-114049-fw set ca-sd-114049-fw trusted=yes set sd-114049-fw trusted=yes export-certificate ca-sd-114049-fw ==== Pool, profile ppp et config openvpn ==== /ip pool add name=admin-ovpn-pool ranges=192.168.2.200-192.168.2.250 /ppp profile add change-tcp-mss=default comment="" bridge=br-admin \ name="ovpn-admin" only-one=default \ use-compression=default use-encryption=required \ local-address=admin-ovpn-pool only-one=no remote-address=admin-ovpn-pool /ppp secret add caller-id="" comment="" disabled=no limit-bytes-in=0 \ limit-bytes-out=0 name="username" password="password" \ routes="" service=any /interface ovpn-server server set auth=sha1,md5 certificate=sd-114049-fw \ cipher=blowfish128,aes128,aes192,aes256 default-profile=ovpn-admin \ enabled=yes keepalive-timeout=disabled max-mtu=1500 mode=ethernet netmask=24 \ port=1194 require-client-certificate=no ==== config client ==== - TCP - TAP - pas de compression - IPV4 : adresses automatiques uniquement, renseigner IP du FW comme DNS - routes : cocher "utiliser cette connexion, uniquement pour les ressources de son réseau". Ajouter les routes utiles à la main. ===== check install ===== /system check-installation ===== debug spanning tree ===== /interface bridge port monitor [find] ==== LOOP (externe) ==== [admin@plmagw03] /interface vlan> /interface print Flags: D - dynamic, X - disabled, R - running, S - slave # NAME TYPE ACTUAL-MTU L2MTU MAX-L2MTU 0 RS ether1 ether 1500 1588 4064 1 S ether2 ether 1500 1588 4064 2 S ether3 ether 1500 1588 4064 3 S ether4 ether 1500 1588 4064 4 S ether5 ether 1500 1588 4064 5 S ether6 ether 1500 1588 4064 6 S ether7 ether 1500 1588 4064 7 S ether8 ether 1500 1588 4064 8 S ether9 ether 1500 1588 4064 9 S ether10 ether 1500 1588 4064 10 S ether11 ether 1500 1588 4064 11 S ether12 ether 1500 1588 4064 12 S ether13 ether 1500 1588 4064 13 S ether14 ether 1500 1588 4064 14 S ether15 ether 1500 1588 4064 15 S ether16 ether 1500 1588 4064 16 S ether17 ether 1500 1588 4064 17 RS ether18 ether 1500 1588 4064 18 S ether19 ether 1500 1588 4064 19 S ether20 ether 1500 1588 4064 20 S ether21 ether 1500 1588 4064 21 S ether22 ether 1500 1588 4064 22 S ether23 ether 1500 1588 4064 23 RS ether24 ether 1500 1588 4064 24 sfp1 ether 1500 1588 4064 25 R br-spanning-tree bridge 1500 1588 26 ;;; 1970.01.02-18:14:44: received loop protect packet originated from 6C:3B:6B:8... vlan1 vlan 1500 1584 ==== LOOP (interne) ==== [admin@plmagw03] /interface vlan> /interface bridge port monitor [find] interface: ether1 ether2 ether3 ethe> status: in-bridge in-bridge in-bridge in-b> port-number: 1 2 3 4 > role: designated-port designated-port backup-port disa> edge-port: no no no no > edge-port-discovery: yes yes yes yes > point-to-point-port: no no no no > external-fdb: no no no no > sending-rstp: yes yes yes no > learning: yes yes no no > forwarding: yes yes no no > root-path-cost: 10 > designated-bridge: 0x8000.6C:3B:6B:85:B8:85 > designated-cost: 0 > designated-port-number: 2 > -- [Q quit|D dump|C-z pause|right] ==== NORMAL ==== [admin@plmagw03] /interface vlan> /interface bridge port monitor [find] interface: ether1 ether2 ether3 ether4 ethe> status: in-bridge in-bridge in-bridge in-bridge in-b> port-number: 1 2 3 4 5 > role: designated-port designated-port disabled-port disabled-port disa> edge-port: no yes no no no > edge-port-discovery: yes yes yes yes yes > point-to-point-port: no no no no no > external-fdb: no no no no no > sending-rstp: yes yes no no yes > learning: yes yes no no no > forwarding: yes yes no no no > ===== script de backup ===== { :local curDate [/system clock get date] :local curTime [/system clock get time] :local systemName [/system identity get name] :local curMonth [:pick $curDate 0 3] :set curMonth ( [ :find key="$curMonth" in="jan,feb,mar,apr,may,jun,jul,aug,sep,oct,nov,dec" from=-1 ] / 4 + 1) if ( $curMonth < 10 ) do={ :set curMonth ( "0".$curMonth ) } else={ :set curMonth $curMonth } :local curDay [:pick $curDate 4 6] :local curYear [:pick $curDate 7 13] :local curHour [:pick $curTime 0 2] :local curMin [:pick $curTime 3 5] / /export show-sensitive file=( "$systemName"."-"."$curYear"."$curMonth"."$curDay" ."-"."$curHour"."$curMin" ) /file print } ===== Automatic Import ===== In RouterOS it is possible to automatically execute scripts - your script file has to be named anything.auto.rsc - once this file is uploaded using FTP to the router, it will automatically be executed, just like with the '/import' command. This method only works with FTP. Once the file is uploaded, it is automatically executed. Information about the success of the commands that were executed is written to anything.auto.log ===== Simple queue : partager un lien internet de manière équitable ===== /queue type add kind=pcq name=PCQ_download pcq-classifier=dst-address add kind=pcq name=PCQ_upload pcq-classifier=src-address /queue simple add max-limit=100M/100M name=queue1 queue=PCQ_upload/PCQ_download target=192.168.1.0/24 ===== Editer les scripts ===== /system script remove brvlan /system script add name=brvlan /system script edit brvlan source paste your script Ctrl+o /system script edit brvlan source review your syntax other solution : /system script print where name=brvlan - https://www.sublimetext.com - https://forum.mikrotik.com/viewtopic.php?f=9&t=81868 - install "package control", restart sublime text - Ctrl + P => install package => mikrotik scripting