Created
April 1, 2025 09:57
-
-
Save njumaen/af4e5e4fa8dab1f6a2fc7fb6f2a95960 to your computer and use it in GitHub Desktop.
GNS3 - RB3011 default config script (run after reset w/o default config)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| :global action "apply"; | |
| #| Welcome to RouterOS! | |
| #| 1) Set a strong router password in the System > Users menu | |
| #| 2) Upgrade the software in the System > Packages menu | |
| #| 3) Enable firewall on untrusted networks | |
| #| ----------------------------------------------------------------------------- | |
| #| RouterMode: | |
| #| * WAN port is protected by firewall and enabled DHCP client | |
| #| * Ethernet interfaces (except WAN port/s) are part of LAN bridge | |
| #| LAN Configuration: | |
| #| IP address 192.168.88.1/24 is set on bridge (LAN port) | |
| #| DHCP Server: enabled; | |
| #| DNS: enabled; | |
| #| WAN (gateway) Configuration: | |
| #| gateway: ether1; | |
| #| ip4 firewall: enabled; | |
| #| ip6 firewall: enabled; | |
| #| NAT: enabled; | |
| #| DHCP Client: enabled; | |
| #| Login | |
| #| admin user protected by password | |
| :global defconfMode; | |
| :log info "Starting defconf script"; | |
| #------------------------------------------------------------------------------- | |
| # Apply configuration. | |
| # these commands are executed after installation or configuration reset | |
| #------------------------------------------------------------------------------- | |
| :if ($action = "apply") do={ | |
| :log info "Applying..."; | |
| # REMOVE DHCP CLIENT !!!! | |
| /ip dhcp-client remove numbers=0; | |
| # wait for interfaces | |
| :local count 0; | |
| :while ([/interface ethernet find] = "") do={ | |
| :if ($count = 30) do={ | |
| :log warning "DefConf: Unable to find ethernet interfaces"; | |
| /quit; | |
| } | |
| :delay 1s; :set count ($count +1); | |
| }; | |
| /interface list add name=WAN comment="defconf" | |
| /interface list add name=LAN comment="defconf" | |
| /interface bridge | |
| add name=bridge disabled=no auto-mac=yes protocol-mode=rstp comment=defconf; | |
| :local bMACIsSet 0; | |
| :foreach k in=[/interface find where !(slave=yes || name="ether1" || passthrough=yes || type=loopback || name~"bridge")] do={ | |
| :local tmpPortName [/interface get $k name]; | |
| :if ($bMACIsSet = 0) do={ | |
| :if ([/interface get $k type] = "ether") do={ | |
| /interface bridge set "bridge" auto-mac=no admin-mac=[/interface get $tmpPortName mac-address]; | |
| :set bMACIsSet 1; | |
| } | |
| } | |
| :if (([/interface get $k type] != "ppp-out") && ([/interface get $k type] != "lte")) do={ | |
| /interface bridge port | |
| add bridge=bridge interface=$tmpPortName comment=defconf; | |
| } | |
| } | |
| /ip pool add name="default-dhcp" ranges=192.168.88.10-192.168.88.254; | |
| /ip dhcp-server | |
| add name=defconf address-pool="default-dhcp" interface=bridge disabled=no; | |
| /ip dhcp-server network | |
| add address=192.168.88.0/24 gateway=192.168.88.1 dns-server=192.168.88.1 comment="defconf"; | |
| /ip address add address=192.168.88.1/24 interface=bridge comment="defconf"; | |
| /ip dns { | |
| set allow-remote-requests=yes | |
| static add name=router.lan address=192.168.88.1 comment=defconf | |
| } | |
| /ip dhcp-client add interface=ether1 disabled=no comment="defconf"; | |
| /interface list member add list=LAN interface=bridge comment="defconf" | |
| /interface list member add list=WAN interface=ether1 comment="defconf" | |
| /ip firewall nat add chain=srcnat out-interface-list=WAN ipsec-policy=out,none action=masquerade comment="defconf: masquerade" | |
| /ip firewall { | |
| filter add chain=input action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked" | |
| filter add chain=input action=drop connection-state=invalid comment="defconf: drop invalid" | |
| filter add chain=input action=accept protocol=icmp comment="defconf: accept ICMP" | |
| filter add chain=input action=accept dst-address=127.0.0.1 comment="defconf: accept to local loopback (for CAPsMAN)" | |
| filter add chain=input action=drop in-interface-list=!LAN comment="defconf: drop all not coming from LAN" | |
| filter add chain=forward action=accept ipsec-policy=in,ipsec comment="defconf: accept in ipsec policy" | |
| filter add chain=forward action=accept ipsec-policy=out,ipsec comment="defconf: accept out ipsec policy" | |
| filter add chain=forward action=fasttrack-connection connection-state=established,related comment="defconf: fasttrack" | |
| filter add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept established,related, untracked" | |
| filter add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid" | |
| filter add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN comment="defconf: drop all from WAN not DSTNATed" | |
| } | |
| /ipv6 firewall { | |
| address-list add list=bad_ipv6 address=::/128 comment="defconf: unspecified address" | |
| address-list add list=bad_ipv6 address=::1 comment="defconf: lo" | |
| address-list add list=bad_ipv6 address=fec0::/10 comment="defconf: site-local" | |
| address-list add list=bad_ipv6 address=::ffff:0:0/96 comment="defconf: ipv4-mapped" | |
| address-list add list=bad_ipv6 address=::/96 comment="defconf: ipv4 compat" | |
| address-list add list=bad_ipv6 address=100::/64 comment="defconf: discard only " | |
| address-list add list=bad_ipv6 address=2001:db8::/32 comment="defconf: documentation" | |
| address-list add list=bad_ipv6 address=2001:10::/28 comment="defconf: ORCHID" | |
| address-list add list=bad_ipv6 address=3ffe::/16 comment="defconf: 6bone" | |
| filter add chain=input action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked" | |
| filter add chain=input action=drop connection-state=invalid comment="defconf: drop invalid" | |
| filter add chain=input action=accept protocol=icmpv6 comment="defconf: accept ICMPv6" | |
| filter add chain=input action=accept protocol=udp dst-port=33434-33534 comment="defconf: accept UDP traceroute" | |
| filter add chain=input action=accept protocol=udp dst-port=546 src-address=fe80::/10 comment="defconf: accept DHCPv6-Client prefix delegation." | |
| filter add chain=input action=accept protocol=udp dst-port=500,4500 comment="defconf: accept IKE" | |
| filter add chain=input action=accept protocol=ipsec-ah comment="defconf: accept ipsec AH" | |
| filter add chain=input action=accept protocol=ipsec-esp comment="defconf: accept ipsec ESP" | |
| filter add chain=input action=accept ipsec-policy=in,ipsec comment="defconf: accept all that matches ipsec policy" | |
| filter add chain=input action=drop in-interface-list=!LAN comment="defconf: drop everything else not coming from LAN" | |
| filter add chain=forward action=fasttrack-connection connection-state=established,related comment="defconf: fasttrack6" | |
| filter add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked" | |
| filter add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid" | |
| filter add chain=forward action=drop src-address-list=bad_ipv6 comment="defconf: drop packets with bad src ipv6" | |
| filter add chain=forward action=drop dst-address-list=bad_ipv6 comment="defconf: drop packets with bad dst ipv6" | |
| filter add chain=forward action=drop protocol=icmpv6 hop-limit=equal:1 comment="defconf: rfc4890 drop hop-limit=1" | |
| filter add chain=forward action=accept protocol=icmpv6 comment="defconf: accept ICMPv6" | |
| filter add chain=forward action=accept protocol=139 comment="defconf: accept HIP" | |
| filter add chain=forward action=accept protocol=udp dst-port=500,4500 comment="defconf: accept IKE" | |
| filter add chain=forward action=accept protocol=ipsec-ah comment="defconf: accept ipsec AH" | |
| filter add chain=forward action=accept protocol=ipsec-esp comment="defconf: accept ipsec ESP" | |
| filter add chain=forward action=accept ipsec-policy=in,ipsec comment="defconf: accept all that matches ipsec policy" | |
| filter add chain=forward action=drop in-interface-list=!LAN comment="defconf: drop everything else not coming from LAN" | |
| } | |
| /ip neighbor discovery-settings set discover-interface-list=LAN | |
| /tool mac-server set allowed-interface-list=LAN | |
| /tool mac-server mac-winbox set allowed-interface-list=LAN | |
| /disk settings | |
| set auto-smb-sharing=yes auto-media-sharing=yes auto-media-interface=bridge | |
| } | |
| :log info Defconf_script_finished; | |
| :set defconfMode; |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I like GNS3 and the RB3011 template but it lacks by default the firewall, etc. of the default config of a real RB3011. Therefore let's fix this!
(Upload file)
/system/reset-configuration no-defaults=yes
(system reboots)
/import gns3-rb3011-apply-default.rsc