Skip to content

Add RouterOS 6 setup script and translate ROS7 script to Russian - #32

Merged
gpas45 merged 4 commits into
mainfrom
claude/initial-setup-script-analysis-eno3r5
Jul 30, 2026
Merged

Add RouterOS 6 setup script and translate ROS7 script to Russian#32
gpas45 merged 4 commits into
mainfrom
claude/initial-setup-script-analysis-eno3r5

Conversation

@gpas45

@gpas45 gpas45 commented Jul 30, 2026

Copy link
Copy Markdown
Owner

Summary

This PR adds a RouterOS 6-specific initial setup script and translates the existing RouterOS 7 setup script to Russian, making the configuration templates more accessible to Russian-speaking users and supporting both RouterOS versions with version-specific syntax.

Key Changes

  • New file: initial-setup-ros6.rsc — Complete initial setup script for RouterOS 6 with:

    • Bridge and interface list configuration (WAN/LAN/StS/VPN)
    • Comprehensive firewall rules (input/forward chains, port knocking, anti-bruteforce detection)
    • NAT masquerading for LAN-to-Internet traffic
    • DNS resolver configuration
    • Service hardening (disabled telnet, ftp, www, api; restricted MAC-server access)
    • Package disabling (hotspot, ipv6, mpls) with RouterOS 6-specific syntax
    • NTP client/server configuration using RouterOS 6 syntax (server-dns-names instead of servers)
    • OSPF routing filters with RouterOS 6 prefix-list syntax
    • RouterBOARD firmware auto-upgrade scheduler
  • Updated: initial-setup-ros7.rsc — Translated to Russian with:

    • All comments and documentation converted to Russian
    • Added clarifications about RouterOS 7-specific syntax differences
    • Enhanced firewall rules with disabled VPN/tunnel protocol rules (IPsec, L2TP, GRE) for optional enablement
    • Improved comments explaining the passthrough action for safe initial setup
    • Updated MAC-server configuration to restrict to LAN interface list
    • RouterOS 7-specific NTP syntax (servers= property instead of submenu)
    • RouterOS 7-specific IPv6 disabling via settings instead of package removal
    • RouterOS 7-specific logging topics (wifi instead of wireless)
    • RouterOS 7-specific OSPF filter rule syntax
  • Updated: README.md — Added reference to the new RouterOS 6 setup script in the file listing

Notable Implementation Details

  • Both scripts use action=passthrough for "drop all other" rules during initial setup to prevent accidental lockout, with clear documentation to switch to action=drop after verification
  • Port knocking implementation with three-stage sequence (1234 → 2345 → 3456 → 12345)
  • Anti-bruteforce detection using dst-limit and address list management
  • OSPF filters restricted to RFC1918 private address ranges
  • Intentional omission of provider-specific settings (addresses, routes, DHCP, passwords) for flexibility across deployments
  • Version-specific syntax handling clearly documented in comments for users switching between RouterOS versions

https://claude.ai/code/session_01UXAWR3BJ7yjfpE7STGCtvT

claude added 4 commits July 30, 2026 03:11
…sable

- Add usage note (item 4) clarifying that the "drop all other" filter rules
  intentionally use action=passthrough and must be switched to action=drop
  after verification.
- Translate all documentation and config comments to Russian.
- Disable unused RouterOS 6 packages (hotspot, ipv6, mpls); this replaces the
  ROS7-only /ipv6 settings disable-ipv6 block for IPv6.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UXAWR3BJ7yjfpE7STGCtvT
…mments)

- Replace initial-setup.rsc with initial-setup-ros6.rsc and
  initial-setup-ros7.rsc; restore English comments.
- ROS7 variant: NTP servers as a client property, /ipv6 settings disable,
  routing-filter rule="if(...)" syntax, wifi logging topic.
- ROS6 variant: NTP server-dns-names, IPv6 off via /system package disable
  (hotspot, ipv6, mpls), /routing filter prefix syntax, wireless logging topic.
- Both keep the action=passthrough "drop all other" rules with usage note 4
  explaining they must be switched to action=drop after verification.
- Update README table for the two variants.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UXAWR3BJ7yjfpE7STGCtvT
- Descriptions (# comments) in Russian; config comment= fields kept English.
- Enable api-ssl (disabled=no).
- Restrict mac-server / mac-winbox to the LAN interface list and disable
  mac-server ping.
- Comment out the example WAN interface-list member (add per deployment).
- Add disabled input rules to accept GRE / L2TP / IPsec (IKE 500/4500, ESP,
  AH) so tunnel termination can be enabled when needed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UXAWR3BJ7yjfpE7STGCtvT
…script-analysis-eno3r5

# Conflicts:
#	routeros/initial-setup-ros7.rsc
@gpas45
gpas45 merged commit bd77a2e into main Jul 30, 2026
1 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants