This shows you the differences between two versions of the page.
Both sides previous revision Previous revision | |||
networking:router:mikrotik_sonora [2012/12/07 12:19] gcooper |
— (current) | ||
---|---|---|---|
Line 1: | Line 1: | ||
- | ====== Sonora Comm Default MikroTik Configuration Script ====== | ||
- | |||
- | See also **[[networking: | ||
- | |||
- | http:// | ||
- | |||
- | ===== Configuration Procedure ===== | ||
- | |||
- | - Reset the router to **no configuration** | ||
- | * ''/ | ||
- | * If you don't completely erase the configuration, | ||
- | - Copy, edit and save the script as '' | ||
- | - Reconnect to the router using Winbox | ||
- | - Drag and drop the script into the File List window | ||
- | - Import the script | ||
- | * ''/ | ||
- | |||
- | ===== Script ===== | ||
- | |||
- | < | ||
- | # Sonora RouterOS Config | ||
- | # | ||
- | # Adapted by Gene Cooper from a script by Nick Barnes (www.vitell.co.uk) | ||
- | # | ||
- | # http:// | ||
- | # | ||
- | # Save this file as ' | ||
- | # in Winbox. Then at the command line, type '/ | ||
- | # and read the logs! | ||
- | # | ||
- | ################################################################# | ||
- | # | ||
- | # The purpose of this script is to create a standard SOHO type | ||
- | # configuration which can be built on by the user. | ||
- | # It does not provide a complete solution, but should be enough | ||
- | # to get you up and running. | ||
- | # | ||
- | ################################################################# | ||
- | # WARNING | ||
- | # As this script stands, it will trash your existing configuration | ||
- | # so don't run it on a router which has been customised or it won't | ||
- | # be any more! | ||
- | # | ||
- | # DO NOT run this on a live production system. | ||
- | # | ||
- | # We accept absolutely no liability whatsoever. If you choose to run | ||
- | # this script, anything bad that happens is entirely your problem. | ||
- | # | ||
- | # We recommend that your configuration be cleared with the command | ||
- | # '/ | ||
- | # before this script is run. | ||
- | ################################################################# | ||
- | # | ||
- | # Make your changes here: | ||
- | ########################## | ||
- | # | ||
- | # Set the ' | ||
- | :local adminpassword " | ||
- | # | ||
- | # Set the web management service port | ||
- | :local adminport " | ||
- | # | ||
- | # | ||
- | # Name servers must be IP addresses (i.e. not a FQDN) | ||
- | :local nsa " | ||
- | :local nsb " | ||
- | # | ||
- | # Use NAT (yes/no) - Set to ' | ||
- | :local natuse " | ||
- | # | ||
- | # Add all additional ethernet ports to the bridge (yes/no) - Set to ' | ||
- | # other portsto be bridged as in most SOHO routers. | ||
- | :local bridgetherest " | ||
- | # | ||
- | # Fowarding ports with this script is limited to one set of ports to one internal server. | ||
- | # Add additional ports manually afterwards. | ||
- | # | ||
- | # Forward TCP Ports (yes/no) - Set to ' | ||
- | :local fwdtcpports " | ||
- | :local tcpports " | ||
- | :local internalserver " | ||
- | # | ||
- | # | ||
- | #### Network Time (NTP) Settings | ||
- | # | ||
- | ## NTP Client Settings | ||
- | # | ||
- | # We use two NTP servers and these must be specified as FQDNs | ||
- | # (Fully qualified domain names) - i.e. not IP addresss. | ||
- | # | ||
- | # Note that NTP we cannot assume that at the time configuration is run you will have an | ||
- | # Internet connection and so we cannot set this up with the addresses you choose | ||
- | # immediately (if we try to but RouterOS cannot resolve the host names, the script will crash). | ||
- | # So we set up dummy IP addresses to start with and then configure a script to run regularly | ||
- | # to ensure that the following addresses are used once the Internet connection is up. This | ||
- | # sounds long and complicated, | ||
- | # it means that if the IP addresses change for these hosts (as they will do if you use the | ||
- | # pool.ntp.org addresses), your RouterOS will always be connected to a working server. | ||
- | # | ||
- | # The defaults are fine, but you may want to closer servers if you don't live in the US. | ||
- | :local ntpa " | ||
- | :local ntpb " | ||
- | # | ||
- | # Now we define the temporary IP addresses to use pending resolution of the FQDNs above. | ||
- | :local ntptempa " | ||
- | :local ntptempb " | ||
- | # | ||
- | ### NTP Server Settings | ||
- | # | ||
- | # Offer NTP to LAN (yes/no) - Leave this as ' | ||
- | # This sets the system up as a NTP server. This probably isn't necessary for simple solutions | ||
- | # but can save some bandwidth for larger systems | ||
- | :local ntpserver " | ||
- | # | ||
- | # | ||
- | #### PPPoE Settings | ||
- | # | ||
- | # Use PPPoE (yes/no) - Set to ' | ||
- | :local pppoeuse " | ||
- | # | ||
- | # Name of PPPoE interface to create if pppoeuse is ' | ||
- | # You can safely leave this alone. | ||
- | :local pppoeinterface " | ||
- | # | ||
- | # Your PPPoE login details (ignored if PPPoE is not used) | ||
- | # PPPoE is configured on the WAN interface in addition to the WAN IP addresses defined below. | ||
- | # | ||
- | # Username | ||
- | :local pppoeuser " | ||
- | # Password | ||
- | :local pppoepassword " | ||
- | # | ||
- | # The IP address you expect to have allocated to this interface. | ||
- | # Set to empty ("" | ||
- | # This is used to determine whether the link has gone down and you | ||
- | # have been allocated an incorrect IP address (typically this would | ||
- | # be when you have BT broadband in the UK!) | ||
- | # Leaving this variable blank means that a monitoring script will not | ||
- | # be created. | ||
- | :local pppoeipaddress ""; | ||
- | # | ||
- | # | ||
- | #### Mail Settings | ||
- | # | ||
- | # The ' | ||
- | # (i.e. we cannot assume that we can resolve the name right now) | ||
- | :local emailserver " | ||
- | # | ||
- | # Again, in the same way we did for NTP, above, we'll use the following IP address until we | ||
- | # can resolve the FQDN specified above. You're OK leaving this as the default, but doing so | ||
- | # may mean that e-mail doesn' | ||
- | :local emailservertempip " | ||
- | # | ||
- | # The default address e-mails will appear to have been sent from. | ||
- | :local emailfrom "MT Router < | ||
- | # | ||
- | # The e-mail address which should be notified about things happening on this system. | ||
- | :local emailto " | ||
- | # | ||
- | # The e-mail username for SMTP Authentication. | ||
- | :local emailusername " | ||
- | # | ||
- | # The e-mail password for SMTP Authentication. | ||
- | :local emailpassword " | ||
- | # | ||
- | # The SMTP port for mail submission. | ||
- | :local emailport " | ||
- | # | ||
- | # | ||
- | #### Interfaces | ||
- | # | ||
- | # You may define one WAN interface plus an ethernet LAN interface and/or a wireless LAN interface. | ||
- | # If you want both ethernet and wireless, a bridge is created across the two interfaces. | ||
- | # | ||
- | # Do we want to have our LAN on Ethernet (yes/no) | ||
- | :local useetherlan " | ||
- | # | ||
- | # Do we want to have our LAN on Wireless (yes/no) | ||
- | :local usewlan " | ||
- | # | ||
- | ### Interface Names | ||
- | # | ||
- | # WAN interface | ||
- | :local waninterface " | ||
- | # | ||
- | # Ethernet LAN interface | ||
- | :local etherlaninterface " | ||
- | # | ||
- | # Wireless LAN interface | ||
- | :local wlaninterface " | ||
- | # | ||
- | # Name of bridge to create if both useetherlan and usewlan are ' | ||
- | :local bridgeinterface " | ||
- | # | ||
- | # | ||
- | #### WAN IP Addressing | ||
- | # | ||
- | # Use DHCP Client on WAN (yes/no) - Set to ' | ||
- | :local dhcpwan " | ||
- | # | ||
- | # The WAN address to use (if not using PPPoE or DHCP), the network it's in and | ||
- | # the number of bits in the subnet mask. These are NOT checked!! | ||
- | # if you are using PPPoE, you will still want to define a WAN network so you can | ||
- | # browse the web pages of your ADSL modem! | ||
- | :local wanaddress " | ||
- | :local wannetwork " | ||
- | :local wanbits " | ||
- | # | ||
- | # Define the external gateway | ||
- | # If we are using PPPoE or DHCP, this is not used, otherwise it's our route out to the world | ||
- | # and should probably be the address of your ADSL modem/ | ||
- | :local wangateway " | ||
- | # | ||
- | #### LAN IP Addressing | ||
- | # | ||
- | # Router IP address, network and subnet mask (24 = 255.255.255.0) | ||
- | :local lanaddress " | ||
- | :local lannetwork " | ||
- | :local lanbits " | ||
- | # | ||
- | # | ||
- | #### Wireless Configuration | ||
- | # | ||
- | # This is only used if usewlan, above is " | ||
- | # If you want a wireless LAN, this script sets one up with WPA and WPA2 security. | ||
- | # Define the frequency we want to run on. We suggest you leave this at the default and | ||
- | # tweak it later if required. ' | ||
- | # | ||
- | :local wlanfreq " | ||
- | # Your SSID | ||
- | :local wlanssid " | ||
- | # The Key to use. | ||
- | :local wlankey " | ||
- | # | ||
- | # | ||
- | #### DHCP Server | ||
- | # | ||
- | # We must define a pool of addresses and a server to serve out that pool. | ||
- | # | ||
- | # Act as DHCP server to LAN (yes/no) | ||
- | :local dhcpuse " | ||
- | # | ||
- | # Define the start and end addresses of the pool to offer. | ||
- | :local dhcppoolstart " | ||
- | :local dhcppoolend " | ||
- | # | ||
- | # If required, define the domain. You can probably leave this as the default. | ||
- | :local dhcpdomain ""; | ||
- | # | ||
- | # | ||
- | ################################################################ | ||
- | # Don't change anything below this line. | ||
- | ################################################################ | ||
- | # | ||
- | :put ""; | ||
- | # | ||
- | # Set up logging so we get more than the standard 100 lines. | ||
- | /system logging action set memory memory-lines=500 | ||
- | # | ||
- | :log info " | ||
- | # | ||
- | :local failedtests " | ||
- | # | ||
- | # Check that if we're using an ethernet LAN, the interface defined exists. | ||
- | :if ($useetherlan = " | ||
- | :log error " | ||
- | :set failedtests " | ||
- | } | ||
- | # Check that if we're using a wireless LAN, we have the wireless package installed. | ||
- | :if ($usewlan = " | ||
- | :log error " | ||
- | :set failedtests " | ||
- | } | ||
- | # Check that if we're using a wireless LAN, the interface exists. | ||
- | :if ($usewlan = " | ||
- | :log error " | ||
- | :set failedtests " | ||
- | } | ||
- | # Check that the WAN interface exists | ||
- | :if ([/ | ||
- | :log error " | ||
- | :set failedtests " | ||
- | } | ||
- | # Check that we aren't using the same interface for different purposes | ||
- | :if ((($useetherlan = " | ||
- | (($useetherlan = " | ||
- | (($usewlan = " | ||
- | :log error "two or all of eLAN, wLAN and WAN interfaces are set to the same value"; | ||
- | :set failedtests " | ||
- | } | ||
- | # If we want PPPoE, we need the PPP package. | ||
- | :if ($pppoeuse = " | ||
- | :log error " | ||
- | :set failedtests " | ||
- | } | ||
- | # If we want to be a NTP server, we need the NTP package. | ||
- | :if ($ntpserver = " | ||
- | :log error " | ||
- | :set failedtests " | ||
- | } | ||
- | # | ||
- | # If we've failed any of the tests above, die! | ||
- | :if ($failedtests != " | ||
- | :put ""; | ||
- | :put ""; | ||
- | :error " | ||
- | } | ||
- | # | ||
- | # Clearing out the garbage. | ||
- | /system scheduler remove [find]; | ||
- | /interface bridge remove [find]; | ||
- | /interface bridge port remove [find]; | ||
- | /ip address remove [find]; | ||
- | /ip route remove [find dst-address=0.0.0.0/ | ||
- | /ip dhcp-server remove [find]; | ||
- | /ip pool remove [find]; | ||
- | /ip dhcp-server network remove [find]; | ||
- | /system script remove [find]; | ||
- | /ip firewall address-list remove [find]; | ||
- | /ip firewall nat remove [find]; | ||
- | /ip firewall filter remove [find]; | ||
- | # | ||
- | # Set admin password | ||
- | :log info " | ||
- | /user set admin password=" | ||
- | # | ||
- | # Configure e-mail | ||
- | :log info " | ||
- | /tool e-mail set from=" | ||
- | | ||
- | # | ||
- | # | ||
- | # Get wireless working if required. | ||
- | :if ($usewlan = " | ||
- | :log info " | ||
- | /interface wireless reset-configuration $wlaninterface; | ||
- | /interface wireless security-profiles remove [find name!=default]; | ||
- | /interface wireless security-profiles add \ | ||
- | authentication-types=wpa-psk, | ||
- | unicast-ciphers=aes-ccm mode=dynamic-keys name=autoconfig \ | ||
- | wpa-pre-shared-key=$wlankey wpa2-pre-shared-key=$wlankey; | ||
- | /interface wireless set $wlaninterface band=2ghz-b/ | ||
- | default-authentication=yes default-forwarding=yes disabled=no \ | ||
- | frequency=$wlanfreq mode=ap-bridge wireless-protocol=any\ | ||
- | security-profile=autoconfig channel-width=20/ | ||
- | ssid=$wlanssid ht-txchains=0, | ||
- | mtu=1500 distance=indoors country=" | ||
- | } | ||
- | # | ||
- | # If using an Ethernet as the WAN interface and the bridge interface as the LAN, | ||
- | # we add the wireless and other Ethernet ports to the LAN bridge. | ||
- | # | ||
- | :local internalinterface; | ||
- | :if ($useetherlan = " | ||
- | :if ($usewlan = " | ||
- | :set internalinterface " | ||
- | } else={ | ||
- | :set internalinterface " | ||
- | } | ||
- | } else={ | ||
- | :if ($usewlan = " | ||
- | :set internalinterface " | ||
- | } else={ | ||
- | :set internalinterface " | ||
- | } | ||
- | } | ||
- | # | ||
- | # Set up the bridge and add the interfaces if required. | ||
- | # | ||
- | :if ( $internalinterface = $bridgeinterface ) do={ | ||
- | /interface bridge add comment=" | ||
- | # | ||
- | /interface bridge port add bridge=$bridgeinterface comment=" | ||
- | edge=auto external-fdb=auto horizon=none interface=$etherlaninterface path-cost=10\ | ||
- | point-to-point=auto priority=0x80; | ||
- | # | ||
- | :if ( $bridgetherest = " | ||
- | : | ||
- | : | ||
- | : | ||
- | : | ||
- | :set ethername [/interface get $etherport name]; | ||
- | :if (( $ethername != " | ||
- | / | ||
- | interface=$ethername; | ||
- | :log info "Added $ethername to $bridgeinterface"; | ||
- | } | ||
- | } | ||
- | } | ||
- | # Add the wireless LAN to the bridge | ||
- | /interface bridge port add bridge=$bridgeinterface comment=" | ||
- | | ||
- | } | ||
- | # | ||
- | :log info "Using $internalinterface as the internal interface."; | ||
- | # | ||
- | # Set up interfaces with the correct addresses | ||
- | # | ||
- | :if ($dhcpwan = " | ||
- | /ip dhcp-client add comment=" | ||
- | :log info " | ||
- | } else={ | ||
- | :log info " | ||
- | /ip address add address=" | ||
- | } | ||
- | # | ||
- | # Set LAN address | ||
- | :log info " | ||
- | /ip address add address=" | ||
- | # | ||
- | # | ||
- | # Sort out gateway | ||
- | :if (($pppoeuse != " | ||
- | :log info " | ||
- | /ip route add comment=" | ||
- | } else={ | ||
- | :log info "Not setting gateway as this will be provided by PPPoE or DHCP."; | ||
- | } | ||
- | # | ||
- | # | ||
- | # And DNS | ||
- | :log info " | ||
- | /ip dns set allow-remote-requests=yes cache-max-ttl=1w cache-size=2048KiB \ | ||
- | max-udp-packet-size=512 servers=" | ||
- | # | ||
- | # | ||
- | # Set up DHCP server if required | ||
- | :if ($dhcpuse = " | ||
- | :log info " | ||
- | /ip pool add name=DHCPpool ranges=" | ||
- | /ip dhcp-server network add address=" | ||
- | dns-server=" | ||
- | /ip dhcp-server add address-pool=DHCPpool authoritative=yes disabled=no \ | ||
- | interface=$internalinterface lease-time=3d name=DHCPserver; | ||
- | } else={ | ||
- | :log info " | ||
- | } | ||
- | # | ||
- | # | ||
- | # Set up PPPoE if required | ||
- | :if ($pppoeuse = " | ||
- | /interface pppoe-client remove [find]; | ||
- | :log info " | ||
- | /interface pppoe-client add add-default-route=yes allow=chap comment=" | ||
- | dial-on-demand=no disabled=no interface=$waninterface max-mru=1492 max-mtu=1492 \ | ||
- | mrru=disabled name=" | ||
- | service-name="" | ||
- | } else={ | ||
- | :log info " | ||
- | } | ||
- | # | ||
- | # | ||
- | # Set up NTP client (doesn' | ||
- | :log info " | ||
- | /system ntp client set enabled=yes mode=unicast primary-ntp=" | ||
- | :log info " | ||
- | /system script add name=setntpip policy=ftp, | ||
- | \n:local ntpclientstatus [/system ntp client get status];\r\ | ||
- | \n:if (\$ntpclientstatus=\" | ||
- | \n# Resolve the two ntp hostnames\r\ | ||
- | \n:local ntpipa [:resolve \" | ||
- | \n:local ntpipb [:resolve \" | ||
- | \n/system ntp client set primary-ntp=\" | ||
- | :log info " | ||
- | /system scheduler add comment=" | ||
- | | ||
- | :log info " | ||
- | :execute setntpip; | ||
- | # | ||
- | # | ||
- | # Set up as NTP server | ||
- | :if ($ntpserver = " | ||
- | :log info " | ||
- | /system ntp server set broadcast=no enabled=yes manycast=yes multicast=no; | ||
- | } else={ | ||
- | :log info " | ||
- | } | ||
- | # | ||
- | # | ||
- | # Start with the firewall stuff. | ||
- | # First, define local addresses. | ||
- | :log info " | ||
- | /ip firewall address-list add address=" | ||
- | # | ||
- | # | ||
- | # Set up NAT if required. We need to know which interface to use (PPPoE or WAN) | ||
- | :local natinterface; | ||
- | :if ($natuse = " | ||
- | :if ($pppoeuse = " | ||
- | :log info "Using PPPoE interface for NAT"; | ||
- | :set natinterface " | ||
- | } else={ | ||
- | :log info "Using WAN interface for NAT"; | ||
- | :set natinterface " | ||
- | } | ||
- | :log info " | ||
- | /ip firewall nat add action=masquerade chain=srcnat comment=" | ||
- | } else={ | ||
- | :log info " | ||
- | } | ||
- | # | ||
- | # Enable connection tracking | ||
- | # | ||
- | :log info " | ||
- | # | ||
- | /ip firewall connection tracking | ||
- | set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s tcp-close-wait-timeout=10s\ | ||
- | tcp-established-timeout=1d tcp-fin-wait-timeout=10s tcp-last-ack-timeout=10s tcp-syn-received-timeout=5s\ | ||
- | tcp-syn-sent-timeout=5s tcp-syncookie=no tcp-time-wait-timeout=10s udp-stream-timeout=3m udp-timeout=10s; | ||
- | # | ||
- | # Add filter rules | ||
- | :log info " | ||
- | # | ||
- | /ip firewall filter | ||
- | add chain=input comment=" | ||
- | add chain=input comment=" | ||
- | add chain=input comment=" | ||
- | add chain=input comment=" | ||
- | add chain=input protocol=udp action=accept comment=" | ||
- | add chain=input comment=" | ||
- | add chain=input action=log log-prefix=" | ||
- | add action=drop chain=input comment=" | ||
- | | ||
- | # | ||
- | # | ||
- | # Configure Port Forwarding | ||
- | # | ||
- | :if ($fwdtcpports = " | ||
- | /ip firewall nat add chain=dstnat in-interface=$waninterface protocol=tcp action=dst-nat\ | ||
- | | ||
- | } | ||
- | # | ||
- | # | ||
- | #### Set up some useful scripts | ||
- | # | ||
- | /system script | ||
- | # | ||
- | :log info " | ||
- | /system script add name=setmail policy=ftp, | ||
- | \n:local emailserverip [:resolve \" | ||
- | \n/tool e-mail set server=\" | ||
- | :log info " | ||
- | /system scheduler add comment=" | ||
- | | ||
- | | ||
- | :log info " | ||
- | :execute setmail; | ||
- | # | ||
- | # Automatic backup | ||
- | :log info " | ||
- | /system script add name=makebackup policy=ftp, | ||
- | source=" | ||
- | \n:local SYSname [/system identity get name];\r\ | ||
- | \n:put \" | ||
- | \n/export file=\" | ||
- | \n:log info \" | ||
- | \n/tool e-mail send to=\" | ||
- | \n:delay 10s;\r\ | ||
- | \n/file remove (\$SYSname . \" | ||
- | \n:log info \" | ||
- | :log info " | ||
- | /system scheduler add comment=" | ||
- | on-event=makebackup policy=reboot, | ||
- | start-time=12: | ||
- | # | ||
- | # System startup notification | ||
- | :log info " | ||
- | /system script add name=Systemstartupnotification policy=ftp, | ||
- | \n:local date ([:pick [/system clock get date] 7 11] . [:pick [/system clock get date] 0 3] . [:pick [/system clock get date] 4 6]);\r\ | ||
- | \n\r\ | ||
- | \n:log info \" | ||
- | \n\r\ | ||
- | \n:local filename ([/system identity get name] . \" | ||
- | \n:local fullfilename (\$filename . \" | ||
- | \n\r\ | ||
- | \n/log print file=\$fullfilename; | ||
- | \n\r\ | ||
- | \n/tool e-mail send to=\" | ||
- | \n body=\" | ||
- | \n\r\ | ||
- | \n:delay 10s;\r\ | ||
- | \n\r\ | ||
- | \n/file remove \$fullfilename; | ||
- | \n\r\ | ||
- | \n:log info (\" | ||
- | \n"; | ||
- | :log info " | ||
- | /system scheduler add comment=" | ||
- | policy=reboot, | ||
- | # | ||
- | # | ||
- | # Restart PPPoE if the IP address isn't what we expect | ||
- | :if ($pppoeuse = " | ||
- | /system script add name=checkpppoe policy=ftp, | ||
- | \n# Define the following two\r\ | ||
- | \n#\r\ | ||
- | \n# Name of the PPPoE interface\r\ | ||
- | \n:local pppoeint \" | ||
- | \n:local expectedip \" | ||
- | \n\r\ | ||
- | \n:local curip [/ip address get [find interface=\$pppoeint] address]; | ||
- | \n\r\ | ||
- | \n:if (\$curip != \$expectedip) do={\r\ | ||
- | \n /interface disable \" | ||
- | \n :delay 1s;\r\ | ||
- | \n /interface enable \" | ||
- | \n}\r\ | ||
- | \n\r\ | ||
- | \n" | ||
- | /system scheduler add comment=" | ||
- | policy=reboot, | ||
- | } | ||
- | # | ||
- | # Change the admin service port for web browser management | ||
- | /ip service set www port=$adminport; | ||
- | # | ||
- | :log info "Auto configuration ended."; | ||
- | :put ""; | ||
- | :put ""; | ||
- | :put "Auto configuration ended. Please check the system log."; | ||
- | :put ""; | ||
- | :put "To access the router with a web browser, you must now use port $adminport"; | ||
- | :put ""; | ||
- | </ | ||